Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

91–100 of 634 posts

Re: No Cookie for You

#91

Post by smarx007 »

outside1234 wrote: post #79
smarx007 wrote: post #41

Earlier quoted context omitted.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

They can't apply EU law to citizens residing outside of the union.

Well, somehow we in EU have to comply with DMCA, which is not an EU law. Every company that _does business in_ EU can get in trouble for not following EU law irrespective where it violated that law.

Re: No Cookie for You

#92

Post by mirekrusin »

s14ve wrote: post #86
AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

This wording should be required by GDPR. :) If that would be the case, maybe more sites would follow GitHub here.

Yes, like on cigarette boxes with mandatory, non-dark pattern, visible without scrolling 3 meters button to choose "Don't agree, Continue".

Re: No Cookie for You

#93

Post by mschoening »

notJim wrote: post #49

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

Good question! We just shipped GitHub Discussions to millions of developers and we can learn whether people use and like the product by looking at whether people are creating discussions, customizing categories, and answering questions.

The argument that you need to follow users around every step of the way to build great products is simply untrue.

Re: No Cookie for You

#94

Post by throwaway2245 »

brtkdotse wrote: post #28
austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.

I believe it is generally untested in law whether third-party Analytics count as "legitimate interest" (direct consent not required) in EU GDPR, which is why cookie banners talk a lot about "legitimate interest" now.

Re: No Cookie for You

#95

Post by colejohnson66 »

tuna-piano wrote: post #54
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

I’m guessing a cookie with an expiration of 24 hours, but I could be wrong

Re: No Cookie for You

#96

Post by dathinab »

smarx007 wrote: post #41
dheera wrote: post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

And as far as I know there is no ruling that using a VPN or other kind of proxy does make you count as "being in the country of the exit node wrt. actions done through the VPN".

Which means that you can't say a user is not residing in the EU (without a popup asking the user if they are residing there... ;=) ).

On the other hand if there would be such a law it would have kinda interesting consequences.

Re: No Cookie for You

#97

Post by lloeki »

SilasX wrote: post #58
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Right but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for , right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, w…

> then you still can’t use those cookies for other purposes, like analytics, right?

Yes. It’s not the cookies, it’s what you make the use of them.

The wording even predates GDPR. You could even dispense of the banner if you had DNT set to 1 or 0, since that would count as consent/not consent resp.

Re: No Cookie for You

#98

Post by closeparen »

SilasX wrote: post #58
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Right but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for , right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, w…

Are we claiming that if GitHub has a dashboard like “number of concurrent sessions” and “average length of session” and “unique users who touched this feature” it would be a GDPR violation?

Because I can’t imagine that they don’t.

Re: No Cookie for You

#99

Post by munchbunny »

baxtr wrote: post #72
dheera wrote: post #33

Earlier quoted context omitted.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

I take the time to check what I'm agreeing to.

By law it's default opt out for non-essential usages specifically to deal with people who are annoyed, but not everyone plays by the rules.

Re: No Cookie for You

#100

Post by jorams »

kayson wrote: post #9

If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.

They appear to be using a self-hosted analytics solution. Every page makes a request to collector.githubapp.com.
Post reply on HN