11 ms·
A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.
by dry_soup 6y ago
A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.
- geek_at 6y agoTrue. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets
- marvinblum 6y agoI would like to add https://pirsch.io/ https://pirsch.io/ :)
- bobm_kite9 6y agoThis looks really nice, but what’s to stop it getting blocked like all the other trackers once apple/uBlock/etc. add it to their database?
- marvinblum 6y agoYou cannot stop that. You can get around it for a while by serving the script yourself and setting a CNAME record for your domain to point to us. That's why we recommend integrating Pirsch into your backend so that it can't be blocked: https://docs.pirsch.io/get-started/backend-integration/ https://docs.pirsch.io/get-started/backend-integration/
- louhike 6y agoAnother solution is to do all the tracking in the backend. I'm not saying it's a good solution.
- shuckles 6y agoWouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.
- owaislone 6y agoThe backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.
- MaurizioPz 6y agopart of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary
- drcongo 6y agoI can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.
- tuna-piano 6y agoLooked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?
- colejohnson66 6y agoI’m guessing a cookie with an expiration of 24 hours, but I could be wrong
- marvinblum 6y agoProbably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch https://github.com/pirsch-analytics/pirsch
- tuna-piano 6y agoSeems like a good method and actually more accurate than they do... seems like they just do a hash of IP.
- marvinblum 6y agoHmm I think I've read something about it elsewhere and they also use more parameters than just the IP. Not sure.
- YetAnotherNick 6y agoWhat's the privacy benefit over storing a tracking cookie with expiry of a day? If at all, random cookie seems better for privacy as in your case if someone really wants it, they can recover the IP if the user agent is not rare by searching for all IP(4 billion IPv4), User-Agent(100 for popular browsers), the date(1 day as date is stored separately), and a salt(known to server), easily within reach of anyone.
- Wowfunhappy 6y agoDoes anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing stuff into the ether.
- dfreire 6y agoYou can probably find some at https://github.com/onurakpolat/awesome-analytics https://github.com/onurakpolat/awesome-analytics
- MarekKnapek 6y agoFew years back I created some HelloWorld application on Google's AppEngine (requires Java, Python or Go) and was positively surprised about its statistics on theirs dashboard.
- type0 6y agoI was also surprised but the number of different dumb bots that had tried to brute-force our app engine site on /wp-login.php and it wasn't even running on wordpress
- neilparikh 6y agoI get requests to /wp-login.php (and the like) on my simple Haskell web app hosted on my university's servers. They're quite persistent and I'm not even sure how found the URL to my app in the first place (the format is something like universityname.com/~userid/projectname, and I haven't linked it anywhere).
- bbellini 6y agoI would recommend GoatCounter. https://www.goatcounter.com/ https://www.goatcounter.com/
- madjam002 6y agoIANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I'd be interested to hear what others think. If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn't need consent. In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.
- slowwriter 6y agoMy understanding is that this kind of active consent that we see as popups everywhere on the web nowadays applies to cookies only. So I would assume that if you can track user activity without a cookie you wouldn't need it. It should probably be stated in the privacy policy though. I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.
- feanaro 6y agoGDPR doesn't care if you're accomplishing the tracking with a cookie or using a different mechanism. You're not allowed to do it either way, unless the user has consented.
- slowwriter 6y agoSince I’m being downvoted: The EU directive that specifically obligates websites to collect informed and active consent for the use of cookies is not GDPR, it’s the ePrivacy Directive. I don’t believe that one should automatically conclude that just because a cookie requires active consent, any kind of ‘logging’ (local and temporary storage of IPs in order to track website usage) requires active consent. Those are two fundamentally different things. I’m not saying you should hide the fact that you’re doing it. I’m saying it should be stated in the privacy policy. Also remember that there is a big difference between ‘personally identifiable information’ and ‘sensitive information’ which are clearly separated concepts in GDPR. Not all collection of data requires active consent. I did read my EU state’s guideline on GDPR in full, but I’m not an expert. I would suggest reading up on the ePrivacy Directive though, which is still in effect.
- dheera 6y agoAlso, it only applies in the EU. You don't need to display any banners outside the EU. Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.
- thecopy 6y agoI am also of this position – however not everyone in my team is. We are currently investigating this in my project. Do you have an authoritative source which i can show our team regarding this?
- smarx007 6y agoNo, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”"
- yohannparis 6y agoYes it apply to residents in the EU, but not EU citizens outside of the EU. Unless I misread the link.
- beardbound 6y agoI read that and it said that it applies to data not processed in the EU. I always interpreted that as applying to data centers and such in something like an was availability zone in the US. It said “ the monitoring of their behaviour as far as their behaviour takes place within the Union.” I never thought that applied to EU citizens all over the world. EU citizens living in another jurisdiction would be subject to that jurisdictions laws right? For instance GDPR wouldn’t apply to a Spanish expat that lives in Thailand, as far as I understand it.
- SilasX 6y agoRight but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for, right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, without explicit permission, to maintain that session then you still can’t use those cookies for other purposes, like analytics, right? Edit: sorry for all the “rights?”, just want to make clear I don’t convey high confidence in this claim.
- matthewheath 6y agoYes.
- munchbunny 6y agoThat's correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.
- SilasX 6y agoSo, this is a case of “tech company thinks they found a clever GDPR hack, but didn’t and is still breaking the law”?
- munchbunny 6y agoIf we're talking about Github, no, I don't think it's a clever hack. I think they've actually ripped out the offending usages. The reason I find that believable is that their core business is selling a git server with bells and whistles. From Microsoft's perspective, Github doesn't need to be doing any marketing because they kind of are the marketing.
- SilasX 6y ago
- Macha 6y agoI think a lot of people are willingly misunderstanding this too
- jwr 6y agoYes! If you use cookies for essential functionality (like keeping track of logged in status), you don't have to do anything. No banners, no annoyance for your users. I dropped all third-party crap from my site way back and haven't ever needed a cookie banner.
- BlueTemplar 6y agoHow long can you keep people logged in before it becomes the bad kind of tracking?
- p_l 6y agoDepends only on whether the fact that they are logged in is used to process any kind of personal data. The question is not "how long". The question is what data, and what happens to it.
- BlueTemplar 6y agoIt is, because "logged in" is an abstraction - someone has to decide how frequently you have to contact the server before being considered to have "logged out".
- p_l 6y agoa cookie representing authentication session with your app isn't personal data, and doesn't need privacy policy, especially if your login is arbitrary and not an email. It doesn't matter how long it's active either, unless you use it to track users activity elsewhere
- BlueTemplar 6y agoIf it's used to determine identity, it's a kind of personal data. However, as you say, it might be allowed by GDPR without requesting extra approval, depending on the way that it's being used and who it is shared with? Hence my question about whether the length of time that you store this data legally matters (because since databases can be stolen, it eventually does). Compare with how ISPs must store all your connection logs for a specific amount of time.
- jedberg 6y agoPart of the problem is that when it first passed, the advice was to just add a cookie banner no matter what to be safe, since no one really understood the law and exactly when it did or did not apply.
- layer8 6y agoThe banners are an opportunity to have the user consent to more than they would otherwise consent to (“allow all”).
- fmntf 6y agoYou are right, and that unfortunately happened because nobody even tried to read the law (which is quite clear regarding this). It's easier to just follow other sheep.
- noja 6y agowhat about identifiable information like ip addresses?
- spullara 6y agogenerally they are used to protect against DDOS and to have forensic data in the case there is malicious behavior and are allowed as essential to operating the service.
- BlueTemplar 6y agoBut then they can read the logs and track you anyway?
- spullara 6y agoSure. But that would be against the GDPR if you didn't say you were going to use it for that.
- BlueTemplar 6y agoAnd who is going to check and enforce that?
- spullara 6y agoThat is within the domain of the EU governments.
- canofbars 6y agoIP addresses are only considered PI if combined with other datapoints.
- swiley 6y agoI really hate the lies you see on a lot of new sites that they will send cookies "necessary for basic functionality." You're serving articles, there's no reason for session tracking!
- amgutier 6y agoI can see a need for cookies to mitigate against things like DDoS attacks, session management for paywalled content or just to leave comments on articles, favoriting certain sections. There are several reasons why as a reader you would want the site to be stateful.
- canofbars 6y agoWithout cookies they can't check if you closed the cookie nag.
- ttepasse 6y agoMore information is in Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Working Party of the European Commission about Cookie Consent, which elaborates about the topic: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... (The §29 WP is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Maybe they are waiting for a forthcoming ePrivacy Regulation. Also: IANAL.)
- Alupis 6y ago> A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case. A lot of people also have the misconception that the EU cookie law applies to them, even if they are not in the EU and have no EU physical presence.
- whiddershins 6y agoWait, is that true? You need to have a physical presence in the EU? If so, why did everyone scramble to meet the requirements. Was it a scam?
- Strom 6y agoIt's not about physical presence. It's about whether the EU could do something to punish you. For every big company that is true. For example the EU can force Visa/MasterCard to stop doing business with you. If you're small enough, then the EU won't bother doing anything. If you don't even depend on any 3rd party that is vulnerable to EU will then you can fully ignore everything. That can be tricky to achieve though. No common money transfer methods and you must be self-hosting. Also, all of this isn't new. The US has been enforcing its will globally in a similar fashion for a long time.
- jeroenhd 6y agoPeople get scared of lawsuits, especially if they're from a very litigious country like the EU. Companies lobbied against the law hard, spreading the idea that any visitor of your website could sue you for millions because you sent a cookie header. Reality is much less scary for most decent people. Technically, the law applies to everyone worldwide, regardless of location. However, if you have no business in the EU and don't plan to expand your current business operations to the EU, you don't need to worry. Hell, if you don't meet the requirements, the relevant enforcement departments generally give you plenty time to implement the necessary requirements or block access if you're a dick. The exception, of course, is data brokers and huge companies like Facebook or Google where the impact is much larger. The GDPR doesn't expose you to lawsuits from anyone but the privacy monitoring instances of EU member states. The average American blog or news site isn't nearly large enough for any government instance to start a lawsuit. You can also ask yourself: so what if they fine my company a €10.000. They're not going to send a team of special forces over the Atlantic or through Russia just to extract the cash from you. You only need to pay the fine if your company ever needs to do business in the EU. If your company structure makes your personally liable, this also impacts your future holiday destination decisions, but you can live perfectly fine without seeing the Eiffel tower. A lot of very similar laws are also being passed in California right now, which will probably be a lot more dangerous than any GDPR restriction, but if you follow the GDPR you're pretty much set to protect yourself from Californian lawsuits as well. Most of the GDPR is just "don't be a dick with people's data". If the fear of not meeting requirements stops the free-for-all data exchange market, then I'm perfectly fine with that.
- xavierlint 6y agoWell, it's a reasonable misconception to have, banners don't usually explain everything, they mostly say "hey, we use cookies", and not "hey, we use non-essential cookies".