No Cookie for You

Post by [deleted] » Thu, Dec 17, 2020, 9:42 PM UTC

dessant wrote: post #298

spinningslate wrote: post #280

Earlier quoted context omitted.

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…

I've been planning to post about this issue a couple of months ago, when I've noticed that GitHub was sending personal data collected on the client-side to Google Analytics without user consent. Then recently they have introduced a consent popup, which was actually one of the most refreshing cookie consent popups I have ever seen: it contained two buttons, Accept and Reject . This popup has now been removed. I think…

Post by rlpb » Thu, Dec 17, 2020, 9:45 PM UTC

chubs wrote: post #393

rlpb wrote: post #387

Earlier quoted context omitted.

Doing "tracking in-house" does not exempt you from GDPR requirements. The requirement is exactly the same: explicit and freely given consent is required to collect extra private information not specifically necessary to provide the service requested.

In this case, is github uncompliant now? They say they're not doing third-party tracking but the blog post seems to hint that they're doing their own tracking.

Post by dathinab » Thu, Dec 17, 2020, 9:50 PM UTC

VBprogrammer wrote: post #108

dathinab wrote: post #69

Earlier quoted context omitted.

Except that if the sites don't do annoying things there is no need for annoying popups. The EU law: - doesn't require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it's tracking people in any way are such opt-ins needed - if you login you are known to have accepted the terms of service and as such after login no opt-in…

> if you login you are known to have accepted the terms of service and as such after login no opt-in pop-up is needed either Apologies if I've misunderstood your claim here but it seems to me that you are saying you can bury consent to processing inside your legalise. That doesn't comply with the GDPR as I understand it; the consent must be informed and freely given. Informed in that case is debatable since you are l…

Post by yuhong » Thu, Dec 17, 2020, 9:52 PM UTC

ocdtrekkie wrote: post #18

kayson wrote: post #9

If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.

Sure, but considering GitHub doesn't have advertising[1], and they're not sending it to a third party (like Google, who does), it's very hard to imagine any use for first party "tracking" that might harm you. Presumably the most they're using this for is recommending potentially interesting repos to you. [1] Potential concern would be if "Microsoft" was considered "their own", since Bing does have an ad network. But…

Post by munchbunny » Thu, Dec 17, 2020, 9:53 PM UTC

SilasX wrote: post #329

munchbunny wrote: post #292

Earlier quoted context omitted.

I don’t understand your point. You’re asking whether they’re trying to work a loophole or a clever hack, and I said that I don’t think they are and that I think it’s credible because they don’t have profit motives that would drive them to take that legal risk.

You don't think they do analytics on users based on these cookies session? Because doing that without the consent pop-up is (I claim above) illegal, and so the clever workaround fails. I would be really, really surprised if Github were the only Bay Area unicorn that lacked a product manager nagging them for more analytics. The fact that they don't need to sell the analytics is irrelevant.