Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do cookie-free analytics need cookie banners?

jfagerberg.me

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Do cookie-free analytics need cookie banners?

#61

Post by raverbashing »

hnbad wrote: post #47
raverbashing wrote: post #43

Earlier quoted context omitted.

> At the end of the day, TCP/IP is inherently a non-anonymous protocol, as fundamentally as your home address is known to the mail system Yes. And the irony is that the German "privacy purists" use the non-private system of having your actual name in post boxes instead of apartment numbers It would be so funny if they shot themselves in the foot with it, but it's not going to happen unfortunately

An address is already PII, whether you pseudonymize it with apartment numbers or not. Also I think in practice the bigger concern with IPs is that the IP itself is PII at the time you collect it, so you're always processing PII even if the hash or other such "anonymized" data you store may end up not technically being PII if there's no way to correlate it to an actual person after the fact (which wouldn't be the case…

> An address is already PII, whether you pseudonymize it with apartment numbers or not.

The full address is PII. But a street level address isn't necessarily, if it points to an appt block.

The problem with the mail boxes is that you're leaking that a "Mr. Smith" is living at that address. Now with Mr. Smith this is not such a big problem but if you're looking for "Mr. LessUnique" then it is

Re: Do cookie-free analytics need cookie banners?

#62

Post by whstl »

t0mas88 wrote: post #59
whstl wrote: post #52

Earlier quoted context omitted.

MartijnHols is talking about using javascript, not cookies (or similar mechanisms). It is possible to use JS without cookies. If they're not using cookies, nor fingerprinting, nor storing PII, or anything else that breaks the spirit of the laws then it doesn't need a cookie banner, but under some jurisdictions you need disclosure about the potential data aggregation (even if it's just "increment a counter") to be in…

I was responding to this: > You can collect anything without limits as long as you don’t associate this data with identification data / profiles. That's completely wrong, the whole article is about the issue of reading data from the visitors device and needing a cookie banner for that. So you can't "collect anything without limits" in fact you can't collect any data from the visitor device. Which leaves a very narrow…

> in fact you can't collect any data from the visitor device

But this is not true.

You can definitely collect and store all sorts of data (including PII) for legitimate purposes, and without a cookie banner. For example: collecting and storing data required to provide the service itself requested by customers, login data, collecting address for delivering a package, shopping cart persistence, language selection, some preferences, fraud detection, rate limiting, DDOS protection, JS polyfill application, logging, resolution optimization.

By the way, ePrivacy is not really about the data collection itself (this is more in the GDPR's wheelhouse), but rather about storage in the user's device, among other things.

For the legitimate purposes regulated by the ePrivacy Directive, the Matomo link in the article also mentions it, in the "When Consent Is Not Required" section. You posted a link to it yourself, here: https://news.ycombinator.com/item?id=42820474

Here's a demonstration of how cookie banners are redundant if you only have legitimate purpose: you can click "deny" and the website still works and performs collection and storage. "To still work" is legally required by the GDPR. For those cases, all you need is a Privacy Policy.

In fact it would be impossible to comply to both ePrivacy and GDPR at the same time if consent was required for legitimate purpose actions!

And of course: as long as you reuse any of this legitimately collected data for advertising or analytics, you need extra consent, but I assume this is clear.

Re: Do cookie-free analytics need cookie banners?

#63

Post by whstl »

MartijnHols wrote: post #5
Vampiero wrote: post #2

If they're doing fingerprinting then they're clearly collecting too much data. If they need javascript to collect their metrics, they're clearly collecting too much data.

I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?

According to GDPR: you're fine if you're just calling an endpoint and not storing any PII anywhere.

According to ePrivacy: it is fine as your backend is storing this data, and not the user's computer.

Re: Do cookie-free analytics need cookie banners?

#64

Post by openplatypus »

As always: it depends.

Most cases: no.

Some cases: yes.

You have to assess: Intent, International Data Transfer, Terminal Device Access (beyond cookies), etc.

https://wideangle.co/blog/what-is-consent-under-gdpr

Unlike many so-called privacy analytics providers, we actually hired (and continue to do so) a professional DPO (former CNIL employees) and we advise our clients to seek counsel and provide them with necessary disclosures for them to make necessary decisions.

At the end of the day, it is our clients that need to make that assessment. Yes, it is our opinion, backed by professional assessment, that in our default set-up you don’t need "cookie banner”, but we are also clear that you should seek counsel of privacy professional.

Re: Do cookie-free analytics need cookie banners?

#65

Post by fguerraz »

vntok wrote: post #29
fguerraz wrote: post #8

Do you really need analytics that much? Enjoy my cookie and analytics free website: https://www.ZoneHero.io I had to resist a lot of temptations, but hey, no banners!

Is it popular?

I don’t know I can’t know.

But seriously no, it’s not, it’s never going to be as the topic is very niche, and it’s only ever consulted by people who have an interest in the product, that received the link by me or the marketplace.

I think the benefits of the “insights” I would get from tracking viewers are outweighed by the inconvenience I would cause to my customers.

Re: Do cookie-free analytics need cookie banners?

#66

Post by fguerraz »

t0mas88 wrote: post #42
fguerraz wrote: post #8

Do you really need analytics that much? Enjoy my cookie and analytics free website: https://www.ZoneHero.io I had to resist a lot of temptations, but hey, no banners!

Totally unrelated to cookies, but: Looks like a nice product! Have you figured out a way to integrate with ECS / Fargate? That's where our high volume ALBs are pointed at.

Yes, at the moment we can handle everything that fits in a Target Group. Adding other constructs is not a big deal either.

Re: Do cookie-free analytics need cookie banners?

#67

Post by 9dev »

theanonymousone wrote: post #60
hnbad wrote: post #44

Earlier quoted context omitted.

As with all legal questions (IANAL): it depends. Can you demonstrate legitimate interest for "using" those parts of the IPv4 address? If yes, then no. The IPv4 address combined with a timestamp identifies the typical person almost uniquely. Tracking this data over time allows narrowing it down further. This makes it PII for all intents and purposes. Anonymizing an IP adress by truncating it is a form of processing. S…

Thanks. It's a bit unfortunate. I essentially only want to keep a visitor count. So I have to show the the same banner (at least to be on the cautious side) as the guy who is sharing my data with their 732 "partners"? :-/ Somewhere in the original article it was mentioned that even hashing is not enough to make data non-PII. I assume then that's also out of questions?

Think about it the other way around. Is that visitor counter essential for your site? No. It’s cool. It’s interesting to know how many have visited, but that’s it. Now all you need to do is asking visitors if it’s okay to record their visit for the purpose of cool statistics. There is no requirement in the law to have a banner, or legalese speak. The only thing that actually matters is that you ask for consent in a way that actually shows why you want to track them.

Re: Do cookie-free analytics need cookie banners?

#68

Post by 9dev »

geon wrote: post #50

I’m so tired of the popups. YOY DON’T NEED A POPUP TO USE COOKIES! Just stop tracking people across sites and you’re good. Cookies, localstorage or fingerprinting makes no difference. The distinction is whether you track users or not. You are allowed to use cookies to your heart’s content, as long as the cookie is necessary for the functionality of your site, like a session id, or a shopping cart id. > [You must] Rec…

For my mom‘s small business, I actually tried to craft something compliant by hand (because I can). It’s surprisingly hard to get it right! Like, don’t load external scripts unless consent has been given, reflect that in the interface, and allow to withdraw consent. For example, there’s a maps embed showing the store address. But that’s can only be displayed if you actually consent to the prompt! So that means you’ll need to hold a list of script sources to add to the document head if the respective category has been accepted, but not earlier. Most implementations get this wrong, loading third-party scripts and snippets in normal script tags, assuming the users will consent anyway.

Re: Do cookie-free analytics need cookie banners?

#69

Post by nwellnhof »

hnbad wrote: post #48
nwellnhof wrote: post #30

> Note: I am not a lawyer. > We’ll be focusing our efforts on the ePrivacy Directive, The author doesn't seem to know that an EU Directive is not binding law. They're mostly irrelevant. It only matters how member states implement Directives. Some states like Germany didn't change any laws at all regarding the EPD. EU Regulations like the GDPR are different.

The ePD is intended to be replaced by the ePR but the ePD has already been implemented in several countries so it's a good abstraction of those implementations if you don't want to look at the specifics of each one individually. > Some states like Germany didn't change any laws at all regarding the EPD. This is false. Germany implemented the ePD[0] by replacing the TKG with the TDDDG in 2021. You may have missed this…

> Germany implemented the ePD[0] by replacing the TKG with the TDDDG in 2021.

At that point, the GDPR was already in force. The GDPR is mostly a superset of the ePD, so I don't think the TDDDG lead to substantial changes.

Re: Do cookie-free analytics need cookie banners?

#70

Post by fingrprintr »

legitster wrote: post #26
3s wrote: post #15

Earlier quoted context omitted.

Curious to know why browser fingerprinting has a “half life” of 24h? I always assumed it would be more static compared to an IP address and therefore a more powerful tracking mechanism (albeit more shady / less legally understood compared to using IPs).

Most of the non-IP components of fingerprinting are pretty goofy things like browser version, device, screen size, etc. If you are dealing with web traffic in any meaningful number, you have to dip into really minute details to tell apart visitor 10,001 from 10,002. More often than not, the details that make your device unique on one day will not stay unique by day two. Your browser might change versions, you might r…

There’s actually a site to test this… https://fingrprintr.pages.dev (i made it)

It routes you to a chat room based on your browser fingerprint. You can check back every so often and see that your room has changed. If your hardware/fingerprint is generic enough, you’ll see other people’s messages in “your” room.

Post reply on HN