Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

511–520 of 634 posts

Re: No Cookie for You

#511

Post by dessant »

867-5309 wrote: post #507
dessant wrote: post #505

Earlier quoted context omitted.

Yes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.

consent is simple to gain, who reads the entire ToS and privacy policy? the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself

> consent is simple to gain, who reads the entire ToS and privacy policy?

That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service.

> the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself

The request can be blocked with uBlock Origin, but it's still important to draw attention to tracking that may be illegal, since not everyone has a content blocker installed.

Re: No Cookie for You

#512

Post by 867-5309 »

dessant wrote: post #511
867-5309 wrote: post #507

Earlier quoted context omitted.

consent is simple to gain, who reads the entire ToS and privacy policy? the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself

> consent is simple to gain, who reads the entire ToS and privacy policy? That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service. > the bottom line is, do you place more trust in your local lawmakers and the website you are visiti…

if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective

you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise

Re: No Cookie for You

#513

Post by Alupis »

jeroenhd wrote: post #474
Alupis wrote: post #465

Earlier quoted context omitted.

> A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case. A lot of people also have the misconception that the EU cookie law applies to them, even if they are not in the EU and have no EU physical presence.

The GDPR applies to anyone anywhere processing personal information (such as IP addresses) of people inside the EU (both EU and non-EU residents). That doesn't mean that you're necessarily at risk of any lawsuits or effective action, but what you're stating is wrong. Physical presence has nothing to do with it.

As a corporation, of any size, you are not beholden to laws made in other countries, unless you do business in that country or have a presence of some kind in that country.

With exception of large, international organizations, that doesn't apply to nearly all business outside the EU.

Re: No Cookie for You

#514

Post by dessant »

867-5309 wrote: post #512
dessant wrote: post #511

Earlier quoted context omitted.

> consent is simple to gain, who reads the entire ToS and privacy policy? That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service. > the bottom line is, do you place more trust in your local lawmakers and the website you are visiti…

if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise

Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal.

This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...

Re: No Cookie for You

#515

Post by astura »

jeroenhd wrote: post #474
Alupis wrote: post #465

Earlier quoted context omitted.

> A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case. A lot of people also have the misconception that the EU cookie law applies to them, even if they are not in the EU and have no EU physical presence.

The GDPR applies to anyone anywhere processing personal information (such as IP addresses) of people inside the EU (both EU and non-EU residents). That doesn't mean that you're necessarily at risk of any lawsuits or effective action, but what you're stating is wrong. Physical presence has nothing to do with it.

No, it absolutely does not "[apply] to anyone anywhere processing personal information of people inside the EU." I don't know why people keep saying this, I have no idea where this misconception came from.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

>When the regulation does not apply

>Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

Re: No Cookie for You

#516

Post by gingerlime »

closeparen wrote: post #369
gingerlime wrote: post #337

Earlier quoted context omitted.

I don’t think this is a problem for GDPR. As long as there’s no personal data involved you can count active sessions, aggregate data etc

How would you count unique users without processing any records corresponding to particular users?

seasion ids are unique? are they personal data if you cannot link them to an individual? count those. let’s say you are paranoid and someone, somewhere can link those random ids to people. So hash those random ids with a key that this someone has no access to. Now you have anonymized ids you can count uniquely and that cannot be linked to individuals.

You can anonymize data if you really want to and use it for understanding trends, usage etc in a privacy respectful way. Few companies bother these days though. And yes if you want a 100% watertight way, it’s hard.

Re: No Cookie for You

#517

Post by eitland »

dessant wrote: post #514
867-5309 wrote: post #512

Earlier quoted context omitted.

if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise

Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...

To add to this:

from my understanding of the rules even a lot of the informed consent popups today aren't compliant.

If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out.

IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.

Re: No Cookie for You

#518

Post by dang »

dessant wrote: post #447
dessant wrote: post #316

Earlier quoted context omitted.

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…

A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers". GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint. GitHub's claims about not tracking users are false, they do identify users in tr…

I had to put some newlines in that monstrous link because it was breaking the page layout (sorry; it's our bug).

Re: No Cookie for You

#519

Post by eitland »

baxtr wrote: post #239
Nextgrid wrote: post #156

Earlier quoted context omitted.

The regulation explicitly forbids annoying banners, the problem is that there’s currently zero enforcement of it so websites continue breaching it and lying to themselves (and others) by thinking their consent banners are compliant.

But that’s exactly my point. Why regulate if things get worse. If you regulate think about enforcing beforehand. What’s the use?

Enforcement is already happening. Multiple confirmed cases of fines being handed out to businesses, organisations etc :-)

More importantly IMO they are also contacting entities up front to tell them about violations and how to get compliant, the fines we have seen yet seems (again IMO) to be only for particularly nasty cases and/or cases where the entities in question refuses to change.

This means the fines we are seeing is just the top of the iceberg: most changes happens underneath the surface and only trickles up in the form of less annoying websites (or fines) little by little.

Re: No Cookie for You

#520

Post by 867-5309 »

dessant wrote: post #514
867-5309 wrote: post #512

Earlier quoted context omitted.

if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise

Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...

it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body

also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include:

-Using tracking/advertising cookies"

this document may help you understand the difference between should and must: https://www.ietf.org/rfc/rfc2119.txt

Post reply on HN