4 ms·

I'm a really big fan of geotargeting these notices only to the EU. If the EU wants cookie notices, give the EU cookie notices. Don't give anyone else cookie not

by Shank 8y ago

I'm a really big fan of geotargeting these notices only to the EU. If the EU wants cookie notices, give the EU cookie notices. Don't give anyone else cookie notices, because they're garish and few people reasonably care.

stingraycharles 8y ago
But what if your geotargeting doesn’t work as expected, and has a few false negatives? Will that hold up in court?
- Shank 8y ago
  Policy is all about how it gets enforced and acted on. An imperfect cookie targeting scheme could probably fall down in court, but there isn't much caselaw about the cookie law right now. I can't recall any major cases where website operators were taken to court over it.
littlestymaar 8y ago
You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.
- Shank 8y ago
  Is IP geolocation included in that? I'm genuinely curious, actually. That's how most websites do content filtering (even BBC iPlayer uses server side geolocation to filter people out).
- fasteddie 8y ago
  This isn't true. You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.
  - tremon 8y ago
    This isn't true either. If you're using an IP lookup to determine the user's current country, that's still processing PII (since many courts have already ruled that an IP address is unique enough to identify a person -- technical challenges notwithstanding). However, you have a clear and stated use case for processing that PII so consent is not required, but you are required to mention this processing in your privacy policy. Not publishing this processing is (strictly speaking) a violation of the GDPR, but the processing itself isn't.
    - davidfischer 8y ago
      For the purpose of the GDPR, an IP is PII. However, one can get rough location using an anonymized version of an IP address (say one that has zeroed out the last octet or two). From Recital 26 (https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/): > The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.
Bizarro 8y ago
If you don't have operations in the EU then you don't have to worry about that nonsense to begin with.
dominotw 8y ago
Is this different from GDPR in the sense that EU citizen can be accessing your website from other parts of the world?

by Shank 8y ago

stingraycharles 8y ago

But what if your geotargeting doesn’t work as expected, and has a few false negatives? Will that hold up in court?

Shank 8y ago
Policy is all about how it gets enforced and acted on. An imperfect cookie targeting scheme could probably fall down in court, but there isn't much caselaw about the cookie law right now. I can't recall any major cases where website operators were taken to court over it.

littlestymaar 8y ago

You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.

Shank 8y ago
Is IP geolocation included in that? I'm genuinely curious, actually. That's how most websites do content filtering (even BBC iPlayer uses server side geolocation to filter people out).
fasteddie 8y ago
This isn't true. You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.
- tremon 8y ago
  This isn't true either. If you're using an IP lookup to determine the user's current country, that's still processing PII (since many courts have already ruled that an IP address is unique enough to identify a person -- technical challenges notwithstanding). However, you have a clear and stated use case for processing that PII so consent is not required, but you are required to mention this processing in your privacy policy. Not publishing this processing is (strictly speaking) a violation of the GDPR, but the processing itself isn't.
  - davidfischer 8y ago
    For the purpose of the GDPR, an IP is PII. However, one can get rough location using an anonymized version of an IP address (say one that has zeroed out the last octet or two). From Recital 26 (https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/): > The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Bizarro 8y ago

If you don't have operations in the EU then you don't have to worry about that nonsense to begin with.

dominotw 8y ago

Is this different from GDPR in the sense that EU citizen can be accessing your website from other parts of the world?