51–60 of 118 posts
Remember the time when every serious homepage had a visitor counter? I don't recall any issues with privacy laws in those days. I think "tracking" back then was decentralized?
- the laws and public awareness just weren't there yet and it would be illegal without consent now
or
- it was something simple without cookies, like an image that automatically incremented a counter when requested
GDPR does not require cookie banner at all for this use case. GDPR is not about cookie banners at all. It is about consent of using personal or identifiable information. It is about safely processing data and not collection personal information that you were not permitted to have. This gets tricky as IP is recognized as private information in EU. This can be solved by telling GA to not collect it.
Google Analytics does not require you to post cookie banner, but you have to inform user on your privacy policy page that you are tracking their "anonymous" activity. How much it is anonymous knows only Google. Source: https://marketingplatform.google.com/about/analytics/terms/u... section "7. Privacy"
What requires consent banner is Google Ads! Google is through you creating unique profile for each visitor that makes him identifiable. This is in direct conflict of GDPR that prohibits such behavior without explicit consent. So mere "We are storing cookies. > Accept I am also not lawyer, but I was involved in implementation of this for e-commerce.
Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…
Tracking users is unethical. The law is there not so that you can wiggle your way around it, but to make a statement about this behavior. Laws are not scripts and they are not interpreted by computers. You are going to get fined for doing this, and it'll be well deserved. Do not spy on people. It's that simple. Don't use google analytics. Don't use any of the dozens of alternatives which are selling you "pro-privacy"…
Calling it spying is hyperbole, and thrusting your personal ethics on others is nonproductive. If analytics turn you off, there are plenty of browser extensions which will block them on your behalf. uBlock Origin is the most common example. https://github.com/gorhill/uBlock
Tracking users is unethical. The law is there not so that you can wiggle your way around it, but to make a statement about this behavior. Laws are not scripts and they are not interpreted by computers. You are going to get fined for doing this, and it'll be well deserved. Do not spy on people. It's that simple. Don't use google analytics. Don't use any of the dozens of alternatives which are selling you "pro-privacy"…
It's how people utilise it that has an ethical/moral component.
Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…
Additionally you are now doing an additional request to Cloudflare, which probably requires you to link to their privacy policy for that service?
But if IP was considered personal data you would need an active consent from the user where you also inform them why you are doing this, which paragraph in GDPR gives you legal right to do this, how long the data is stored and you will need a data processing agreement with Cloudflare. You will also need to be able to prove that you made sufficient effort to make sure you are not handling data of someone under 16 years of age.
People often think that GDPR is made to forbid processing of personal data. Actually you can pretty much do anything with peoples information and still be GDPR compliant. It's more that it becomes such a hassle to do it and still be compliant that it's just not worth it to collect personal data "just because you can".
Earlier quoted context omitted.
"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.
Just read up on it and it's actually a bit more detailed, it requires active consent. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... Statement 82 reads: "The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions thatrequire an intervention from the data subject to prevent agreement(for example ‘opt-out boxes’)." This in my mind pretty much invalidates most of the existing…
Earlier quoted context omitted.
Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies. You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner. You can use your server logs to measure your audience.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
Look, I'm not that much into respecting laws for the sake of respecting laws. I actually don't really like rules all that much. And there are shitty laws. GDPR and speed limits aren't in my opinion though. I find them sensible. If you think they are not, I got you covered with my civic disobedience parenthesis.
That said, breaking the law has risks, you cannot lightly advise people breaking it as they feel like it.
Where did you read that I want cookie banners? They ask me whether I want to be tracked. They are nonsense, often bad UX, and often riddled with dark patterns. The GDPR never forced anyone to implement them. It requires explicit consent for tracking in essence, which cookie banners often do a very bad job of.
If you think that as a visitor I am not going to opt in, don't ask me, and definitely don't force me into it with dark patterns. If you think your cookie banner is going to annoy me, well don't design your website this way, or you are not being coherent. Or, more accurately, you are solving a problem that is yours, not mine, and yet putting the burden on me.
Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…
Yes since GDPR states that personal data is any piece of information that uniquely identifies a living person, creating a unique identifier for each visitor by definition will make you a data processor.
IP addresses are slightly different because that address can be used to identify the subscriber in certain cases (who in turn may or may not be an individual).
Earlier quoted context omitted.
"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.
If it simply stated what you say (may I have the quote?), few would be in violation of it, again as you say.
And this is not for cookies required for technical reasons (seesion cookies and cookies to save preferences) - you don't need consent for them. Only for marketing / statistical cookies. See [1], it does a good job of explaining this.