Live data from Hacker News

Do cookie-free analytics need cookie banners?

jfagerberg.me

71–80 of 88 posts

Re: Do cookie-free analytics need cookie banners?

#71
post #37

Earlier quoted context omitted.

There's a distinction between first-party data and third-party data. You can view your own server logs - but sending over user data to a service like Google Analytics is what is regulated.

No it's not. Nowhere in the ePrivacy Directive do they specify anything about first- vs third-party data.

It's not explicit in the directive, but it is right there in the working docs so it's pretty clearly a principle:

> the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards.

Re: Do cookie-free analytics need cookie banners?

#72
post #56

Earlier quoted context omitted.

I regret to inform you that solutions like Ad Naseum are snake oil. Bot-clicks and LLM networks are already pretty pervasive clickers of ads. Most ad networks already have ways of filtering out noisy clicks. And anyone dumping real money into ads will be smart enough to tie their ROI to conversion events, not clicks.

Perhaps, but bot clicks and LLM networks are not domestic users with off-the-shelf browsers doing other legitimate activities in a website. Also: the ad networks don't care about your ROI, they'll still charge if they don't catch the fraud.

Ad networks can't charge you if you stop buying ads because you're not getting a good ROI.

Re: Do cookie-free analytics need cookie banners?

#73
post #37

Earlier quoted context omitted.

No it's not. Nowhere in the ePrivacy Directive do they specify anything about first- vs third-party data.

It's not explicit in the directive, but it is right there in the working docs so it's pretty clearly a principle: > the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as we…

You left out the context of your quote[0], where the Working Party explicitly states that first party analytics are not exempt from Article 5.3. Your quote leads up to their opinion that they _wish_ it was exempt, since it represents little privacy risk, but that it would require the article to be re-visited.

[0] Section 4.3 of https://ec.europa.eu/justice/article-29/documentation/opinio...

Re: Do cookie-free analytics need cookie banners?

#74
post #67

Earlier quoted context omitted.

Thanks. It's a bit unfortunate. I essentially only want to keep a visitor count. So I have to show the the same banner (at least to be on the cautious side) as the guy who is sharing my data with their 732 "partners"? :-/ Somewhere in the original article it was mentioned that even hashing is not enough to make data non-PII. I assume then that's also out of questions?

Think about it the other way around. Is that visitor counter essential for your site? No. It’s cool. It’s interesting to know how many have visited, but that’s it. Now all you need to do is asking visitors if it’s okay to record their visit for the purpose of cool statistics. There is no requirement in the law to have a banner, or legalese speak. The only thing that actually matters is that you ask for consent in a w…

Poof. What if I don't keep the IP at all and just the timestamp? Essentially "Someone visited at 23:12 January 20th", nothing else stored. Still banner needed?

Re: Do cookie-free analytics need cookie banners?

#75
post #42
post #8

Do you really need analytics that much? Enjoy my cookie and analytics free website: https://www.ZoneHero.io I had to resist a lot of temptations, but hey, no banners!

Totally unrelated to cookies, but: Looks like a nice product! Have you figured out a way to integrate with ECS / Fargate? That's where our high volume ALBs are pointed at.

If you want to get in touch, click Join the beta and drop us an email, old school, no strings attached. We’re currently testing Marketplace integration, the rest has already been battle tested.

Re: Do cookie-free analytics need cookie banners?

#76
post #67

Earlier quoted context omitted.

Think about it the other way around. Is that visitor counter essential for your site? No. It’s cool. It’s interesting to know how many have visited, but that’s it. Now all you need to do is asking visitors if it’s okay to record their visit for the purpose of cool statistics. There is no requirement in the law to have a banner, or legalese speak. The only thing that actually matters is that you ask for consent in a w…

Poof. What if I don't keep the IP at all and just the timestamp? Essentially "Someone visited at 23:12 January 20th", nothing else stored. Still banner needed?

No. But then someone could ruin your stats by sitting there and refreshing all day long.

Re: Do cookie-free analytics need cookie banners?

#77

Earlier quoted context omitted.

Poof. What if I don't keep the IP at all and just the timestamp? Essentially "Someone visited at 23:12 January 20th", nothing else stored. Still banner needed?

No. But then someone could ruin your stats by sitting there and refreshing all day long.

The price to pay if I don't want want to be in the same bucket with data dealers...

Re: Do cookie-free analytics need cookie banners?

#78
post #34
post #32

The article picks Fathom fingerprinting but there are differences. Other services like Plausible also include time element. So to plausible every day you are someone else. Unlike Fathom, Plausible cannot track unique visitors per month. Fathom is pretty sneaky here and its not surprising because they have been pretty sketchy in past. EU law is very much based on interpretation and “spirit” of the law and Plausible la…

Most of these "cookie free" analytics vendors keep talking about how cleverly they have anonymised the data, but this article finally gets it right: That does not matter for cookie popups. Anonymisation is only relevant to GDPR, but you still need cookie banners under the ePrivacy directive.

> you still need cookie banners under the ePrivacy directive

Only if you store data in the browsing (using cookies, localStorage, or any other technical means), no?

Re: Do cookie-free analytics need cookie banners?

#79
post #52
post #35

Earlier quoted context omitted.

This is wrong, read the article. Your answer aligns with GDPR, but cookie banners come from the ePrivacy directive. The author is one of the few to describe it well.

MartijnHols is talking about using javascript, not cookies (or similar mechanisms). It is possible to use JS without cookies. If they're not using cookies, nor fingerprinting, nor storing PII, or anything else that breaks the spirit of the laws then it doesn't need a cookie banner, but under some jurisdictions you need disclosure about the potential data aggregation (even if it's just "increment a counter") to be in…

[deleted]

Re: Do cookie-free analytics need cookie banners?

#80
post #56

Earlier quoted context omitted.

Perhaps, but bot clicks and LLM networks are not domestic users with off-the-shelf browsers doing other legitimate activities in a website. Also: the ad networks don't care about your ROI, they'll still charge if they don't catch the fraud.

Ad networks can't charge you if you stop buying ads because you're not getting a good ROI.

Yeah everyone who isn’t purposefully burning money has people whose sole job is just to spend less money on stuff that doesn’t work and more money on stuff that does. Pretty much every platform (DSP) has some fancy deep learning that bids up or down based on the quality of the individual bid (taking into account the user, host, banner size, likeliehood of fraud, etch
Post reply on HN