3 ms·

Another way of looking at it: the effect of the legislation has been to expose that just about every website tracks you. Websites don't have to put a cookie ba

Another way of looking at it: the effect of the legislation has been to expose that just about every website tracks you. Websites don't have to put a cookie banner for every kind of cookie. They have to show it whenever they collect identifying data about you. If they choose not to collect info on their visitors, then they don't have to put a banner.

berkes 6y ago
With most of my customers the conversation goes something like: - Customer: We must still implement that cookie popup before launch! - Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop. - Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice? - Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now. Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up". There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem. Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.
- johannes1234321 6y ago
  You should add this question to your set of questions: "Do you really want to report all your users up to Google, so that Google sees how successful your product is and can build a competing product?" And yeah, doesn't work for all sorts of things, but as a site operator I would be careful in giving away that information out of self interest already ...
- esperent 6y ago
  You don't even have to fully disable GA. You just need to disable individual level tracking, as far as I know.
  - smhg 6y ago
    With the anonymizeIp parameter? https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#anonymizeIp https://developers.google.com/analytics/devguides/collection...
  - berkes 6y ago
    I am no lawyer, but I was told this still is "third party tracking cookies" which is what the GDPR is about.
- dorgo 6y ago
  >Log-analyzers as alternative You mean... no opt-in popup is required for logfiles? Isn't it also PII? IP + browser + timestamp + referrer? It's almost enough to identify unique visitors.
m12k 6y ago
Yup, it's very similar to what happened with Windows Vista. Those security dialogs were annoying as hell, but the real issue was that most applications were used to running with way more permissions than they really needed. Windows 7 didn't get the flak that Windows Vista got, but the biggest difference was just that applications had had time to fix their permissions so they didn't ask for admin rights that they didn't actually need.

berkes 6y ago

With most of my customers the conversation goes something like: - Customer: We must still implement that cookie popup before launch! - Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop. - Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice? - Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now. Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up". There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem. Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.

johannes1234321 6y ago
You should add this question to your set of questions: "Do you really want to report all your users up to Google, so that Google sees how successful your product is and can build a competing product?" And yeah, doesn't work for all sorts of things, but as a site operator I would be careful in giving away that information out of self interest already ...
esperent 6y ago
You don't even have to fully disable GA. You just need to disable individual level tracking, as far as I know.
- smhg 6y ago
  With the anonymizeIp parameter? https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#anonymizeIp https://developers.google.com/analytics/devguides/collection...
- berkes 6y ago
  I am no lawyer, but I was told this still is "third party tracking cookies" which is what the GDPR is about.
dorgo 6y ago
>Log-analyzers as alternative You mean... no opt-in popup is required for logfiles? Isn't it also PII? IP + browser + timestamp + referrer? It's almost enough to identify unique visitors.

m12k 6y ago

Yup, it's very similar to what happened with Windows Vista. Those security dialogs were annoying as hell, but the real issue was that most applications were used to running with way more permissions than they really needed. Windows 7 didn't get the flak that Windows Vista got, but the biggest difference was just that applications had had time to fix their permissions so they didn't ask for admin rights that they didn't actually need.