4 ms·

See my reply to b34r. In addition assigning users into “anonymous” cohorts is a similar principle to FLoC which is likely not GDPR compliant https://searchengin

See my reply to b34r. In addition assigning users into “anonymous” cohorts is a similar principle to FLoC which is likely not GDPR compliant https://searchengineland.com/googles-current-floc-tests-arent-gdpr-compliant-347168 https://searchengineland.com/googles-current-floc-tests-aren...

dahfizz 4y ago
> Processing personal data to generate the cohort assignment without the proper consent could also be a violation Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though?
- eganist 4y ago
  > Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though? Quoting the European commission: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data." I'd hazard a guess that it's the second part under which the EC might find this to be within scope.
  - dahfizz 4y ago
    If I gave you a list of all the last-modified headers from a day, how would you use that information to identify a person?
- ATsch 4y ago
  The definition of personal data under the GDPR is anything that can be used to uniquely identify a natural person (with sufficiently high probability). Both cookies and date-modified meet that definition identically, as do IP addresses. That doesn't mean you can't use it at all. It just places strong restrictions on what purpodes you can use it for. The important point is just that those restrictions are the same under GDPR for all of these technologies. It doesn't matter how you uniquely identify users, what matters is what you do with that information.
  - dahfizz 4y ago
    They don't assign a unique date-modified to each user. They assign everyone the same date modified on their first visit of the day. I don't accept that this could be used to uniquely identify a natural person. You may be able to look at the headers and see that a certain user made the most requests that day. That still tells you nothing about their identity.
  - mytailorisrich 4y ago
    Nothing in the technique described here allows to identify an individual directly or indirectly because 'identifiers' are not unique and really no different than standard 'last-modified' dates. Even if they were unique further data would have to be collected in order to be able to identify individuals and turn everything into personal data. What the technique may fall foul of, though, are cookie laws.
tobr 4y ago
That seems very different, as those cohorts are based on actual personal data (correct me if I’ve misunderstood this about FLoC). That’s fundamentally different from a counter I think.
- jahewson 4y ago
  Yes that’s right, FLoC is explicitly using personal data. But now consider that that data is “you visited a gardening website in the past month” and compare it with “you visited this website 3 times yesterday” and the two methods don’t look so different.
  - tobr 4y ago
    I guess we all have different instincts when it comes to this, but I find it much more expected and acceptable that a website can see that I’m returning, than that they get to know about random other interests I have based on my general browsing history.
Spivak 4y ago
You can't just scare quotes anonymous without explaining how it could deanonymize you. You're sitting there with full access to the count data they collect. Use any statistical methods you like, figure out what visits were me.
mytailorisrich 4y ago
The article you quote does not suggest that "assigning users into “anonymous” cohorts is ... is likely not GDPR compliant" and I fail to see how that would be the case. Rather it seems to mention concerns that processing personal data to do so may be problematic.

dahfizz 4y ago

> Processing personal data to generate the cohort assignment without the proper consent could also be a violation Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though?

eganist 4y ago
> Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though? Quoting the European commission: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data." I'd hazard a guess that it's the second part under which the EC might find this to be within scope.
- dahfizz 4y ago
  If I gave you a list of all the last-modified headers from a day, how would you use that information to identify a person?
ATsch 4y ago
The definition of personal data under the GDPR is anything that can be used to uniquely identify a natural person (with sufficiently high probability). Both cookies and date-modified meet that definition identically, as do IP addresses. That doesn't mean you can't use it at all. It just places strong restrictions on what purpodes you can use it for. The important point is just that those restrictions are the same under GDPR for all of these technologies. It doesn't matter how you uniquely identify users, what matters is what you do with that information.
- dahfizz 4y ago
  They don't assign a unique date-modified to each user. They assign everyone the same date modified on their first visit of the day. I don't accept that this could be used to uniquely identify a natural person. You may be able to look at the headers and see that a certain user made the most requests that day. That still tells you nothing about their identity.
- mytailorisrich 4y ago
  Nothing in the technique described here allows to identify an individual directly or indirectly because 'identifiers' are not unique and really no different than standard 'last-modified' dates. Even if they were unique further data would have to be collected in order to be able to identify individuals and turn everything into personal data. What the technique may fall foul of, though, are cookie laws.

tobr 4y ago

That seems very different, as those cohorts are based on actual personal data (correct me if I’ve misunderstood this about FLoC). That’s fundamentally different from a counter I think.

jahewson 4y ago
Yes that’s right, FLoC is explicitly using personal data. But now consider that that data is “you visited a gardening website in the past month” and compare it with “you visited this website 3 times yesterday” and the two methods don’t look so different.
- tobr 4y ago
  I guess we all have different instincts when it comes to this, but I find it much more expected and acceptable that a website can see that I’m returning, than that they get to know about random other interests I have based on my general browsing history.

Spivak 4y ago

You can't just scare quotes anonymous without explaining how it could deanonymize you. You're sitting there with full access to the count data they collect. Use any statistical methods you like, figure out what visits were me.

mytailorisrich 4y ago

The article you quote does not suggest that "assigning users into “anonymous” cohorts is ... is likely not GDPR compliant" and I fail to see how that would be the case. Rather it seems to mention concerns that processing personal data to do so may be problematic.