3 ms·

> This is great for privacy as we don't need to use cookies, IP addresses, fingerprinting or unique identifiers. In our tests, this method proved durable enough

> This is great for privacy as we don't need to use cookies, IP addresses, fingerprinting or unique identifiers. In our tests, this method proved durable enough to be the most reliable method of counting unique visitors without using cookies. The differences with a cookie are that the header is named Last-modified instead of Set-Cookie and Cookie, and the value must be a datetime in the RFC2616 format. How is it good for privacy? I think it’s worse because it’s invisible for the user. I would bet tracking visitors using such an hack isn’t compatible with GDPR, that requires an informed consent for tracking. And good luck explaining your hack to the average visitor.

Etheryte 4y ago
You seem to slightly misunderstand how GDPR works. Tracking in and of itself is not the problem, it's personal data and personally identifying data that is. You can count how many hits your server receives no problem, this is roughly the same idea.
- luckylion 4y ago
  This is equivalent to setting a cookie with a hit count. It's still storing & submitting information, it's just not using a unique identifier (Which is pretty privacy-respecting, I'm not saying it's a terrible thing or something). I assume it will be treated as such, too. If you can use a cookie to do this without consent, this is fine too. If you can't then it's not. The same happens for local/session storage: it's cookie-equivalent.
  - xyproto 4y ago
    The user with the highest visit count will always be uniquely identifiable, though.
    - not2b 4y ago
      Only on the same day. Everything is reset the next day.
    - jiveturkey 4y ago
      I don't follow how this is a problem. By that measure, any users behind a unique single IP (no IP pooling, no CGNAT, etc) will always be uniquely identifiable. And for IP there's much fewer steps to personally identify the user. The server necessarily sees the user IP.
      - speedgoose 4y ago
        Yes, the IP can be used to identify people. If you want to track users using their IP and respect GDPR, you need to get their consent first. The best is to not store them before you get consent. Having a temporary access log with a few IPs is probably fine. But keeping all your access logs forever for analytics purposes is not fine anymore.
- speedgoose 4y ago
  I will quote the law: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
- havkom 4y ago
  Basically the “cookie consent” part in the EU stems from the e-privacy directive. Article 5.3 refers to GDPR (through the directive that is replaced by GDPR) and reads: Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. In short, this method may fall under the EU “cookie law” above. The use of timestamps may require consent if they are used to distinguish users (even if only for counting purposes). The timestamps may then also be personal data under the GDPR.

Etheryte 4y ago

You seem to slightly misunderstand how GDPR works. Tracking in and of itself is not the problem, it's personal data and personally identifying data that is. You can count how many hits your server receives no problem, this is roughly the same idea.

luckylion 4y ago
This is equivalent to setting a cookie with a hit count. It's still storing & submitting information, it's just not using a unique identifier (Which is pretty privacy-respecting, I'm not saying it's a terrible thing or something). I assume it will be treated as such, too. If you can use a cookie to do this without consent, this is fine too. If you can't then it's not. The same happens for local/session storage: it's cookie-equivalent.
- xyproto 4y ago
  The user with the highest visit count will always be uniquely identifiable, though.
  - not2b 4y ago
    Only on the same day. Everything is reset the next day.
  - jiveturkey 4y ago
    I don't follow how this is a problem. By that measure, any users behind a unique single IP (no IP pooling, no CGNAT, etc) will always be uniquely identifiable. And for IP there's much fewer steps to personally identify the user. The server necessarily sees the user IP.
    - speedgoose 4y ago
      Yes, the IP can be used to identify people. If you want to track users using their IP and respect GDPR, you need to get their consent first. The best is to not store them before you get consent. Having a temporary access log with a few IPs is probably fine. But keeping all your access logs forever for analytics purposes is not fine anymore.
speedgoose 4y ago
I will quote the law: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
havkom 4y ago
Basically the “cookie consent” part in the EU stems from the e-privacy directive. Article 5.3 refers to GDPR (through the directive that is replaced by GDPR) and reads: Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. In short, this method may fall under the EU “cookie law” above. The use of timestamps may require consent if they are used to distinguish users (even if only for counting purposes). The timestamps may then also be personal data under the GDPR.