7 ms·
Author here. Our tool is GDPR compliant out of the box. We can't use local storage (it's legal wise the same as a cookie). Although your suggestion will provide
by AdriaanvRossum 7y ago
Author here. Our tool is GDPR compliant out of the box. We can't use local storage (it's legal wise the same as a cookie). Although your suggestion will provide more accurate stats, it's a trade-off we are willing to accept.
- bouncycastle 7y agoHow about referring from a https site? AFAIK, browsers don't send a referrer from s https site.
- michaelbuckbee 7y agoIf the referring site is http and the site being referred to it won't send the referrer header. http --> https = no referrer header https --> https = referrer header
- sm4rk0 7y agoActually: https --> http = no referrer header
- sm4rk0 7y ago> HTTPS sites will never transmit referer information to non-HTTPS sites https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns https://developer.mozilla.org/en-US/docs/Web/Security/Refere...
- AdriaanvRossum 7y agoThat is not really relevant because if a user comes from a different website and the referrer is not present, it will be counted as unique. Having a referrer of that other website or having no referrer does not change anything. We both treat them as unique. The only referrer we actually use is the one from the same site to the same site. Those requests are always with the same protocol (and if you not you should change that). In that case we see both the hostname and the referrer are equal thus being non unique.
- __ka 7y ago> it's legal wise the same as a cookie I am not sure that is the case. GDPR makes provisions for personal data that can uniquely identify users. Blanket statements like: Local storage is not allowed I think are misleading. The state is persisted in the client's machine. Unlike cookies, which get attached to all requests in the specified path, local storage items are not transmitted with the request. Furthermore, in the approach I recommended earlier, no unique identifiers are being sent with the request at all. I am pretty sure that is GDPR compliant, but would love to be pointed to legal provisions that would suggest otherwise. > it's a trade-off we are willing to accept. Referrers, in my opinion, are not reliable enough to derive uniques, and I would assume (although I would not have any numbers to back it up), that the margin of error is very significant when you consider every condition under which referrers would not be sent (some very good cases when that happens are mentioned by other people in this very thread)
- jedimastert 7y agoFunctionally, local storage is the same as cookies with the only real difference being it requires an active request. Any information stored can immediately moved to and from the browser to the server with fetch or whatever. "Uniquely identifying users" would work with local storage the same as a cookie.
- true_religion 7y agoIt could be moved, but until you actually do it it’s not tracking but merely logging.
- yorwba 7y agoThe same is true for cookies.
- true_religion 7y agoBut cookies are automatically sent with every request to your server. So you would need to take special care to ensure they aren’t sent until you have permission.
- pkalinowski 7y agoHow about using quickly expiring cookies to tell if visit is unique (no cookie) or same (cookie exist). It would get reset if external referer is recognized.
- NullPrefix 7y agoSetting a short expiring cookie is still setting a cookie.
- pleasecalllater 7y agoJust like setting a cookie that I didn't agree for setting other cookies :)