4 ms·

Slightly off topic: Plausible claim that their cookieless tracking is GDPR compliant but this seems a bit shaky to me. Unless they are doing something that isn'

Slightly off topic: Plausible claim that their cookieless tracking is GDPR compliant but this seems a bit shaky to me. Unless they are doing something that isn't specified in their docs their fingerprinting seems reversible which would make their user identifiers PII like any session ID you'd store in a cookie. AIUI the GDPR doesn't particularly care about cookies, it cares about you tracking people without their consent. If you have a cookieless way of tracking individual people that is as accurate as cookies then clearly you still need consent?

abofh 6y ago
Correct, the rulings to date have generally involved cookies, but it's the act, not the tool.
iamacyborg 6y ago
GDPR doesn't care about tracking, it's about data processing. How cookies are handled in a compliant manner is handled under something like PECR (in the UK at least). https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... If data is being processed without containing PII, then GDPR becomes a non-issue. /edit My bad, because this tool uses cookies it does in fact require consent if it's to be used in a properly GDPR compliant manner.
- freeone3000 6y ago
  It contains IP addresses, which are personally identifiable under the GDPR.
pmontra 6y ago
Yes. GDPR is about collection and processing of personal information. How you collect them is not important. HTTP cookies or fingerprinting and successive deanonimization is the same as getting the name and address with a form on paper. You need consent.
Symbiote 6y ago
It seems on-topic, since the post is essentially advertising the Plausible.io service. > In summary, here’s how we assign a hash that we use for unique user counting: hash(website_domain + ip_address + user_agent) Would adding a daily salt to this make it compliant? You'd no longer be able to track if someone returns to the website the next day. https://plausible.io/data-policy https://plausible.io/data-policy
secondcoming 6y ago
It's not impossible to fingerprint people by using the GDPR consent cookie itself.
m90 6y ago
Even if this hash would include a salt and the salt is rotated daily, you'd still be able to reverse information for the last day (there's an interesting doc by the European Union itself on that topic: https://edps.europa.eu/data-protection/our-work/publications/papers/introduction-hash-function-personal-data_en https://edps.europa.eu/data-protection/our-work/publications...). I feel most of these "privacy" focused analytics tools are mostly about working around the need for a cookie banner. I also don't get how they can continue to show off their public dashboards full of data that has been collected without user consent, boasting about how many hits they have. Gives me the feeling "Privacy" is more of a marketing tactic here than a mission.
- __alexs 6y ago
  The thing is the "cookie banner" is not required simply because you use cookies. Consent is required for any processing of PII regardless of the technical means through which you get it. I don't know if "privacy" is just a marketing tactic but I have definitely seen a lot of misplaced good deeds based on not understanding the regulation correctly.
sigwinch28 6y ago
The answer is: it depends. The GDPR allows for collection and processing without consent for several reasons including (but not limited to) legal requirement (e.g. anti-fraud) and legitimate interests (e.g. app install conversions). The GDPR is also quite clear that consent is not required to collect _anonymous_ data, i.e. data which in no way can be traced back to the individual, but this requires balancing with the other principles of the regulation. Recital 26 of the GDPR states: “…The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”
- ThePhysicist 6y ago
  It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information. Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.
  - sigwinch28 6y ago
    I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.
    - ThePhysicist 6y ago
ThePhysicist 6y ago
You also have to adhere to the ePrivacy directive, which specifies, among other things, how you are allowed to identify users on their devices (e.g. using cookies).
- GordonS 6y ago
  I don't have a link on hand, but I posted about this recently in an HN article about Fathom. There is an ePrivacy Directive ammendment that specifically prohibits the use of hashing identifiers (e.g. IP address, browser, OS) to work around cookies, even it a timestamp is introduced to limit the life of a hashed ID. I'm a privacy advocate myself, yet find this a bit OTT - but that's the ePrivacy regulations, and I think Plausible could get burned here at some point. Presumably they know about this amendment and are betting that there will be no enforcement, or their lawyers have found a weasel-wordy loophole (I doubt the later, as the directive is very specific).
  - m90 6y ago
    I think this is the document you are referring to: https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=57541 https://ec.europa.eu/newsroom/article29/document.cfm?action=..., Revision of Article 5(3)
  - deleted 6y ago
    [deleted]

abofh 6y ago

Correct, the rulings to date have generally involved cookies, but it's the act, not the tool.

iamacyborg 6y ago

GDPR doesn't care about tracking, it's about data processing. How cookies are handled in a compliant manner is handled under something like PECR (in the UK at least). https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... If data is being processed without containing PII, then GDPR becomes a non-issue. /edit My bad, because this tool uses cookies it does in fact require consent if it's to be used in a properly GDPR compliant manner.

freeone3000 6y ago
It contains IP addresses, which are personally identifiable under the GDPR.

pmontra 6y ago

Yes. GDPR is about collection and processing of personal information. How you collect them is not important. HTTP cookies or fingerprinting and successive deanonimization is the same as getting the name and address with a form on paper. You need consent.

Symbiote 6y ago

It seems on-topic, since the post is essentially advertising the Plausible.io service. > In summary, here’s how we assign a hash that we use for unique user counting: hash(website_domain + ip_address + user_agent) Would adding a daily salt to this make it compliant? You'd no longer be able to track if someone returns to the website the next day. https://plausible.io/data-policy https://plausible.io/data-policy

secondcoming 6y ago

It's not impossible to fingerprint people by using the GDPR consent cookie itself.

m90 6y ago

Even if this hash would include a salt and the salt is rotated daily, you'd still be able to reverse information for the last day (there's an interesting doc by the European Union itself on that topic: https://edps.europa.eu/data-protection/our-work/publications/papers/introduction-hash-function-personal-data_en https://edps.europa.eu/data-protection/our-work/publications...). I feel most of these "privacy" focused analytics tools are mostly about working around the need for a cookie banner. I also don't get how they can continue to show off their public dashboards full of data that has been collected without user consent, boasting about how many hits they have. Gives me the feeling "Privacy" is more of a marketing tactic here than a mission.

__alexs 6y ago
The thing is the "cookie banner" is not required simply because you use cookies. Consent is required for any processing of PII regardless of the technical means through which you get it. I don't know if "privacy" is just a marketing tactic but I have definitely seen a lot of misplaced good deeds based on not understanding the regulation correctly.

sigwinch28 6y ago

The answer is: it depends. The GDPR allows for collection and processing without consent for several reasons including (but not limited to) legal requirement (e.g. anti-fraud) and legitimate interests (e.g. app install conversions). The GDPR is also quite clear that consent is not required to collect _anonymous_ data, i.e. data which in no way can be traced back to the individual, but this requires balancing with the other principles of the regulation. Recital 26 of the GDPR states: “…The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”

ThePhysicist 6y ago
It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information. Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.
- sigwinch28 6y ago
  I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.
  - ThePhysicist 6y ago

ThePhysicist 6y ago

You also have to adhere to the ePrivacy directive, which specifies, among other things, how you are allowed to identify users on their devices (e.g. using cookies).

GordonS 6y ago
I don't have a link on hand, but I posted about this recently in an HN article about Fathom. There is an ePrivacy Directive ammendment that specifically prohibits the use of hashing identifiers (e.g. IP address, browser, OS) to work around cookies, even it a timestamp is introduced to limit the life of a hashed ID. I'm a privacy advocate myself, yet find this a bit OTT - but that's the ePrivacy regulations, and I think Plausible could get burned here at some point. Presumably they know about this amendment and are betting that there will be no enforcement, or their lawyers have found a weasel-wordy loophole (I doubt the later, as the directive is very specific).
- m90 6y ago
  I think this is the document you are referring to: https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=57541 https://ec.europa.eu/newsroom/article29/document.cfm?action=..., Revision of Article 5(3)
- deleted 6y ago
  [deleted]