I find it annoying that 3rd party analytics gets lumped in with ad tracking. Analytics is incredibly useful for improving products, it lets you see where users are having a hard time and it lets you do experiments and measure the results. It's beneficial to both the user and the company, it's a win-win.
No Cookie for You
51–60 of 634 posts
Re: No Cookie for You
#52Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.
Yeah here’s what it says about “necessary processing,” which does not require user consent.
Note GDPR never mentions cookies, or cookie banners. It regulates the control and processing of personal information (which can be stored in cookies).
https://gdpr.algolia.com/gdpr-article-6
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Re: No Cookie for You
#53How do you do site analytics?
The same without tracking users with personally identifiable information. You know how many people clicked on which button, but you don't know that the user 05475524789 who clicked on the button lives in South Europe, has HIV, and is interested in video games and vacuum cleaners.
Re: No Cookie for You
#54A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.
True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets
Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page?
I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day."
But where is that ID stored?
Re: No Cookie for You
#55Earlier quoted context omitted.
Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.
They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.
Sounds like a security nightmare.
Re: No Cookie for You
#56I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?
You could still self-host an analytics solution. Just don't share that data with 3rd parties.
Re: No Cookie for You
#57I love it! As a web developer, cookie warnings infuriate me probably more than they should as at least half of the time they aren't actually either required (only essential) or effective (doesn't actually compy, just annoys).
I've had clients straight up demand I should add an ugly cookie warning to the beautiful site I spent a month designing "because it's the law". Then, when I asked them to provide a full privacy policy to go with it, I've often gotten the response to "just leave it empty, nobody actually reads that". Thankfully, I'm stubborn enough to have always been successful in convincing them that maaaybe they should listen to the person who does this stff for a living and not a sensationalist Medium article...
Re: No Cookie for You
#58A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.
Right but it still seems like this could violate the GDPR, right? They say:
>>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services.
But you’re still only allowed to use the cookies for the purpose the user gave you them for, right?
So, if:
a) the cookies are essential for the user session, and
b) you collect the cookies, without explicit permission, to maintain that session
then you still can’t use those cookies for other purposes, like analytics, right?
Edit: sorry for all the “rights?”, just want to make clear I don’t convey high confidence in this claim.
Re: No Cookie for You
#59Earlier quoted context omitted.
Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.
They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.
That's disgusting. And it's like saying roads aren't essential because cars can drive on dirt.
Re: No Cookie for You
#60Earlier quoted context omitted.
Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.
They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.
>a URL parameter
I love those systems. Especially when the unwary users share links, accidentally letting other users into the site as them. Or when google indexes it, and in addition to terrible security, the site uses regular GET links to perform site actions, so google deletes the user's content or buys a bunch of stuff as them while walking the links it finds as it indexes in beyond the user's initial account bearing link.
lol. no.