How to track users for analytics in a privacy-first, cookie-less future • Hacker News Board

Re: How to track users for analytics in a privacy-first, cookie-less future

#51

Post by kcartlidge » Fri, Jun 18, 2021, 7:53 AM UTC

This is so wrong.

All data that is collected whilst a user is anonymous was done so under the condition of anonymity. Breaking that anonymity by assigning unknown-user data to the now-known user is retroactively changing that user's consent without getting their agreement. Like saying "I know you chose not to be tracked, but now we've had some interaction with you we don't think you meant it". But on what basis?

Not only is this morally/ethically incorrect, it is probably illegal as it is a clear violation of data collection laws. Consent was not given for those prior activities to be tracked. Current consent does not change that.

Edit: Even the suggestion that the stitching together of the data could use the non-PII that was obtained does not get around the fact that permission was not given and by joining the sessions/activity that way you would in fact be de-anonymising (non-PII gets associated with PII).

Re: How to track users for analytics in a privacy-first, cookie-less future

#52

Post by kcartlidge » Fri, Jun 18, 2021, 11:55 AM UTC

bouzouk wrote: post #22

We do it a bit differently (French company). Since the only cookie that is endangered is the « third party cookie », it is very much ok to store anonymous session information in a first party cookie for all anonymous visitors. So we store page views and utm there, and capture this data in the datawarehouse when (and only when) there is a conversion. This is also working with returning visitors (who most likely kept t…

> Since the only cookie that is endangered is the « third party cookie »

Data protection regulations (esp. GDPR) are totally unconcerned with the distinction between first and third party cookies. They are concerned with data collection permissions and scopes, regardless of the technology used.

If you are capturing information which is not essential to the service/product you are offering at that moment and in that session, then you need specific permission - even for your own cookies. And if you did not have that permission at the time it was collected then you cannot merge it into records after conversion.

Re: How to track users for analytics in a privacy-first, cookie-less future

#53

Post by tatersolid » Tue, Jun 22, 2021, 2:49 AM UTC

garciasn wrote: post #8

cedricd wrote: post #7

Earlier quoted context omitted.

The identifier on the urls isn't meant to identify the actual user I think. If you look at the examples given they're more like identifiers to something else -- an order id or subscription id. Wouldn't tracking something like an order (but not the user directly) be ok with GDPR?

A company may store both customer data and order data and keep them under GDPR, because a particular customer provided it knowingly. The important piece is when a customer asks to be removed, the company must remove their customer data (e.g. their name and address) but the order information can remain orphaned in order to do analyses on revenue, orders, etc. The right to be forgotten is ONLY about customer data, not…

Actually even the personal details associated with the order often must be kept even if a person requests their removal. The GDPR doesn’t trump other financial, consumer protection, and anti-fraud laws.

Example: if you buy a lawnmower, the seller may he required to notify you of any safety recalls for many years (depending on location). GDPR does not change this requirement for saving personal contact data with the order data, even if the buyer later says “forget me”.