Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do cookie-free analytics need cookie banners?

jfagerberg.me

Post reply on HN
Print view View original

11–20 of 88 posts

Re: Do cookie-free analytics need cookie banners?

#11

Post by legitster »

This is a world I am very familiar with in my day job.

IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent.

(While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for any business purposes.)

But it's all kind of moot anyway. It hasn't been extensively tested by case law, so no corporate lawyer is going to tell you to go with the innovative black box solution.

In our industry, we all await for the completion of the ePrivacy directive. But I suspect regulators have put themselves into a bit of a corner. At the end of the day, TCP/IP is inherently a non-anonymous protocol. Your identifiers are baked into the architecture of the internet as fundamentally as your home address is known to the mail system and your license plate is to the transit system.

Re: Do cookie-free analytics need cookie banners?

#13

Post by legitster »

archerx wrote: post #4

This whole cookie banner situation is a disaster. Companies know that you will not accept their cookies and have decided to use the "legitimate interest" loop hole. So if you select reject all cookie, the legitimate interest ones are not rejected unless you go an uncheck them manually. https://old.reddit.com/r/mildlyinfuriating/comments/1cn306c/... Here is an example of what I am talking about, I think some companies…

I regret to inform you that solutions like Ad Naseum are snake oil.

Bot-clicks and LLM networks are already pretty pervasive clickers of ads. Most ad networks already have ways of filtering out noisy clicks. And anyone dumping real money into ads will be smart enough to tie their ROI to conversion events, not clicks.

Re: Do cookie-free analytics need cookie banners?

#15

Post by 3s »

legitster wrote: post #11

This is a world I am very familiar with in my day job. IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. (While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for an…

Curious to know why browser fingerprinting has a “half life” of 24h? I always assumed it would be more static compared to an IP address and therefore a more powerful tracking mechanism (albeit more shady / less legally understood compared to using IPs).

Re: Do cookie-free analytics need cookie banners?

#16

Post by iamacyborg »

legitster wrote: post #11

This is a world I am very familiar with in my day job. IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. (While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for an…

> IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent.

Probably more helpful to phrase this as Personal Data instead of “PII” as the latter does not appear in the GDPR once and the former is much broader in scope than pii data.

Re: Do cookie-free analytics need cookie banners?

#17

Post by legitster »

choeger wrote: post #3

In the end, it all boils down to this: 1. It is trivial to have a metric about how many requests were made for a link on a site, say a/ 2. It is legally very much non-trivial to have a metric about how many requests were made to a/ followed by requests to b/ One way to solve 2. would be to change links based on earlier interaction server-side. So instead of [a/, b/], the requests would be [a/, a.b/] IMO, this should…

There's a distinction between first-party data and third-party data. You can view your own server logs - but sending over user data to a service like Google Analytics is what is regulated.

Re: Do cookie-free analytics need cookie banners?

#18

Post by Moru »

bluepuma77 wrote: post #6
choeger wrote: post #3

In the end, it all boils down to this: 1. It is trivial to have a metric about how many requests were made for a link on a site, say a/ 2. It is legally very much non-trivial to have a metric about how many requests were made to a/ followed by requests to b/ One way to solve 2. would be to change links based on earlier interaction server-side. So instead of [a/, b/], the requests would be [a/, a.b/] IMO, this should…

Sounds like the early days of the web, when cookies weren’t widely used. User sessions were created with a URL query parameter, like `?sessionid=`, and every page would pick up the sessionid and include it in every link on the page.

That is just cookies. What GP was suggesting was a history trail, not a session id.

Re: Do cookie-free analytics need cookie banners?

#19

Post by almostnormal »

oneeyedpigeon wrote: post #9
archerx wrote: post #4

This whole cookie banner situation is a disaster. Companies know that you will not accept their cookies and have decided to use the "legitimate interest" loop hole. So if you select reject all cookie, the legitimate interest ones are not rejected unless you go an uncheck them manually. https://old.reddit.com/r/mildlyinfuriating/comments/1cn306c/... Here is an example of what I am talking about, I think some companies…

> https://adnauseam.io/ I'm not sure this is a good thing. Wouldn't this make advertisers think their ads are doing better than they are? Which would then encourage them to advertise even more?

Ads are doing worse, not better. The purpose of an ad isn't to be clicked but to increase revenue. In the end of the year data will show clicks have gone up but other more important metrics haven't.

Who is guilty for tracking users? The site relying an income from ads with user-tracking, or the company buying the ads based on tracking instead of some less invasive method of distribution?

Post reply on HN