3 ms·

"Tracking" that is necessary to ensure the service is functioning does not require consent. That is for example why logging IPs for things like rate-limiting or

"Tracking" that is necessary to ensure the service is functioning does not require consent. That is for example why logging IPs for things like rate-limiting or DDoS protection does not require consent, but that data cannot be used for anything else. If you do not track users but just track usage that should not require consent. So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. You can also track usage of certain site functions without tying that data to a specific user or session. So the actually necessary tracking does not require consent, but since companies got used to tracking everything and tying it to users/sessions before these laws it seems like they try to continue on that path instead of adapting.

denton-scratch 4y ago
> So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. Yeah, nice for you! But you're requiring my collaboration in your investigations; sorry, but I can't tell which cookies (or web-storage blocks) are for checking whether my behaviour is "irregular", and which are intrusive data-collectors. I'm not going to scrutinise every cookie a site serves; life's too short. I configure my browser to accept first-party session-cookies only. My web-storage pool is zero bytes. If your site doesn't work with those settings, your site is broken (and I'll find a better one).
- SahAssar 4y ago
  I think you misunderstand my point. The "tracking" I mentioned is only "actions per {time unit}", for all users. Basically aggregating how many times the "/api/checkout" endpoint is hit. It requires no cookies, it requires no checking of any individuals behavior. The only point of it is if action $FOO decreases dramatically then $FOO might be broken. At no point does that require cookies or personal data or personal tracking. My point was that you don't need cookies or personally identifiable info to be able to make sure a website runs well.
  - denton-scratch 4y ago
    I think I did misunderstand your point, by about 180deg. Sorry. Thank you for clarifying.

denton-scratch 4y ago

> So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. Yeah, nice for you! But you're requiring my collaboration in your investigations; sorry, but I can't tell which cookies (or web-storage blocks) are for checking whether my behaviour is "irregular", and which are intrusive data-collectors. I'm not going to scrutinise every cookie a site serves; life's too short. I configure my browser to accept first-party session-cookies only. My web-storage pool is zero bytes. If your site doesn't work with those settings, your site is broken (and I'll find a better one).

SahAssar 4y ago
I think you misunderstand my point. The "tracking" I mentioned is only "actions per {time unit}", for all users. Basically aggregating how many times the "/api/checkout" endpoint is hit. It requires no cookies, it requires no checking of any individuals behavior. The only point of it is if action $FOO decreases dramatically then $FOO might be broken. At no point does that require cookies or personal data or personal tracking. My point was that you don't need cookies or personally identifiable info to be able to make sure a website runs well.
- denton-scratch 4y ago
  I think I did misunderstand your point, by about 180deg. Sorry. Thank you for clarifying.