3 ms·
I think that's a fair question. AFAICT, v1 of PECR awkwardly applies whenever the cookie is not functionally directly necessary for the service that the user i
by orra 7y ago
I think that's a fair question.
AFAICT, v1 of PECR awkwardly applies whenever the cookie is not functionally directly necessary for the service that the user is using. PECR applies even if, like here, the cookie is just for counting unique numbers of visitors, and is not used for fingerprinting individuals.
The draft v2 of PECR contains an exemption for first party analytics. I think this maybe strikes a nice balance: explicit consent would still be required for the more-harmful third party analytics.
Not sure when v2 of PECR will happen. It is years overdue. Perhaps it is a priority for the newly elected European Parliament and the new Commission?
- krageon 7y agoWhat makes analytics first-party? When the first party serves them, or only if the data never leaves machines under the direct and exclusive control of the first party?
- orra 7y agoI don't know the answer to that. FWIW, my guess would be that the definition is fairly strict. Now, I don't think that would prevent the first party using data processors, but I suspect the first party would have to exercise a lot of control over the processor. This would be in contrast to a service like Google Analytics, where the company's control and choice is simply limited to take it or leave it.
- krageon 7y agoA data processor agreement is not usually negotiated all that hard and this is indeed not really possible with truly large companies (and let's face it, that's where most companies get their enterprise software). Therefore I feel that expecting a lot of control being exercised is a bit of a pipe dream.