Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

581–590 of 634 posts

Re: No Cookie for You

#581

Post by FeepingCreature »

manigandham wrote: post #544
dessant wrote: post #514

Earlier quoted context omitted.

Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...

GDPR has lots of issues and this is one of the major ones. It can be easily argued that companies cannot be forced to service users and there has been no real precedent or enforcement around this.

A company cannot be forced to service users. It can also decide to stop operating entirely, and die. A company can be forced to not use particular criteria to decide to service specific users, an idea with a long history - a common example is skin color.

Re: No Cookie for You

#582

Post by M2Ys4U »

p410n3 wrote: post #200
cryptonym wrote: post #17

Earlier quoted context omitted.

Cookie is a technical solution. The law isn't about cookies but about privacy. The alternative to asking permission to do intrusive things is to avoid doing intrusive things.

Finally someone who knows this! Even (some) "SEO advice" blogs have suggested to just use local storage instead of cookies. Just no. Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32. Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and…

You're confusing the upcoming ePrivacy regulation with the existing ePrivacy directive - one that's been in force for 18 years.

Just like people thought that the data protection was a new concept when the GDPR was created, ignoring the fact that the Data Protection Directive had been around for decades.

Re: No Cookie for You

#583

Post by M2Ys4U »

martin-adams wrote: post #435

Prior to the GDPR making this law, Silktide, the creator of a popular cookie banner software, got fed up, removed the banners and asked the ICO to sue them. The ICO responded. They said that they accomplished the goal of bringing awareness to cookies and it’s usage. https://nocookielaw.com/

The GDPR did not introduce the requirement to inform users of cookies.

That was the ePrivacy Directive. From 2002.

Re: No Cookie for You

#585

Post by dspillett »

867-5309 wrote: post #504
dessant wrote: post #447

Earlier quoted context omitted.

A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers". GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint. GitHub's claims about not tracking users are false, they do identify users in tr…

this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not send any information to third-party analytics services" - but presumably third parties are still able to access this data on request. their privacy policy probably reflects this. if you visit a website and don't want to be tracked, make it as hard as possible f…

> no cookies doesn't mean no tracking

It does though make tracking by third parties so they can sell things to me (or sell information about me to other parties for that use) more difficult. Not impossible though, of course.

Re: No Cookie for You

#586

Post by Yaggo »

niutech wrote: post #571
yason wrote: post #570

Earlier quoted context omitted.

I accept but don't save any cookies except certain whitelisted ones. So I get a lot of cookie policy banners and I always click the full 'accept all' option because at best it'll just eat into their database storage and I'll arrive with no stored cookies the next time I visit the site. The browser allows me to accept all cookies or non-third-party cookies automatically but I still get these stupid cookie policy banne…

Just install this extension: https://www.i-dont-care-about-cookies.eu/

Sure, there exists an extension for pretty much everything, but it's not an ideal situation that you need to install an extension for stuff like this.

Also, having too many extensions slows down the browser (because they need to parse/manipulate DOM) and extensions themselves are also a security/privacy risk and finding the good ones for every browser can be tedious.

Besides, my mom has no idea what's "a browser extension".

Re: No Cookie for You

#588

Post by BlueTemplar »

p_l wrote: post #561
BlueTemplar wrote: post #536

Earlier quoted context omitted.

It is, because "logged in" is an abstraction - someone has to decide how frequently you have to contact the server before being considered to have "logged out".

a cookie representing authentication session with your app isn't personal data, and doesn't need privacy policy, especially if your login is arbitrary and not an email. It doesn't matter how long it's active either, unless you use it to track users activity elsewhere

If it's used to determine identity, it's a kind of personal data.

However, as you say, it might be allowed by GDPR without requesting extra approval, depending on the way that it's being used and who it is shared with?

Hence my question about whether the length of time that you store this data legally matters (because since databases can be stolen, it eventually does). Compare with how ISPs must store all your connection logs for a specific amount of time.

Re: No Cookie for You

#589

Post by iamacyborg »

M2Ys4U wrote: post #562
iamacyborg wrote: post #526

Earlier quoted context omitted.

If you're processing server logs for marketing purposes, then no, you need consent to do that. You also should be trying to scrub IP adresses from those logs as that counts as PII.

>You also should be trying to scrub IP adresses from those logs as that counts as PII. That counts as personal data . The GDPR doesn't care about "PII", as that is a US legal term and not something defined or references in EU law.

Fair point.

Re: No Cookie for You

#590

Post by merijnv »

eitland wrote: post #517
dessant wrote: post #514

Earlier quoted context omitted.

Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...

To add to this: from my understanding of the rules even a lot of the informed consent popups today aren't compliant. If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out . IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.

Correct. Also, you cannot with hold access upon users not consenting, so there's literally zero incentive for users to ever consent for compliant providers. Which is kinda obvious with the GDPR's overall goal of making it impossible to use privacy as currency.
Post reply on HN