5 ms·

I don’t think GDPR necessarily says that one must get consent for every cookie.

by eli 7y ago

tyingq 7y ago
Google analytics does use first party cookies for the site stats, but it also s̶e̶t̶s̶ [edit] can set a third party DoubleClick cookie that tracks users across sites. So that anonymizing the IP doesn't anonymize the user. There's also optional functionality that can track users via the first party cookie. Passing login id, for example, to GA.
- founderling 7y ago
  it also sets a third party DoubleClick cookie I have never witnessed that. Can you link to a site that uses only Google Analytics where that happens? Maybe you confused Analytics and Adsense?
  - tyingq 7y ago
    "For customers that are using Google Analytics' Display Advertiser features, such as remarketing, a third-party DoubleClick cookie is used in addition to the other cookies" So, I suppose I should have said "can set", though remarketing is very common. https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage https://developers.google.com/analytics/devguides/collection...
    - founderling 7y ago
      I would think that enabling the "Display advertisers features" only makes sense for webmasters who also use Google Adsense. And then their visitors get bombarded with all kinds of cookies anyhow. So I don't think it applies to the use case at hand. Where a webmaster wants to implement statistics without violating GDPR.
      - tyingq 7y ago
        It's used for Adwords. That doesn't change anything on your site. You can remarket only on Google searches, for example...no AdSense involved.
  - true_religion 7y ago
    It’s not a double click cookie, but if you have multiple sites under the same analytics account google will be able to track cross site sessions via a cookie they set to their own domain.
    - eli 7y ago
      Not in a default configuration
donohoe 7y ago
There is much confusion as there is both the Directive 2009/136/EC (aka EU Cookie Law) AND GDPR. EU mandated that all websites (residing in EU) to obtain informed consent before they can store or retrieve information on a visitor's computer or web-enabled device. This is not limited to "cookies". The law doesn't even mention the word "cookie". It covers localStorage and any TBD technology in the future. There are exceptions for "strictly necessary" like a store would not have to get consent to operate a shopping cart on the website as thats can be considered critical to the purchasing and checking out. However storing what you browsed for recommendation purposes is not, and therefore that would require consent.
ksec 7y ago
On the Subject of GDPR, Are there any website still blocking EU visitors or has that been solved? I remember when GDPR was introduce lots of website simply decide to shut off EU IP access and redirect them to a page saying not available to EU.
- LeftHandPath 7y ago
  I think a number of US news sites (e.g. LA Times) still block EU traffic. Furthermore, GDPR has caused a massive decrease in the number of newly registered domains that are successfully recognized as spam: > Prior to the implementation of GDPR, security researchers were able to identify and block 1.8 million newly registered malicious domains in October of 2017 alone. Fast forward to February of 2019 and that number drops to less than 160,000.[0] And it has caused a major annoyance for the general public, who mindlessly consent to almost every "consent" prompt they are given.[1] Companies are also at the mercy of their regional government when it comes to compliance. A company in Greece was fined 150,000 euros, not because the law made it illegal to process data in the way they did, but because the reason they provided for processing was the "wrong" one.[2] > PWC asked its employees for permission to process their personal data when it should have used a different legal basis (combination of contract, legal obligations and legitimate interest). [(2)] In effect, their effort to follow the law made them break the law, even though their actions were legal under Article 6, Section 1 of the GDPR.[3] This flies in the face of the EU's language in 2018, where they suggested that companies attempt to follow the "spirit of the law" rather than to worry about dotting i's and crossing t's. Oddly enough, regulators seem to be pleased with this outcome of seemingly arbitrary enforcement. [0]: http://www.circleid.com/posts/20191213_the_high_cost_of_privacy_in_a_post_gdpr_world/ http://www.circleid.com/posts/20191213_the_high_cost_of_priv... [1]: https://www.cnbc.com/2019/05/04/gdpr-has-frustrated-users-and-regulators.html https://www.cnbc.com/2019/05/04/gdpr-has-frustrated-users-an... [2]: https://iapp.org/news/a/just-say-yes-gdpr-consent-is-not-as-simple-as-it-seems/ https://iapp.org/news/a/just-say-yes-gdpr-consent-is-not-as-... [3]: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

I don’t think GDPR necessarily says that one must get consent for every cookie.

by eli 7y ago

I don’t think GDPR necessarily says that one must get consent for every cookie.

Google analytics does use first party cookies for the site stats, but it also s̶e̶t̶s̶ [edit] can set a third party DoubleClick cookie that tracks users across sites. So that anonymizing the IP doesn't anonymize the user. There's also optional functionality that can track users via the first party cookie. Passing login id, for example, to GA.

founderling 7y ago
it also sets a third party DoubleClick cookie I have never witnessed that. Can you link to a site that uses only Google Analytics where that happens? Maybe you confused Analytics and Adsense?
- tyingq 7y ago
  "For customers that are using Google Analytics' Display Advertiser features, such as remarketing, a third-party DoubleClick cookie is used in addition to the other cookies" So, I suppose I should have said "can set", though remarketing is very common. https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage https://developers.google.com/analytics/devguides/collection...
  - founderling 7y ago
    I would think that enabling the "Display advertisers features" only makes sense for webmasters who also use Google Adsense. And then their visitors get bombarded with all kinds of cookies anyhow. So I don't think it applies to the use case at hand. Where a webmaster wants to implement statistics without violating GDPR.
    - tyingq 7y ago
      It's used for Adwords. That doesn't change anything on your site. You can remarket only on Google searches, for example...no AdSense involved.
- true_religion 7y ago
  It’s not a double click cookie, but if you have multiple sites under the same analytics account google will be able to track cross site sessions via a cookie they set to their own domain.
  - eli 7y ago
    Not in a default configuration

donohoe 7y ago

There is much confusion as there is both the Directive 2009/136/EC (aka EU Cookie Law) AND GDPR. EU mandated that all websites (residing in EU) to obtain informed consent before they can store or retrieve information on a visitor's computer or web-enabled device. This is not limited to "cookies". The law doesn't even mention the word "cookie". It covers localStorage and any TBD technology in the future. There are exceptions for "strictly necessary" like a store would not have to get consent to operate a shopping cart on the website as thats can be considered critical to the purchasing and checking out. However storing what you browsed for recommendation purposes is not, and therefore that would require consent.

ksec 7y ago

On the Subject of GDPR, Are there any website still blocking EU visitors or has that been solved? I remember when GDPR was introduce lots of website simply decide to shut off EU IP access and redirect them to a page saying not available to EU.

LeftHandPath 7y ago
I think a number of US news sites (e.g. LA Times) still block EU traffic. Furthermore, GDPR has caused a massive decrease in the number of newly registered domains that are successfully recognized as spam: > Prior to the implementation of GDPR, security researchers were able to identify and block 1.8 million newly registered malicious domains in October of 2017 alone. Fast forward to February of 2019 and that number drops to less than 160,000.[0] And it has caused a major annoyance for the general public, who mindlessly consent to almost every "consent" prompt they are given.[1] Companies are also at the mercy of their regional government when it comes to compliance. A company in Greece was fined 150,000 euros, not because the law made it illegal to process data in the way they did, but because the reason they provided for processing was the "wrong" one.[2] > PWC asked its employees for permission to process their personal data when it should have used a different legal basis (combination of contract, legal obligations and legitimate interest). [(2)] In effect, their effort to follow the law made them break the law, even though their actions were legal under Article 6, Section 1 of the GDPR.[3] This flies in the face of the EU's language in 2018, where they suggested that companies attempt to follow the "spirit of the law" rather than to worry about dotting i's and crossing t's. Oddly enough, regulators seem to be pleased with this outcome of seemingly arbitrary enforcement. [0]: http://www.circleid.com/posts/20191213_the_high_cost_of_privacy_in_a_post_gdpr_world/ http://www.circleid.com/posts/20191213_the_high_cost_of_priv... [1]: https://www.cnbc.com/2019/05/04/gdpr-has-frustrated-users-and-regulators.html https://www.cnbc.com/2019/05/04/gdpr-has-frustrated-users-an... [2]: https://iapp.org/news/a/just-say-yes-gdpr-consent-is-not-as-simple-as-it-seems/ https://iapp.org/news/a/just-say-yes-gdpr-consent-is-not-as-... [3]: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/