4 ms·

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party anal

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

brtkdotse 6y ago
I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.
- p410n3 6y ago
  I work a lot with GDPR and making sites compliant, and some agency's do in fact tell this to their customers. I suspect it's to sell their Services for cheaper. Luckily where I work we are pretty serious about this stuff. Since one of our main revenue's is Data protection consulting, anything else would be idiotic anyway
- throwaway2245 6y ago
  I believe it is generally untested in law whether third-party Analytics count as "legitimate interest" (direct consent not required) in EU GDPR, which is why cookie banners talk a lot about "legitimate interest" now.
that_guy_iain 6y ago
There is no bright line, mostly as far as I can tell it’s session cookies and those you need to set to fulfill your contracts with the user.
fluidcruft 6y ago
Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.
- sildur 6y ago
  They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.
  - tjpnz 6y ago
    Sounds like a security nightmare.
  - criley2 6y ago
    That's disgusting. And it's like saying roads aren't essential because cars can drive on dirt.
  - knome 6y ago
    >a URL parameter I love those systems. Especially when the unwary users share links, accidentally letting other users into the site as them. Or when google indexes it, and in addition to terrible security, the site uses regular GET links to perform site actions, so google deletes the user's content or buys a bunch of stuff as them while walking the links it finds as it indexes in beyond the user's initial account bearing link. lol. no.
    - sildur 6y ago
      Hey, I'm not saying it's a good idea. I'm only saying it can be done. I would very much prefer cookies.
  - agency 6y ago
    Would this mean that if you shared a URL with someone you would be sharing your session as well?
    - lloeki 6y ago
      Yes. Some sites operating like that eventually tried to work around this issue by tying it to the IP, but you can see how that is hopelessly broken anyway.
ed 6y ago
Yeah here’s what it says about “necessary processing,” which does not require user consent. Note GDPR never mentions cookies, or cookie banners. It regulates the control and processing of personal information (which can be stored in cookies). https://gdpr.algolia.com/gdpr-article-6 https://gdpr.algolia.com/gdpr-article-6 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
munchbunny 6y ago
There isn't an obvious bright line, and that's probably intentional. This is not legal language or legal advice, but the gist of it is "if you don't have it, can your website still do what it claims to do?" For a site like Github, if you can't use cookies to maintain session state, you'd have trouble implementing login sessions, so that's pretty squarely on the essential side of the fence. But moving into murkier territory, how about logging the IP addresses you signed in from? If you're using it to detect new login locations or new devices as a security alerting thing, then I think you can make a strong enough claim that this is essential. (Again, not a lawyer, this is not legal advice.) What if a PM wants to look in these logs for how many unique users show up in each country? That's pretty squarely on the side of analytics, and is probably not essential. But... muddying the waters more, what about if an engineer wants to query unique users to figure out how many more racks of servers to buy? I have no idea. I'd be asking a lawyer.
dathinab 6y ago
- Security stuff (auth tokens and similar) are generally essential (if only used for that purpose). - Any form of tracking people is generally non-essential. What you can and can't do is not based on technical implementation details but practical usage of the information!! The tricky part if when both overlap, i.e. if you track people but only for assuring a secure operation, i.e. you don't use the tracking information for anything besides their main purpose of assuring secure operation. A lot (all?) of systems which provide such security specific tracking do not strictly limit their usage, access and collection of information and as such are also used for non-essential purposes and in turn need opt-in. But then sometimes companies try to abuse it and will do do until taken to court. For example Facebook argued that people use Facebook with the (main) intend to get customized ads and as such tracking them is essential for Facebooks service. As you can guess this argument is completely ridiculous especially given that they also track users which don't use Facebook, but if you are the size of Facebook you can try to bring that to court and maybe gain a bit more time before you need to comply.
deleted 6y ago
[deleted]
ttepasse 6y ago
There is no direct language about cookies in article 5(3) of the ePrivacy Directive. What we have is Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Working Group of the European Commission about Cookie Consent, which elaborates about the topic: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... (The §29 WG is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Also: IANAL.)

brtkdotse 6y ago

I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.

p410n3 6y ago
I work a lot with GDPR and making sites compliant, and some agency's do in fact tell this to their customers. I suspect it's to sell their Services for cheaper. Luckily where I work we are pretty serious about this stuff. Since one of our main revenue's is Data protection consulting, anything else would be idiotic anyway
throwaway2245 6y ago
I believe it is generally untested in law whether third-party Analytics count as "legitimate interest" (direct consent not required) in EU GDPR, which is why cookie banners talk a lot about "legitimate interest" now.

that_guy_iain 6y ago

There is no bright line, mostly as far as I can tell it’s session cookies and those you need to set to fulfill your contracts with the user.

fluidcruft 6y ago

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

sildur 6y ago
They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.
- tjpnz 6y ago
  Sounds like a security nightmare.
- criley2 6y ago
  That's disgusting. And it's like saying roads aren't essential because cars can drive on dirt.
- knome 6y ago
  >a URL parameter I love those systems. Especially when the unwary users share links, accidentally letting other users into the site as them. Or when google indexes it, and in addition to terrible security, the site uses regular GET links to perform site actions, so google deletes the user's content or buys a bunch of stuff as them while walking the links it finds as it indexes in beyond the user's initial account bearing link. lol. no.
  - sildur 6y ago
    Hey, I'm not saying it's a good idea. I'm only saying it can be done. I would very much prefer cookies.
- agency 6y ago
  Would this mean that if you shared a URL with someone you would be sharing your session as well?
  - lloeki 6y ago
    Yes. Some sites operating like that eventually tried to work around this issue by tying it to the IP, but you can see how that is hopelessly broken anyway.

ed 6y ago

Yeah here’s what it says about “necessary processing,” which does not require user consent. Note GDPR never mentions cookies, or cookie banners. It regulates the control and processing of personal information (which can be stored in cookies). https://gdpr.algolia.com/gdpr-article-6 https://gdpr.algolia.com/gdpr-article-6 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

munchbunny 6y ago

There isn't an obvious bright line, and that's probably intentional. This is not legal language or legal advice, but the gist of it is "if you don't have it, can your website still do what it claims to do?" For a site like Github, if you can't use cookies to maintain session state, you'd have trouble implementing login sessions, so that's pretty squarely on the essential side of the fence. But moving into murkier territory, how about logging the IP addresses you signed in from? If you're using it to detect new login locations or new devices as a security alerting thing, then I think you can make a strong enough claim that this is essential. (Again, not a lawyer, this is not legal advice.) What if a PM wants to look in these logs for how many unique users show up in each country? That's pretty squarely on the side of analytics, and is probably not essential. But... muddying the waters more, what about if an engineer wants to query unique users to figure out how many more racks of servers to buy? I have no idea. I'd be asking a lawyer.

dathinab 6y ago

- Security stuff (auth tokens and similar) are generally essential (if only used for that purpose). - Any form of tracking people is generally non-essential. What you can and can't do is not based on technical implementation details but practical usage of the information!! The tricky part if when both overlap, i.e. if you track people but only for assuring a secure operation, i.e. you don't use the tracking information for anything besides their main purpose of assuring secure operation. A lot (all?) of systems which provide such security specific tracking do not strictly limit their usage, access and collection of information and as such are also used for non-essential purposes and in turn need opt-in. But then sometimes companies try to abuse it and will do do until taken to court. For example Facebook argued that people use Facebook with the (main) intend to get customized ads and as such tracking them is essential for Facebooks service. As you can guess this argument is completely ridiculous especially given that they also track users which don't use Facebook, but if you are the size of Facebook you can try to bring that to court and maybe gain a bit more time before you need to comply.

deleted 6y ago

[deleted]

ttepasse 6y ago

There is no direct language about cookies in article 5(3) of the ePrivacy Directive. What we have is Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Working Group of the European Commission about Cookie Consent, which elaborates about the topic: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... (The §29 WG is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Also: IANAL.)