5 ms·

this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not s

this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not send any information to third-party analytics services" - but presumably third parties are still able to access this data on request. their privacy policy probably reflects this. if you visit a website and don't want to be tracked, make it as hard as possible for the host to do so, don't rely on what the host says. they can do anything they like with visitors' data. anyone who hosts websites will confirm this

dessant 6y ago
Yes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.
- 867-5309 6y ago
  consent is simple to gain, who reads the entire ToS and privacy policy? the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
  - dessant 6y ago
    > consent is simple to gain, who reads the entire ToS and privacy policy? That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service. > the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself The request can be blocked with uBlock Origin, but it's still important to draw attention to tracking that may be illegal, since not everyone has a content blocker installed.
    - 867-5309 6y ago
      if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise
      - dessant 6y ago
        Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#Five_Elements_Of_Consent_Under_The_Gdpr https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
        eitland 6y ago
        To add to this: from my understanding of the rules even a lot of the informed consent popups today aren't compliant. If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out. IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.
        merijnv 6y ago
        Correct. Also, you cannot with hold access upon users not consenting, so there's literally zero incentive for users to ever consent for compliant providers. Which is kinda obvious with the GDPR's overall goal of making it impossible to use privacy as currency.
        deleted 6y ago
        [deleted]
        867-5309 6y ago
        it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help you understand the difference between should and must: https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt
  - tripzilch 6y ago
    > consent is simple to gain, who reads the entire ToS and privacy policy? nobody because they are pretty much meaningless in the EU we got laws to protect consumers, not laws for businesses to trick users into making some meaningless gesture > the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself what do you mean by "local lawmakers"? these laws are EU-wide. or did you mean "local" to mean, "non-US" anyway, these lawmakers are fighting the shitty corporations that pull this tracking stuff and your bottom line is not really a choice one way or the other. I can use blockers and other plugins to protect myself, AND cheer on the people fighting the fuckfaces that think it's in any way honourable to make a profit by merely following the letter of our laws but we got some really good consumer protections in the EU. and we try to keep it that way. we're not going to simply roll over because some US corporations are used to being able to track the hell out of US customers
dspillett 6y ago
> no cookies doesn't mean no tracking It does though make tracking by third parties so they can sell things to me (or sell information about me to other parties for that use) more difficult. Not impossible though, of course.
tripzilch 6y ago
> this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. Except the GDPR and cookie directive, obviously, undeniably, unmistakably, weren't intended to give websites a "bad UX" obstacle to work around. It's not even about cookies. It's about letting users AGREE to being tracked and then track them, OR (with the same amount of effort and without denying them service vs tracked people) DISAGREE and then not track them. If they're still tracking me and keeping data about me that they can match to the PI that is my github account, then this "no cookie" thing is just more "letter of the law" bullshit. I think it's pretty damn clear to Github and MS what the intention of these EU laws are. They can't just say "oh it's worded in a way that gives us wiggle room, so fuck your intentions". Well they can but they'll find out whose faces they told "fuck your intentions" to. We're trying to protect consumers from tracking bullshit, here. Not throwing up obstacles for large corporations to work around.
WhyNotHugo 6y ago
Don't confuse "we don't set cookies" with "we don't set non-essential cookies". They say no "non-essential" cookies, but an anonymous user just landing on the homepage gets a cookie with some unique-looking tokens. I've seen many companies just hire the right lawyers that would sign off on all sorts of tracking cookies as "yeah, this is essential, since we can't track users without it, and tracking users is essential to our business model".

dessant 6y ago

Yes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.

867-5309 6y ago
consent is simple to gain, who reads the entire ToS and privacy policy? the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
- dessant 6y ago
  > consent is simple to gain, who reads the entire ToS and privacy policy? That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service. > the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself The request can be blocked with uBlock Origin, but it's still important to draw attention to tracking that may be illegal, since not everyone has a content blocker installed.
  - 867-5309 6y ago
    if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise
    - dessant 6y ago
      Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#Five_Elements_Of_Consent_Under_The_Gdpr https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
      - eitland 6y ago
        To add to this: from my understanding of the rules even a lot of the informed consent popups today aren't compliant. If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out. IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.
        merijnv 6y ago
        Correct. Also, you cannot with hold access upon users not consenting, so there's literally zero incentive for users to ever consent for compliant providers. Which is kinda obvious with the GDPR's overall goal of making it impossible to use privacy as currency.
        deleted 6y ago
        [deleted]
      - 867-5309 6y ago
        it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help you understand the difference between should and must: https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt
- tripzilch 6y ago
  > consent is simple to gain, who reads the entire ToS and privacy policy? nobody because they are pretty much meaningless in the EU we got laws to protect consumers, not laws for businesses to trick users into making some meaningless gesture > the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself what do you mean by "local lawmakers"? these laws are EU-wide. or did you mean "local" to mean, "non-US" anyway, these lawmakers are fighting the shitty corporations that pull this tracking stuff and your bottom line is not really a choice one way or the other. I can use blockers and other plugins to protect myself, AND cheer on the people fighting the fuckfaces that think it's in any way honourable to make a profit by merely following the letter of our laws but we got some really good consumer protections in the EU. and we try to keep it that way. we're not going to simply roll over because some US corporations are used to being able to track the hell out of US customers

dspillett 6y ago

> no cookies doesn't mean no tracking It does though make tracking by third parties so they can sell things to me (or sell information about me to other parties for that use) more difficult. Not impossible though, of course.

tripzilch 6y ago

> this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. Except the GDPR and cookie directive, obviously, undeniably, unmistakably, weren't intended to give websites a "bad UX" obstacle to work around. It's not even about cookies. It's about letting users AGREE to being tracked and then track them, OR (with the same amount of effort and without denying them service vs tracked people) DISAGREE and then not track them. If they're still tracking me and keeping data about me that they can match to the PI that is my github account, then this "no cookie" thing is just more "letter of the law" bullshit. I think it's pretty damn clear to Github and MS what the intention of these EU laws are. They can't just say "oh it's worded in a way that gives us wiggle room, so fuck your intentions". Well they can but they'll find out whose faces they told "fuck your intentions" to. We're trying to protect consumers from tracking bullshit, here. Not throwing up obstacles for large corporations to work around.

WhyNotHugo 6y ago

Don't confuse "we don't set cookies" with "we don't set non-essential cookies". They say no "non-essential" cookies, but an anonymous user just landing on the homepage gets a cookie with some unique-looking tokens. I've seen many companies just hire the right lawyers that would sign off on all sorts of tracking cookies as "yeah, this is essential, since we can't track users without it, and tracking users is essential to our business model".