Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

561–570 of 634 posts

Re: No Cookie for You

#561

Post by p_l »

BlueTemplar wrote: post #536
p_l wrote: post #441

Earlier quoted context omitted.

Depends only on whether the fact that they are logged in is used to process any kind of personal data. The question is not "how long". The question is what data, and what happens to it.

It is, because "logged in" is an abstraction - someone has to decide how frequently you have to contact the server before being considered to have "logged out".

a cookie representing authentication session with your app isn't personal data, and doesn't need privacy policy, especially if your login is arbitrary and not an email.

It doesn't matter how long it's active either, unless you use it to track users activity elsewhere

Re: No Cookie for You

#562

Post by M2Ys4U »

iamacyborg wrote: post #526
adrr wrote: post #439

Earlier quoted context omitted.

So I am not allowed to keep server logs without consent?

If you're processing server logs for marketing purposes, then no, you need consent to do that. You also should be trying to scrub IP adresses from those logs as that counts as PII.

>You also should be trying to scrub IP adresses from those logs as that counts as PII.

That counts as personal data.

The GDPR doesn't care about "PII", as that is a US legal term and not something defined or references in EU law.

Re: No Cookie for You

#563

Post by niutech »

Yaggo wrote: post #545

I wish browsers had built-in mechanism for showing the cookie banners. After all, cookies are just an HTTP header sent from server and it's up to the user-agent to handle it. There could be a standard header such as cookie-privacy-policy which would point to url containing the policy in standadrd format (html?) and the browser could show it in standard way (by user's settings). Personally I would be happy with just a…

Back in the days there was the P3P protocol (https://en.wikipedia.org/wiki/P3P) supported by IE and Edge, but it didn't work out and was abandoned.

There is also `Do Not Track` header but it is not respected by most of websites.

You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

Re: No Cookie for You

#564

Post by 867-5309 »

stupidcar wrote: post #546
867-5309 wrote: post #520

Earlier quoted context omitted.

it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help…

Did you seriously just link an IETF document as the basis for an argument about the law? Never mind the difference between "should" and "must", do you understand the difference between an RFC and the law? And there is no room for ambiguity in the actual law: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%... > Consent should be given by a clear affirmative act establishing a freely given, specific, infor…

> Did you seriously just link an IETF document as the basis for an argument about the law?

of course not, it was an example to demonstrate the difference and easier to include one link for both definitions than e.g. two for each from a dictionary

> Never mind the difference between "should" and "must"

given the context I believe the difference is of paramount importance

> do you understand the difference between an RFC and the law?

slightly reworded first question but yes, I do, thanks

> And there is no room for ambiguity in the actual law: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%...

that seems a good example for a better source which actually bolsters my point on bad sources, but alas, it's irrelevant. note that it refers to personal data and not (third time lucky) the original argument concerning tracking consent. in fact, I cannot even find any personal data in the OP's URL, probably because no personal data is required to create a GitHub account. let's just ignore that one for now

Re: No Cookie for You

#565

Post by deepersprout »

dessant wrote: post #316
heroprotagonist wrote: post #141

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…

> GitHub still sends the same personal data to their own analytics endpoint

I see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property.

What's the problem you have with that?

Re: No Cookie for You

#566

Post by M2Ys4U »

ghego1 wrote: post #308
oauea wrote: post #258

Earlier quoted context omitted.

> not self hosted you'll need a cookie banner then

Not necessarily. Only if personal data is collected by the third party.

You need to notify users, and give them an opt-out, if the cookies are not strictly necessary for the provision of the service.

Analytics cookies are not strictly necessary.

Re: No Cookie for You

#567

Post by M2Ys4U »

madjam002 wrote: post #319
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This…

>IP addresses still count as Personally Identifiable Information under GDPR

The GDPR does not count anything as "Personally Identifiable Information", which isn't surprising as that's a US legal term.

What you mean is "Personal Data", and yes IP addresses are considered personal data under the GDPR.

>so deriving an identifier from this for a use case such as analytics would likely require consent.

Consent isn't the only legal basis for processing personal data, though, there are 5 others available.

Re: No Cookie for You

#568

Post by 867-5309 »

account42 wrote: post #549
867-5309 wrote: post #520

Earlier quoted context omitted.

it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help…

Terminology in guidelines for following a new law != terminology in technical documents. Not being able to get implicit consent by hiding some terms in a long legal document is the entire fucking point of the GDPR.

as above

Re: No Cookie for You

#569

Post by Yaggo »

niutech wrote: post #563
Yaggo wrote: post #545

I wish browsers had built-in mechanism for showing the cookie banners. After all, cookies are just an HTTP header sent from server and it's up to the user-agent to handle it. There could be a standard header such as cookie-privacy-policy which would point to url containing the policy in standadrd format (html?) and the browser could show it in standard way (by user's settings). Personally I would be happy with just a…

Back in the days there was the P3P protocol ( https://en.wikipedia.org/wiki/P3P ) supported by IE and Edge, but it didn't work out and was abandoned. There is also `Do Not Track` header but it is not respected by most of websites. You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

> There is also `Do Not Track` header but it is not respected by most of websites.

The naivety of this approach almost makes me laugh. I mean, it's good intention, but really we cannot just trust the "bad" party. Active client-side measures are needed (e.g. as Safari does).

Re: No Cookie for You

#570

Post by yason »

niutech wrote: post #563
Yaggo wrote: post #545

I wish browsers had built-in mechanism for showing the cookie banners. After all, cookies are just an HTTP header sent from server and it's up to the user-agent to handle it. There could be a standard header such as cookie-privacy-policy which would point to url containing the policy in standadrd format (html?) and the browser could show it in standard way (by user's settings). Personally I would be happy with just a…

Back in the days there was the P3P protocol ( https://en.wikipedia.org/wiki/P3P ) supported by IE and Edge, but it didn't work out and was abandoned. There is also `Do Not Track` header but it is not respected by most of websites. You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

I accept but don't save any cookies except certain whitelisted ones.

So I get a lot of cookie policy banners and I always click the full 'accept all' option because at best it'll just eat into their database storage and I'll arrive with no stored cookies the next time I visit the site.

The browser allows me to accept all cookies or non-third-party cookies automatically but I still get these stupid cookie policy banners that cover half the screen at the worst.

I'd really like a standardized way to accept all cookie policies with no questions asked.

(And, for the matter, something that automatically says 'no' each and every time a site decides that the best first thing to do is to ask me to give some feedback of the site before I've even used the said site.)

Post reply on HN