Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

571–580 of 634 posts

Re: No Cookie for You

#571

Post by niutech »

yason wrote: post #570
niutech wrote: post #563

Earlier quoted context omitted.

Back in the days there was the P3P protocol ( https://en.wikipedia.org/wiki/P3P ) supported by IE and Edge, but it didn't work out and was abandoned. There is also `Do Not Track` header but it is not respected by most of websites. You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

I accept but don't save any cookies except certain whitelisted ones. So I get a lot of cookie policy banners and I always click the full 'accept all' option because at best it'll just eat into their database storage and I'll arrive with no stored cookies the next time I visit the site. The browser allows me to accept all cookies or non-third-party cookies automatically but I still get these stupid cookie policy banne…

Just install this extension: https://www.i-dont-care-about-cookies.eu/

Re: No Cookie for You

#572

Post by niutech »

Yaggo wrote: post #569
niutech wrote: post #563

Earlier quoted context omitted.

Back in the days there was the P3P protocol ( https://en.wikipedia.org/wiki/P3P ) supported by IE and Edge, but it didn't work out and was abandoned. There is also `Do Not Track` header but it is not respected by most of websites. You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

> There is also `Do Not Track` header but it is not respected by most of websites. The naivety of this approach almost makes me laugh. I mean, it's good intention, but really we cannot just trust the "bad" party. Active client-side measures are needed (e.g. as Safari does).

You can install uBlock Origin and disable all third-party cookies in almost every web browser.

Re: No Cookie for You

#573

Post by M2Ys4U »

asimops wrote: post #106
louhike wrote: post #38

Earlier quoted context omitted.

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

To my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.

There are six legal bases for processing personal data, consent is only one of those.

Re: No Cookie for You

#574

Post by M2Ys4U »

astura wrote: post #515
jeroenhd wrote: post #474

Earlier quoted context omitted.

The GDPR applies to anyone anywhere processing personal information (such as IP addresses) of people inside the EU (both EU and non-EU residents). That doesn't mean that you're necessarily at risk of any lawsuits or effective action, but what you're stating is wrong. Physical presence has nothing to do with it.

No, it absolutely does not "[apply] to anyone anywhere processing personal information of people inside the EU." I don't know why people keep saying this, I have no idea where this misconception came from. https://ec.europa.eu/info/law/law-topic/data-protection/refo... >When the regulation does not apply >Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clie…

Recital 23 of the GDPR provides some more information about when an organisation would be considered as targeting users in the EU:

"In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

Re: No Cookie for You

#575

Post by Slikey »

FriedrichN wrote: post #65

This is great. My experience is that many people claim to want analytics for their website but end up looking at it a couple of times and then never using it again. Meanwhile they're sponsoring and bolstering the position of internet tracking giants who - despite their claims - have no regard for user privacy. Just sell your product instead of wasting time and money on bike shedding your website with whatever you bel…

Sadly this is often unfeasible if your site relies on reCAPTCHA. Are there any cookie-free GDPR compliant captcha options?

Re: No Cookie for You

#576

Post by M2Ys4U »

jeroenhd wrote: post #477
caminocorner wrote: post #119

Earlier quoted context omitted.

What about former EU residents? (such as the Brits; or foreign residents)

The GDPR is implemented in British law, that's how these directives work. Once the UK leaves the EU, they're no longer obliged to keep their implementation of the GDPR. The government can choose to keep their implementation, and in practice keep the same regulations as the GDPR, or they could reduce or remove their privacy protection laws as they see fit. With London being famous for their camera surveillance, I expe…

The GDPR is a regulation (hence the R at the end) not a directive.

It became UK law as soon as it was passed by the EU, and it didn't need to be implemented in to UK law.

The UK has already passed their amendments to the GDPR,[0] which will effectively fork it into the "UK GDPR". These will come in to force on the 1st of January.

There's a "Keeling Schedule" available[1], which is effectively a diff between the EU GDPR and the UK GDPR.

[0] https://www.legislation.gov.uk/uksi/2019/419/introduction/ma...

[1] https://assets.publishing.service.gov.uk/government/uploads/...

Re: No Cookie for You

#578

Post by chopin »

deepersprout wrote: post #565
dessant wrote: post #316

Earlier quoted context omitted.

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…

> GitHub still sends the same personal data to their own analytics endpoint I see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property. What's the problem you have with that?

It's not GDPR compliant without consent. It doesn't matter whether you are using cookies or something else.

Re: No Cookie for You

#580

Post by M2Ys4U »

robgibbons wrote: post #116

I understand the need for GDPR, but its consequence of obtrusive cookie consent banners is easily one of the worst things to happen to the web in recent memory.

Cookie banners are not a result of the GDPR.

They're a consequence of the ePrivacy directive from 2002.

The reason why they're more prevalent now is because GDPR 1) made people aware of data protection issues; and 2) made people more scared of fines.

Post reply on HN