3 ms·

I hate cookie banners.

madeofpalk 4y ago
fwiw 'cookie banners' aren't about the technology cookies, but rather about gaining consent for tracking and storing data on users. Even if you do this without cookies, if you still track users (like for attribution) for non-essential purposes, then you could still need consent from a "cookie banner". a hash of an ip address could still be 'personal data' under the eyes of gdpr.
- shanebellone 4y ago
  I appreciate and understand that. I responded with this point to another comment. GDPR does aggressively define what can and cannot be done. As far as I know, I'm adhering to their definitions and guidelines. I will consult with a lawyer to confirm before I make claims about GDPR or other laws. My goal is to make the best product possible given the constraints set. I believe there is middle ground between user privacy and analytics.
- korlja 4y ago
  > a hash of an ip address could still be 'personal data' under the eyes of gdpr. We did something similar for a project, which got approved by the relevant data protection officer: hash(IP + daily secret) as an identifier in the logs. This will be used to count unique visitors, the wraparound at 24:00:00 didn't matter to us. The daily secret is just a random number that our one (small setup) application server generates each day. It is never written out to disk or database, so an appserver restart also recreates that secret, it is strictly kept in RAM. That way, we could argue that, barring extreme measures like attaching a debugger to get the secret, we technically prevented deanonymisation. But that was just a small-scale project, has never been tested in court and the usual YMMV, IANAL, ... Edit: I think some webservers can be configured to do something similar
TekMol 4y ago
There is a popular misconception "If you use cookies, you have to show a cookie banner". The origin is a complete misunderstanding of privacy laws (GDPR etc) around the world. Privacy laws are not about technology. They are about privacy. Seeing your answer, I have the feeling that this misconception is the basis for your project.
- shanebellone 4y ago
  Are you specifically referring to the difference between 1st party and 3rd party cookies?
  - gildas 4y ago
    He means that cookies are an implementation detail, the fact of using alternative techniques doesn't absolutely change anything regarding the law. And it is perfectly legal to store cookies (e.g. a session token) without asking the user's permission if it is within the law, i.e. if you don't use it for tracking users without their consent.
    - shanebellone 4y ago
      Thank you for the clarification.

fwiw 'cookie banners' aren't about the technology cookies, but rather about gaining consent for tracking and storing data on users. Even if you do this without cookies, if you still track users (like for attribution) for non-essential purposes, then you could still need consent from a "cookie banner". a hash of an ip address could still be 'personal data' under the eyes of gdpr.

shanebellone 4y ago
I appreciate and understand that. I responded with this point to another comment. GDPR does aggressively define what can and cannot be done. As far as I know, I'm adhering to their definitions and guidelines. I will consult with a lawyer to confirm before I make claims about GDPR or other laws. My goal is to make the best product possible given the constraints set. I believe there is middle ground between user privacy and analytics.
korlja 4y ago
> a hash of an ip address could still be 'personal data' under the eyes of gdpr. We did something similar for a project, which got approved by the relevant data protection officer: hash(IP + daily secret) as an identifier in the logs. This will be used to count unique visitors, the wraparound at 24:00:00 didn't matter to us. The daily secret is just a random number that our one (small setup) application server generates each day. It is never written out to disk or database, so an appserver restart also recreates that secret, it is strictly kept in RAM. That way, we could argue that, barring extreme measures like attaching a debugger to get the secret, we technically prevented deanonymisation. But that was just a small-scale project, has never been tested in court and the usual YMMV, IANAL, ... Edit: I think some webservers can be configured to do something similar

TekMol 4y ago

There is a popular misconception "If you use cookies, you have to show a cookie banner". The origin is a complete misunderstanding of privacy laws (GDPR etc) around the world. Privacy laws are not about technology. They are about privacy. Seeing your answer, I have the feeling that this misconception is the basis for your project.

shanebellone 4y ago
Are you specifically referring to the difference between 1st party and 3rd party cookies?
- gildas 4y ago
  He means that cookies are an implementation detail, the fact of using alternative techniques doesn't absolutely change anything regarding the law. And it is perfectly legal to store cookies (e.g. a session token) without asking the user's permission if it is within the law, i.e. if you don't use it for tracking users without their consent.
  - shanebellone 4y ago
    Thank you for the clarification.