31–40 of 88 posts
Earlier quoted context omitted.
> https://adnauseam.io/ I'm not sure this is a good thing. Wouldn't this make advertisers think their ads are doing better than they are? Which would then encourage them to advertise even more?
No, it will ad noise to their data and make their profile of me a mess and very inaccurate. If they make models from this data it will be fundamentally flawed (Garbage in = Garbage out)
EU law is very much based on interpretation and “spirit” of the law and Plausible lawyers just think its enough to not be able track individuals but track overall flows of masses.
> All web analytics need to somehow track individual users.
Wrong.
Suitably anonymised, unintrusive first-party statistical analytics are fine. Stalking users is not.
ObDisclosure: I used to wear the DPO hat in my previous job, and assist in the practicalities in my current one.
The article picks Fathom fingerprinting but there are differences. Other services like Plausible also include time element. So to plausible every day you are someone else. Unlike Fathom, Plausible cannot track unique visitors per month. Fathom is pretty sneaky here and its not surprising because they have been pretty sketchy in past. EU law is very much based on interpretation and “spirit” of the law and Plausible la…
Earlier quoted context omitted.
I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?
You can collect anything without limits as long as you don’t associate this data with identification data / profiles. An amount of visitors isn’t creating any privacy concern. That would be another situation if you stored individual completion rates associated with, say, an IP or worse, an user account. You would still technically be able to do it but not without clear consent from the user.
Your answer aligns with GDPR, but cookie banners come from the ePrivacy directive. The author is one of the few to describe it well.
Earlier quoted context omitted.
I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?
I do that, plus a little more (page being closed), with an identifier in session storage. If doNotTrack is turned on, the session storage is skipped. I do not have a consent banner, and I do not believe that I need one.
In the end, it all boils down to this: 1. It is trivial to have a metric about how many requests were made for a link on a site, say a/ 2. It is legally very much non-trivial to have a metric about how many requests were made to a/ followed by requests to b/ One way to solve 2. would be to change links based on earlier interaction server-side. So instead of [a/, b/], the requests would be [a/, a.b/] IMO, this should…
There's a distinction between first-party data and third-party data. You can view your own server logs - but sending over user data to a service like Google Analytics is what is regulated.
This is a world I am very familiar with in my day job. IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. (While it's theoretically possible to do analytics on someone without an IP address, browser fingerprinting alone has a half life of ~24 hours. It's not a reliable enough indicator for an…
> IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent. Probably more helpful to phrase this as Personal Data instead of “PII” as the latter does not appear in the GDPR once and the former is much broader in scope than pii data.
For example "likes french fries" is "personal data" in the general sense but not gdpr since it is not identifiable since you cant figure out who it is talking about. Your name, address, etc is identifiable because it can be tied to a physical person.
> Note: I am not a lawyer. > We’ll be focusing our efforts on the ePrivacy Directive, The author doesn't seem to know that an EU Directive is not binding law. They're mostly irrelevant. It only matters how member states implement Directives. Some states like Germany didn't change any laws at all regarding the EPD. EU Regulations like the GDPR are different.
This whole cookie banner situation is a disaster. Companies know that you will not accept their cookies and have decided to use the "legitimate interest" loop hole. So if you select reject all cookie, the legitimate interest ones are not rejected unless you go an uncheck them manually. https://old.reddit.com/r/mildlyinfuriating/comments/1cn306c/... Here is an example of what I am talking about, I think some companies…