No Cookie for You • Hacker News Board

Re: No Cookie for You

#41

Post by smarx007 » Thu, Dec 17, 2020, 5:32 PM UTC

dheera wrote: post #33

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Also, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.

No, it applies to every resident in EU and EU citizens all over the world.

Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively)

Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”"

Re: No Cookie for You

#42

Post by shuckles » Thu, Dec 17, 2020, 5:32 PM UTC

louhike wrote: post #38

geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

Re: No Cookie for You

#43

Post by sjs382 » Thu, Dec 17, 2020, 5:33 PM UTC

3pt14159 wrote: post #15

This is great! GitHub continues to, somehow, surprise me. One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio's location settings. If it is truly unmasking people's location I think it should be opt-in only…

I spot-tested a three of them and for each one I tested, it matched the information from the user's GitHub profile.

The users might not know it's being used for marketing on the home page, but it seems to be (again, just spot-tested) information that they provided for their /public/ profile.

Edit: NEVERMIND! Just checked a fourth and code from someone with "United States" in their profile showed as coming from Minneapolis.

Re: No Cookie for You

#44

Post by renewiltord » Thu, Dec 17, 2020, 5:33 PM UTC

3pt14159 wrote: post #15

This is great! GitHub continues to, somehow, surprise me. One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio's location settings. If it is truly unmasking people's location I think it should be opt-in only…

I thought that used the bio. Interesting that it didn't match.

Re: No Cookie for You

#45

Post by djohnston » Thu, Dec 17, 2020, 5:34 PM UTC

Nice. I wonder if one could build an analysis program to determine if you actually need the banner or not, with some reasonable accuracy. I would love to see those cut down.

Re: No Cookie for You

#46

Post by dsr_ » Thu, Dec 17, 2020, 5:35 PM UTC

jcroll wrote: post #39

How do you do site analytics?

Your webservers provide all the information you need via a logging mechanism.

Re: No Cookie for You

#47

Post by ffpip » Thu, Dec 17, 2020, 5:35 PM UTC

Great! Even before, rejecting tracking on GitHub was just one click away, same number of clicks as accepting it.

I also like the fact that all users get equal privacy rights!

Re: No Cookie for You

#48

Post by sildur » Thu, Dec 17, 2020, 5:35 PM UTC

fluidcruft wrote: post #34

austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Re: No Cookie for You

#49

Post by notJim » Thu, Dec 17, 2020, 5:36 PM UTC

I'm sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

Re: No Cookie for You

#50

Post by owaislone » Thu, Dec 17, 2020, 5:36 PM UTC

shuckles wrote: post #42

louhike wrote: post #38

Earlier quoted context omitted.

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.