Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

411–420 of 634 posts

Re: No Cookie for You

#411

Post by dathinab »

dheera wrote: post #297
dathinab wrote: post #69

Earlier quoted context omitted.

Except that if the sites don't do annoying things there is no need for annoying popups. The EU law: - doesn't require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it's tracking people in any way are such opt-ins needed - if you login you are known to have accepted the terms of service and as such after login no opt-in…

The thing is, tracking cookies don't annoy me, because I block all cookies anyway (unless it's one of the few sites I need to actually log into), so they can't track me with them. It's the popups that actually annoy me, especially because they keep on popping up -- ironically they need to store a cookie to remember that the user has accepted/denied, and my cookie-blocking blocks that cookie as well. I think browsers…

But the EU law is not just about cookies. It's also about e.g. fingerprinting your browser which is very hard to effectively block in practice.

It's a common misconception that it's about cookies. It's about data processing, i.e. tracking. There is a different law then GDPR which is about storing data on user PC's but that is also not about cookies but about any browser storage and more or less got superseded(1) by GDPR.

(1): Ok, that is quite a oversimplification, but most popups are now about GDPR and having them also covers the other law.

Re: No Cookie for You

#412

Post by [deleted] »

munchbunny wrote: post #410
SilasX wrote: post #329

Earlier quoted context omitted.

You don't think they do analytics on users based on these cookies session? Because doing that without the consent pop-up is (I claim above) illegal, and so the clever workaround fails. I would be really, really surprised if Github were the only Bay Area unicorn that lacked a product manager nagging them for more analytics. The fact that they don't need to sell the analytics is irrelevant.

I can't speak for Github, but I can speak for my team in [tech giant]: if I wanted to do analytics on end users I'd have to go through a review to confirm that I would not be violating privacy laws. I literally couldn't query them if I wanted to without jumping through technical hoops with audit processes and paper trails. I do believe Github is legitimately trying not to use that data for analytics. But whether some…

[deleted]

Re: No Cookie for You

#413

Post by [deleted] »

austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

[deleted]

Re: No Cookie for You

#414

Post by ttepasse »

austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

There is no direct language about cookies in article 5(3) of the ePrivacy Directive. What we have is Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Working Group of the European Commission about Cookie Consent, which elaborates about the topic:

https://ec.europa.eu/justice/article-29/documentation/opinio...

(The §29 WG is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Also: IANAL.)

Re: No Cookie for You

#415

Post by reillyse »

rlpb wrote: post #387
BlueTemplar wrote: post #357

Earlier quoted context omitted.

I am pretty sure that they are still tracking you - but Microsoft can easily afford to do tracking in-house...

Doing "tracking in-house" does not exempt you from GDPR requirements. The requirement is exactly the same: explicit and freely given consent is required to collect extra private information not specifically necessary to provide the service requested.

There is a lot of wiggle room in "provide the service requested"

Re: No Cookie for You

#416

Post by markdown »

vidarh wrote: post #140
FriedrichN wrote: post #65

This is great. My experience is that many people claim to want analytics for their website but end up looking at it a couple of times and then never using it again. Meanwhile they're sponsoring and bolstering the position of internet tracking giants who - despite their claims - have no regard for user privacy. Just sell your product instead of wasting time and money on bike shedding your website with whatever you bel…

And when people want analytics they often just really want headline numbers that do not require user tracking. E.g. I've started using Fathom [1]. It's very basic, but for the sites I use it on all I really want to know is if traffic is going up or down or if any specific pages are suddenly getting lots of traffic. [1] https://usefathom.com

No pricing page, and jesus, not even a menu. They want us to sign in before they'll show us pricing? fuck right off with that bullshit.

Re: No Cookie for You

#417

Post by krlx »

Wowfunhappy wrote: post #147
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

I developed for myself krlx.fr/feu-analytics/ for exactly the same scenario.

It is self-hosted but on firebase and taking advantage of the free tier. Of course there is no personal data collected at any point.

There are still improvement to do, but as it works perfectly for me I have not be able to gather enough motivation to do that.

Re: No Cookie for You

#418

Post by gman83 »

ocdtrekkie wrote: post #18
kayson wrote: post #9

If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.

Sure, but considering GitHub doesn't have advertising[1], and they're not sending it to a third party (like Google, who does), it's very hard to imagine any use for first party "tracking" that might harm you. Presumably the most they're using this for is recommending potentially interesting repos to you. [1] Potential concern would be if "Microsoft" was considered "their own", since Bing does have an ad network. But…

Wait, Google isn't sharing your analytics data with any third parties.

Re: No Cookie for You

#419

Post by ttepasse »

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

More information is in Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Working Party of the European Commission about Cookie Consent, which elaborates about the topic:

https://ec.europa.eu/justice/article-29/documentation/opinio...

(The §29 WP is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Maybe they are waiting for a forthcoming ePrivacy Regulation. Also: IANAL.)

Post reply on HN