5 ms·

Unfortunately in Germany that’s not true. Putting anything in someone’s computer without their approval is now considered illegal. Therefore even if you’re just

Unfortunately in Germany that’s not true. Putting anything in someone’s computer without their approval is now considered illegal. Therefore even if you’re just using Matomo stats or anything that isn’t tracking and just functional you need to ask for permission. That is idiotic and doesn’t solve the issue at hand at all

karol 5y ago
That sounds nonsensical, when people visit your website they run your code using their CPUs and electricity. You also get their attention and may even influence their heart rates and breathing patterns.
rad_gruchalski 5y ago
> Putting anything in someone’s computer without their approval is now considered illegal. Citation needed.
- enumjorge 5y ago
  Agreed that doesn’t make a lot of sense. You need to “put” html, css, images in the visitor’s computer just as much as you do a session cookie. How is one allowed and not the other?
  - number6 5y ago
    It doesn't make a lot of sense. Now we have to interpret what was intended with the law. What about In Browser databases? Or Javascript? It's much more than just cookies that are stored on computers.
- number6 5y ago
  Art 25 TTDSG "The storage of information in the end-user's terminal equipment or the access to information already stored in the terminal equipment shall only be allowed if the end-user has consented on the basis of clear and comprehensive information. The information to the end-user and the consent shall be provided in accordance with Regulation (EU) 2016/679."
  - welterde 5y ago
    There is a second paragraph to this article that contains exceptions to this. If it is absolutely necessary for the requested functionality then it is allowed. Therefore it doesn't really change anything.
    - number6 5y ago
      I bet this will be settled in court
      - welterde 5y ago
        Why do you think this would result in a different outcome in Germany? The language of the new law in Germany is virtually identical to the language of the EU directive. So why would it be different in Germany versus other countries in the EU that also have to implement the directive?
        number6 5y ago
        Following the German debate the courts and watchdogs interpretation of the law is that strictly necessary means that the functionality is not possible without cookies or other technology and the consent has to be of the same quality as per GDPR. Privacy law in Germany is usually stricter than in other EU country's even if the text is identical.
        welterde 5y ago
        Which is exactly what the EU directive intends. You are literally just stating the acceptable exceptions from the EU directive. And the main argument of this thread initially was that you don't need to ask if you are only using cookies for such use cases.
        number6 5y ago
        I assume from your handle that you understand German (?): This Podcast explains the topic much better than I could: Rechtsbelehrung - Recht, Technik & Gesellschaft: TTDSG – Cookies unter Aufsicht – Rechtsbelehrung 102 https://rechtsbelehrung.com/102-ttdsg-cookies/ https://rechtsbelehrung.com/102-ttdsg-cookies/
cmeacham98 5y ago
Don't get me wrong, I love self-hosted analytics like Matomo, but there is never a situation where a cookie for any form of analytics is "functional".
- XCSme 5y ago
  What about affiliate systems? Knowing who referred you to the site when you purchase so they can get their cut.
  - cmeacham98 5y ago
    Arguable either way in my opinion, but irrelevent because not analytics
Nursie 5y ago
"Therefore even if you’re just using Matomo stats" That's not functional though, is it? I understand entirely the desire to use such a thing, to understand how your site is being used, but it's not functional in a "delivering service to the end user" way. (Personally I like the way it sounds, analytics without signing over the world to Google, but it's still not functional)
franciscop 5y ago
Matomo calls its cookies "tracking cookies": > It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate So it seems there's no "functional cookies" in Matomo, and so all cookies from Matomo without consent popup is not in compliance. You can disable all Matomo cookies and allow for compliance: > By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen.
ReleaseCandidat 5y ago
> Unfortunately in Germany that’s not true. It is. There is no other law about cookies. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. English version of the response from the EU court: https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN https://curia.europa.eu/juris/document/document.jsf?docid=21... Part of this case at the german 'Bundesgerichtshof'. https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2020/2020067.html?nn=10690868 https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilung...
- number6 5y ago
  There is now Art 25 TTDSG Deals with it. The law Was passes this month
  - latk 5y ago
    TTDSG is finally a correct implementation of the 2005 ePrivacy directive. § 25 TTDSG literally just rephrases the exact ePrivacy requirements. The pendant to the above quote is § 25 Abs 2 Nr 1: > Die Einwilligung nach Absatz 1 ist nicht erforderlich, wenn der alleinige Zweck [der Speicherung oder des Zugriffs] die Durchführung der Übertragung einer Nachricht über ein öffentliches Telekommunikationsnetz ist oder wenn [sie] unbedingt erforderlich ist, damit der Anbieter eines Telemediendienstes einen vom Nutzer ausdrücklich gewünschten Telemediendienst zur Verfügung stellen kann.
    - number6 5y ago
      This shifts the consent down to the the feature: >vom Nutzer ausdrücklich >gewünschten Telemediendienst >zur Verfügung stellen kann. Now we have to document that the user wanted the feature that needs the cookie...
SamBam 5y ago
When you load a webpage you're putting images, text, and other files "in someone's computer." I don't think it's as simple as that.
croes 5y ago
False, since the BGH ruling in the "Planet49" case (judgment dated May 28, 2020 - I ZR 7/16), the following applies: Cookies and comparable technologies may only be used with consent in Germany as well, regardless of the processing of personal data. This is only different if the cookies are "absolutely necessary" for the technical provision of the respective service or they serve solely to transmit a message via a public telecommunications network. So technically necessary cookies still don't need consent.
cardanome 5y ago
That is a common misconception in the industry here in Germany but that doesn't make it true. I was often told to add a Cookie Consent banner even for sites that don't use any Cookies at all. Fact is, you don't need a Cookie Consent banner for functional cookies. The issue with Matomo is that even though nicer than Google Analytics it is optional for the working of the website, so it should only activate if the user consents. There is some serious cargo culting regarding these kind of laws going on. I remember back in the day that you would add "I don't take responsibility for the external links" kind of disclaimers on every website. Or everyone thinking they need a Impressum (legal info/contact info) page on their website because it is required by law. (No only for commercial sites, which is reasonable.)
- summm 5y ago
  I largely agree. An Impressum/Imprint is however not only needed for explicitly commercial sites, but also for sites that are not purely personal. E.g. just earning some cents with an ad banner on your personal site means you need an imprint. There have been lots of lawsuits, it's really ugly, and I totally can understand that people want to be on the safe side.
  - number6 5y ago
    Even if you don't earn a cent but the website is not only intended for close friends and family...
  - cardanome 5y ago
    Yeah it still good style to always provide Imprint. I just listed it as an example where people don't understand the nuance around an issue. "You better provide some Imprint if you are in doubt" becomes "You are required by law to always have an Imprint"
ekianjo 5y ago
> Putting anything in someone’s computer without their approval is now considered illegal Selling Windows by default with every computer is now illegal in Germany then?
- bmn__ 5y ago
  I wish it was, but no, selling a computer system with Windows installed is consensual, either by explicit customer request or by the customer agreeing to a sale offer as advertised. No one gets tricked into approval (here: buying) because every customer is able to request a different or no OS, or to reject an immutable sale offer; except if you think that not knowing what an operating system is and what it implies constitutes a trick, but that does not meet the legal definition.

karol 5y ago

That sounds nonsensical, when people visit your website they run your code using their CPUs and electricity. You also get their attention and may even influence their heart rates and breathing patterns.

rad_gruchalski 5y ago

> Putting anything in someone’s computer without their approval is now considered illegal. Citation needed.

enumjorge 5y ago
Agreed that doesn’t make a lot of sense. You need to “put” html, css, images in the visitor’s computer just as much as you do a session cookie. How is one allowed and not the other?
- number6 5y ago
  It doesn't make a lot of sense. Now we have to interpret what was intended with the law. What about In Browser databases? Or Javascript? It's much more than just cookies that are stored on computers.
number6 5y ago
Art 25 TTDSG "The storage of information in the end-user's terminal equipment or the access to information already stored in the terminal equipment shall only be allowed if the end-user has consented on the basis of clear and comprehensive information. The information to the end-user and the consent shall be provided in accordance with Regulation (EU) 2016/679."
- welterde 5y ago
  There is a second paragraph to this article that contains exceptions to this. If it is absolutely necessary for the requested functionality then it is allowed. Therefore it doesn't really change anything.
  - number6 5y ago
    I bet this will be settled in court
    - welterde 5y ago
      Why do you think this would result in a different outcome in Germany? The language of the new law in Germany is virtually identical to the language of the EU directive. So why would it be different in Germany versus other countries in the EU that also have to implement the directive?
      - number6 5y ago
        Following the German debate the courts and watchdogs interpretation of the law is that strictly necessary means that the functionality is not possible without cookies or other technology and the consent has to be of the same quality as per GDPR. Privacy law in Germany is usually stricter than in other EU country's even if the text is identical.
        welterde 5y ago
        Which is exactly what the EU directive intends. You are literally just stating the acceptable exceptions from the EU directive. And the main argument of this thread initially was that you don't need to ask if you are only using cookies for such use cases.
        number6 5y ago
        I assume from your handle that you understand German (?): This Podcast explains the topic much better than I could: Rechtsbelehrung - Recht, Technik & Gesellschaft: TTDSG – Cookies unter Aufsicht – Rechtsbelehrung 102 https://rechtsbelehrung.com/102-ttdsg-cookies/ https://rechtsbelehrung.com/102-ttdsg-cookies/

cmeacham98 5y ago

Don't get me wrong, I love self-hosted analytics like Matomo, but there is never a situation where a cookie for any form of analytics is "functional".

XCSme 5y ago
What about affiliate systems? Knowing who referred you to the site when you purchase so they can get their cut.
- cmeacham98 5y ago
  Arguable either way in my opinion, but irrelevent because not analytics

Nursie 5y ago

"Therefore even if you’re just using Matomo stats" That's not functional though, is it? I understand entirely the desire to use such a thing, to understand how your site is being used, but it's not functional in a "delivering service to the end user" way. (Personally I like the way it sounds, analytics without signing over the world to Google, but it's still not functional)

franciscop 5y ago

Matomo calls its cookies "tracking cookies": > It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate So it seems there's no "functional cookies" in Matomo, and so all cookies from Matomo without consent popup is not in compliance. You can disable all Matomo cookies and allow for compliance: > By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen.

ReleaseCandidat 5y ago

> Unfortunately in Germany that’s not true. It is. There is no other law about cookies. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. English version of the response from the EU court: https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN https://curia.europa.eu/juris/document/document.jsf?docid=21... Part of this case at the german 'Bundesgerichtshof'. https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2020/2020067.html?nn=10690868 https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilung...

number6 5y ago
There is now Art 25 TTDSG Deals with it. The law Was passes this month
- latk 5y ago
  TTDSG is finally a correct implementation of the 2005 ePrivacy directive. § 25 TTDSG literally just rephrases the exact ePrivacy requirements. The pendant to the above quote is § 25 Abs 2 Nr 1: > Die Einwilligung nach Absatz 1 ist nicht erforderlich, wenn der alleinige Zweck [der Speicherung oder des Zugriffs] die Durchführung der Übertragung einer Nachricht über ein öffentliches Telekommunikationsnetz ist oder wenn [sie] unbedingt erforderlich ist, damit der Anbieter eines Telemediendienstes einen vom Nutzer ausdrücklich gewünschten Telemediendienst zur Verfügung stellen kann.
  - number6 5y ago
    This shifts the consent down to the the feature: >vom Nutzer ausdrücklich >gewünschten Telemediendienst >zur Verfügung stellen kann. Now we have to document that the user wanted the feature that needs the cookie...

SamBam 5y ago

When you load a webpage you're putting images, text, and other files "in someone's computer." I don't think it's as simple as that.

croes 5y ago

False, since the BGH ruling in the "Planet49" case (judgment dated May 28, 2020 - I ZR 7/16), the following applies: Cookies and comparable technologies may only be used with consent in Germany as well, regardless of the processing of personal data. This is only different if the cookies are "absolutely necessary" for the technical provision of the respective service or they serve solely to transmit a message via a public telecommunications network. So technically necessary cookies still don't need consent.

cardanome 5y ago

That is a common misconception in the industry here in Germany but that doesn't make it true. I was often told to add a Cookie Consent banner even for sites that don't use any Cookies at all. Fact is, you don't need a Cookie Consent banner for functional cookies. The issue with Matomo is that even though nicer than Google Analytics it is optional for the working of the website, so it should only activate if the user consents. There is some serious cargo culting regarding these kind of laws going on. I remember back in the day that you would add "I don't take responsibility for the external links" kind of disclaimers on every website. Or everyone thinking they need a Impressum (legal info/contact info) page on their website because it is required by law. (No only for commercial sites, which is reasonable.)

summm 5y ago
I largely agree. An Impressum/Imprint is however not only needed for explicitly commercial sites, but also for sites that are not purely personal. E.g. just earning some cents with an ad banner on your personal site means you need an imprint. There have been lots of lawsuits, it's really ugly, and I totally can understand that people want to be on the safe side.
- number6 5y ago
  Even if you don't earn a cent but the website is not only intended for close friends and family...
- cardanome 5y ago
  Yeah it still good style to always provide Imprint. I just listed it as an example where people don't understand the nuance around an issue. "You better provide some Imprint if you are in doubt" becomes "You are required by law to always have an Imprint"

ekianjo 5y ago

> Putting anything in someone’s computer without their approval is now considered illegal Selling Windows by default with every computer is now illegal in Germany then?

bmn__ 5y ago
I wish it was, but no, selling a computer system with Windows installed is consensual, either by explicit customer request or by the customer agreeing to a sale offer as advertised. No one gets tricked into approval (here: buying) because every customer is able to request a different or no OS, or to reject an immutable sale offer; except if you think that not knowing what an operating system is and what it implies constitutes a trick, but that does not meet the legal definition.