cries in git
No Cookie for You
331–340 of 634 posts
Re: No Cookie for You
#332All aboaaaard!
We recently removed Google Analytics and switched to apache server logs. It was the only 3rd party cookie our site was using, and the apache logs are far more transparent. (No one understands or trusts the analytics from google, and no one has the time, they only want to see certain bumps for certain pages).
Re: No Cookie for You
#333Earlier quoted context omitted.
True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets
IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This…
> IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent.
Only if there is a bijection between the identifier and the IP address, so that you could re-derive the IP address from the identifier. Otherwise, I do not see how the identifier itself would count as PII.
This way of divorcing data from PII by replacing it with pseudonymous identifiers which cannot be linked back is a relatively standard technique for this.
Re: No Cookie for You
#334Earlier quoted context omitted.
IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This…
My understanding is that this kind of active consent that we see as popups everywhere on the web nowadays applies to cookies only. So I would assume that if you can track user activity without a cookie you wouldn't need it. It should probably be stated in the privacy policy though. I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.
GDPR doesn't care if you're accomplishing the tracking with a cookie or using a different mechanism. You're not allowed to do it either way, unless the user has consented.
Re: No Cookie for You
#335This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…
If you don’t have to actually make money though, there isn’t really a point to the analytics third parties enable - eliminating bots and click fraud. Microsoft managers are incentivized to not identify bot or noise traffic, since their performance metrics do not separate those.
It is harder than that. I would for example like to use google maps api - but I cant.
Re: No Cookie for You
#336Have GitHub credentials on your machine and interacting with the service is the most valuable data for GitHub. They probably have something in the terms that they can use this data.
So I see this more like a warning, than a positive thing.
Re: No Cookie for You
#337Earlier quoted context omitted.
Right but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for , right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, w…
Are we claiming that if GitHub has a dashboard like “number of concurrent sessions” and “average length of session” and “unique users who touched this feature” it would be a GDPR violation? Because I can’t imagine that they don’t.
I don’t think this is a problem for GDPR. As long as there’s no personal data involved you can count active sessions, aggregate data etc
Re: No Cookie for You
#338Earlier quoted context omitted.
True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets
Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…
https://simpleanalytics.com/
Says this on their homepage:
We don't use cookies or collect any personal data. So no cookie banners, GDPR, CCPA, or PECR to worry about.
Seems like a cool company/project to me.
But, it's not free :( $19/mo Still thought it's worth pointing out.
Re: No Cookie for You
#339So instead they’re doing 1st party taking, which I think is not allowed.
Re: No Cookie for You
#340Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data. The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com. The privacy policy page which lists third part…
Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…
Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law.
GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.