Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do cookie-free analytics need cookie banners?

jfagerberg.me

Post reply on HN
Print view View original

21–30 of 88 posts

Re: Do cookie-free analytics need cookie banners?

#21

Post by ryan-c »

MartijnHols wrote: post #5
Vampiero wrote: post #2

If they're doing fingerprinting then they're clearly collecting too much data. If they need javascript to collect their metrics, they're clearly collecting too much data.

I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?

I do that, plus a little more (page being closed), with an identifier in session storage. If doNotTrack is turned on, the session storage is skipped.

I do not have a consent banner, and I do not believe that I need one.

Re: Do cookie-free analytics need cookie banners?

#22

Post by otherme123 »

fguerraz wrote: post #8

Do you really need analytics that much? Enjoy my cookie and analytics free website: https://www.ZoneHero.io I had to resist a lot of temptations, but hey, no banners!

Some sites need them, or they would not exist. A page with ads, where the advertisers what to know, at mleast, how many times their ad was displayed. They have an aproximation of this number for printed press, for TV, for the radio.

I have a lot of sites that are also banner free, but they are paid with other means (usually grants). But when the money ends, the sites go down.

The sad thing with analytics is that the dreadful banner makes it look like my site that only sets a cookie to know what is an unique visitor looks the same than other site that collects hundreds of data variables and then sell the data to hundreds of third parts, making the data sharing a business in itself.

Re: Do cookie-free analytics need cookie banners?

#23

Post by pjerem »

MartijnHols wrote: post #5
Vampiero wrote: post #2

If they're doing fingerprinting then they're clearly collecting too much data. If they need javascript to collect their metrics, they're clearly collecting too much data.

I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?

You can collect anything without limits as long as you don’t associate this data with identification data / profiles.

An amount of visitors isn’t creating any privacy concern. That would be another situation if you stored individual completion rates associated with, say, an IP or worse, an user account. You would still technically be able to do it but not without clear consent from the user.

Re: Do cookie-free analytics need cookie banners?

#25

Post by ryan-c »

choeger wrote: post #3

In the end, it all boils down to this: 1. It is trivial to have a metric about how many requests were made for a link on a site, say a/ 2. It is legally very much non-trivial to have a metric about how many requests were made to a/ followed by requests to b/ One way to solve 2. would be to change links based on earlier interaction server-side. So instead of [a/, b/], the requests would be [a/, a.b/] IMO, this should…

You can turn on the referrer header for same site, however I suspect the author would argue that this would be contrary to GDPR. There is also the ping attribute on links, but again, if we accept the author's premise...

Re: Do cookie-free analytics need cookie banners?

#26

Post by legitster »

3s wrote: post #15
legitster wrote: post #11

This is a world I am very familiar with in my day job. IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. (While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for an…

Curious to know why browser fingerprinting has a “half life” of 24h? I always assumed it would be more static compared to an IP address and therefore a more powerful tracking mechanism (albeit more shady / less legally understood compared to using IPs).

Most of the non-IP components of fingerprinting are pretty goofy things like browser version, device, screen size, etc. If you are dealing with web traffic in any meaningful number, you have to dip into really minute details to tell apart visitor 10,001 from 10,002.

More often than not, the details that make your device unique on one day will not stay unique by day two. Your browser might change versions, you might resize your viewport, install a font, etc.

I believe phone apps can get more conclusive device IDs via the SDK, but for web traffic cookies and IP addresses are still the only reliable identifiers. I would take any study or hypothetical about fingerprinting with a massive grain of salt if they don't keep a stable match for 30 days.

Re: Do cookie-free analytics need cookie banners?

#27

Post by legitster »

iamacyborg wrote: post #16
legitster wrote: post #11

This is a world I am very familiar with in my day job. IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. (While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for an…

> IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. Probably more helpful to phrase this as Personal Data instead of “PII” as the latter does not appear in the GDPR once and the former is much broader in scope than pii data.

Sorry! PII is still the industry shorthand.

Re: Do cookie-free analytics need cookie banners?

#28

Post by [deleted] »

oneeyedpigeon wrote: post #9
archerx wrote: post #4

This whole cookie banner situation is a disaster. Companies know that you will not accept their cookies and have decided to use the "legitimate interest" loop hole. So if you select reject all cookie, the legitimate interest ones are not rejected unless you go an uncheck them manually. https://old.reddit.com/r/mildlyinfuriating/comments/1cn306c/... Here is an example of what I am talking about, I think some companies…

> https://adnauseam.io/ I'm not sure this is a good thing. Wouldn't this make advertisers think their ads are doing better than they are? Which would then encourage them to advertise even more?

[deleted]

Re: Do cookie-free analytics need cookie banners?

#30

Post by nwellnhof »

> Note: I am not a lawyer.

> We’ll be focusing our efforts on the ePrivacy Directive,

The author doesn't seem to know that an EU Directive is not binding law. They're mostly irrelevant. It only matters how member states implement Directives. Some states like Germany didn't change any laws at all regarding the EPD.

EU Regulations like the GDPR are different.

Post reply on HN