4 ms·

I think this is probably illegal in EU countries. The ePrivacy Directive requires consent before storing data on a user's machine that isn't strictly necessary

by jefftk 4y ago

I think this is probably illegal in EU countries. The ePrivacy Directive requires consent before storing data on a user's machine that isn't strictly necessary for providing the service the user requested. Analytics isn't "strictly necessary", and ePrivacy doesn't care whether you use the Cookie header or some other method of storage. I do think this is better for privacy than standard id-based approaches, but the law is very strict. More: https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners (Not a lawyer)

Quarrelsome 4y ago
I thought GDPR cared mostly about uniquely identifying visitors which this does not do. You still need a cookie banner to state that you will put some data on their machine but you always need one of those.
- jefftk 4y ago
  > you always need one of those The withcabin.com landing page claims you don't need consent banners to use it.
  - t0mas88 4y ago
    That claim is false in Europe. You need to ask permission for this approach, because you're storing something on the user's device (the generated date in the cache) that isn't strictly necessarily. The ePrivacy directive says you need permission for that, nowhere does the law specify "cookies" it's about any kind of data stored on the user device.
    - jefftk 4y ago
      Uh, yes? That's exactly what I've been saying upthread.
    - mgrund 4y ago
      True it does not matter if it’s a cookie, or whatever. You need to look to the ePrivacy directive article 5.3 for which exemption case applies. In the case of timestamps, it would be case A : > when the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network” (“Exemption A“) Since the timestamp is no longer used solely for this purpose, you need consent.
yellow_lead 4y ago
Assuming you're correct, can anyone think of a way to count unique visitors without storing data on a users machine or using identifiable user information? Identifiable user information should include hashes that can be re-computed given the original information. This isn't a criticism of the law, I'm just curious what options there could be, because I can't think of any.
- genewitch 4y ago
  Hi there, Marketing Company Intern! Tell them you'd rather make the coffee ;-)
  - 411111111111111 4y ago
    Ha, that would explain that question. My first reaction was mostly confusion as there is so much prior art at this point, i.e. fingerprinting through installed add-ons, resolution/window size/system language, browser language, IP locality etc. There are even demo pages around which shows you just how unique your configuration is even without anything else. https://amiunique.org/fp https://amiunique.org/fp
  - yellow_lead 4y ago
    Lol, I knew it would sound that way, but I don't work in this domain - just interested in privacy and this problem.
    - genewitch 4y ago
      the only reason we could think of for wanting unique visitors was for the marketing people or investors/stakeholders/shareholders. Parsing the request logs should be sufficient for every other metric. We had a bunch of meetings about this at what essentially amounted to a giant information superhighway billboard company. IIRC someone brought up using cache headers even back then, because it didn't require cookies or javascript, which we couldn't guarantee would be "up to date", this is back in "target IE6, still" days. As one of my networking friends said, advertisers usually know everything about your metrics, even if you don't. You can't really fudge the numbers in your favor, so raw requests or QPS or whatever ancillary metric would be enough. the method in the article is defeated by clearing your session when you're done browsing, or using incognito/private browsing tab, as that should mark all "cached" items for deletion.
Hnrobert42 4y ago
Here is the ePrvacy Directive. I can’t find anything in it to back up your assertion, though. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32...
- jefftk 4y ago
  The directive is a bit hard to read, but its widely understood to require at least notification before storing information on a user's device, probably consent. The guidance is a lot clearer: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
  - hyperman1 4y ago
    I'm not sure the guidance applies in this case, as this technique is an edge case which the writers probably didn't foresee. The ePrivacy directive itself has in article 3.1: This Directive shall apply to the processing of personal data [...] which would mean it doesnt apply here, as there is no personal data. In practice, I assume this one is for the judges.
deleted 4y ago
[deleted]

by jefftk 4y ago

Quarrelsome 4y ago

I thought GDPR cared mostly about uniquely identifying visitors which this does not do. You still need a cookie banner to state that you will put some data on their machine but you always need one of those.

jefftk 4y ago
> you always need one of those The withcabin.com landing page claims you don't need consent banners to use it.
- t0mas88 4y ago
  That claim is false in Europe. You need to ask permission for this approach, because you're storing something on the user's device (the generated date in the cache) that isn't strictly necessarily. The ePrivacy directive says you need permission for that, nowhere does the law specify "cookies" it's about any kind of data stored on the user device.
  - jefftk 4y ago
    Uh, yes? That's exactly what I've been saying upthread.
  - mgrund 4y ago
    True it does not matter if it’s a cookie, or whatever. You need to look to the ePrivacy directive article 5.3 for which exemption case applies. In the case of timestamps, it would be case A : > when the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network” (“Exemption A“) Since the timestamp is no longer used solely for this purpose, you need consent.

yellow_lead 4y ago

Assuming you're correct, can anyone think of a way to count unique visitors without storing data on a users machine or using identifiable user information? Identifiable user information should include hashes that can be re-computed given the original information. This isn't a criticism of the law, I'm just curious what options there could be, because I can't think of any.

genewitch 4y ago
Hi there, Marketing Company Intern! Tell them you'd rather make the coffee ;-)
- 411111111111111 4y ago
  Ha, that would explain that question. My first reaction was mostly confusion as there is so much prior art at this point, i.e. fingerprinting through installed add-ons, resolution/window size/system language, browser language, IP locality etc. There are even demo pages around which shows you just how unique your configuration is even without anything else. https://amiunique.org/fp https://amiunique.org/fp
- yellow_lead 4y ago
  Lol, I knew it would sound that way, but I don't work in this domain - just interested in privacy and this problem.
  - genewitch 4y ago
    the only reason we could think of for wanting unique visitors was for the marketing people or investors/stakeholders/shareholders. Parsing the request logs should be sufficient for every other metric. We had a bunch of meetings about this at what essentially amounted to a giant information superhighway billboard company. IIRC someone brought up using cache headers even back then, because it didn't require cookies or javascript, which we couldn't guarantee would be "up to date", this is back in "target IE6, still" days. As one of my networking friends said, advertisers usually know everything about your metrics, even if you don't. You can't really fudge the numbers in your favor, so raw requests or QPS or whatever ancillary metric would be enough. the method in the article is defeated by clearing your session when you're done browsing, or using incognito/private browsing tab, as that should mark all "cached" items for deletion.

Hnrobert42 4y ago

Here is the ePrvacy Directive. I can’t find anything in it to back up your assertion, though. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32...

jefftk 4y ago
The directive is a bit hard to read, but its widely understood to require at least notification before storing information on a user's device, probably consent. The guidance is a lot clearer: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
- hyperman1 4y ago
  I'm not sure the guidance applies in this case, as this technique is an edge case which the writers probably didn't foresee. The ePrivacy directive itself has in article 3.1: This Directive shall apply to the processing of personal data [...] which would mean it doesnt apply here, as there is no personal data. In practice, I assume this one is for the judges.

deleted 4y ago

[deleted]