6 ms·
Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.
by louhike 6y ago
Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.
- shuckles 6y agoWouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.
- owaislone 6y agoThe backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.
- MaurizioPz 6y agopart of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary
- drcongo 6y agoI can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.
- OJFord 6y agoFor very recent comments, click on the timestamp to get the single comment view and be able to reply. (I had to do it here too.)
- drcongo 6y agoOh! Useful tip, thanks!
- edoceo 6y agoYou folks might just be time limited on the reply - HN puts some brakes on "too fast" commenting
- OJFord 6y agoSee my profile if you want, that was my first comment in hours. I think it is that sort of brake, (prevents heated discussions veing quite so quick-fire) but it's not on the user, it's on everyone for <'5 [or something] minutes ago' comments; drcongo's happened to be '0 minutes ago' when I loaded the page, so I clicked on it to reply.
- jarofgreen 6y agoIANAL!!!! But I think, yes, there are still implications. GDPR makes no distinction about back end and front end AFAIK, it's just about what data you collect and why/purpose. But note there are other reasons you can have for collecting data other than consent (something often overlooked) - for example I would guess GitHub would log IP addresses in the back end for a limited time for spam fighting reasons, and I think that would be fine.
- munchbunny 6y agoIt would still be a violation because of how you're using it. The law isn't purely about what data you track, it's primarily about what you do with the data.
- asimops 6y agoTo my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.
- BlueTemplar 6y agoWould that mean that you need consent for storing IP addresses in logs?
- kybernetikos 6y agoIt depends on what you use them for, but I think you would need it documented that you do it and why.
- M2Ys4U 6y agoThere are six legal bases for processing personal data, consent is only one of those.
- coldpie 6y agoOr, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.
- scrollaway 6y agoMuch like logging though, it's the 1 percent that isn't discarded that's important. I agree with you by the way, but ...
- chipotle_coyote 6y agoThis is probably correct. On my personal web sites I'm using GoAccess, which is basically a new spin on a very old idea -- just analyzing the server's web logs. https://goaccess.io https://goaccess.io That's not as accurate as throwing around cookies and JavaScript, but I rarely check the log pages anyway, and when I do I'm less interested in raw numbers than I am in the relative performance of various pages. (And that's mostly just idle curiosity, e.g., are there some old articles that keep getting steady traffic from somewhere?)