3 ms·

There are lots of sites without tracking cookies. HN doesn't set tracking cookies, for example. The only two cookies set are the cloudflare uid and a user logi

by zaarn 8y ago

There are lots of sites without tracking cookies. HN doesn't set tracking cookies, for example. The only two cookies set are the cloudflare uid and a user login cookie, both of which are hardly meant for tracking.

Kiro 8y ago
What about analytics?
- zaarn 8y ago
  As long as analytics don't produce any personal data of an individual and only aggregate data or even anonymized data, it should be perfectly fine to do without any banner. Of course, if you use Google Analytics, you can't guarantee what Google is doing, so you'll need some banner to get consent before you can perform any analytics through GA (which means you need to disable GA until the user agrees, which barely any site does anyway). If you can guarantee that the analytics won't produce or store personal data, you don't need to disable it or produce a banner.
  - merijnv 8y ago
    > As long as analytics don't produce any personal data of an individual and only aggregate data or even anonymized data, it should be perfectly fine to do without any banner. Even if they did produce personal data, they very likely wouldn't need a banner. For processing personal data you merely need a lawful basis and documented processes, and asking consent is (intentionally) the least attractive lawful basis for using personal data. Consider for example the "legitimate interest" lawful basis: > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. If you're using analytics to, say, optimise accessibility/usability of the site, then it should be fairly straight forward that the legitimate interest of both you and user (of improving the site) outweighs the "privacy harm" of processing that personal data. (Of course, using it for anything else will land you in hot water if you argue this). Even a 3rd party data processor like Google Analytics would be fine, if they're 1) GDPR compliant and 2) you have a data processing agreement with the provider. 90% of websites who don't do shady things with your personal data should never require any banner or opt-in prompt. The fact that most of the web now does is incompetence, ignorance, intentional annoyance to provoke legislation change, or a mix of these.
    - jeltz 8y ago
      I think a decent portion is also because they actually do shady shit.
- Faark 8y ago
  Do you need banners for self hosted analytics not shared with 3rd parties? I'd be fine with clicking through countless banners if that pushes the industry even just slightly in that direction.
  - anonunt 8y ago
    nope.. that is the point of these laws - if you are doing decent stuff they don't really make a difference. if you are doing dodgey stuff you just have to tell people you what you are up to.. but dodgey people don't like telling people they are dodgey - hence all the moaning!

by zaarn 8y ago

Kiro 8y ago

What about analytics?

zaarn 8y ago
As long as analytics don't produce any personal data of an individual and only aggregate data or even anonymized data, it should be perfectly fine to do without any banner. Of course, if you use Google Analytics, you can't guarantee what Google is doing, so you'll need some banner to get consent before you can perform any analytics through GA (which means you need to disable GA until the user agrees, which barely any site does anyway). If you can guarantee that the analytics won't produce or store personal data, you don't need to disable it or produce a banner.
- merijnv 8y ago
  > As long as analytics don't produce any personal data of an individual and only aggregate data or even anonymized data, it should be perfectly fine to do without any banner. Even if they did produce personal data, they very likely wouldn't need a banner. For processing personal data you merely need a lawful basis and documented processes, and asking consent is (intentionally) the least attractive lawful basis for using personal data. Consider for example the "legitimate interest" lawful basis: > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. If you're using analytics to, say, optimise accessibility/usability of the site, then it should be fairly straight forward that the legitimate interest of both you and user (of improving the site) outweighs the "privacy harm" of processing that personal data. (Of course, using it for anything else will land you in hot water if you argue this). Even a 3rd party data processor like Google Analytics would be fine, if they're 1) GDPR compliant and 2) you have a data processing agreement with the provider. 90% of websites who don't do shady things with your personal data should never require any banner or opt-in prompt. The fact that most of the web now does is incompetence, ignorance, intentional annoyance to provoke legislation change, or a mix of these.
  - jeltz 8y ago
    I think a decent portion is also because they actually do shady shit.
Faark 8y ago
Do you need banners for self hosted analytics not shared with 3rd parties? I'd be fine with clicking through countless banners if that pushes the industry even just slightly in that direction.
- anonunt 8y ago
  nope.. that is the point of these laws - if you are doing decent stuff they don't really make a difference. if you are doing dodgey stuff you just have to tell people you what you are up to.. but dodgey people don't like telling people they are dodgey - hence all the moaning!