4 ms·

What if cookies which are required for a service to function are also used for tracking?

by YPPH 4y ago

hackmiester 4y ago
It looks like you have identified the workaround that a ton of sites are using to track even users who deny non-essential cookies.
- _v7gu 4y ago
  Doing that is a clear GDPR violation
  - rendall 4y ago
    As an American living in Europe who supports the GDPR, I suspect that most of the violations are driven by American companies and these violations are in part ideological. The concept of a government sincerely passing a law that genuinely and competently protects the privacy of its individual citizens seems absurdly unlikely to many of us. Laws are not created for individuals except when a cynical politician wants votes from the gullible. Circumventing such a "stupid", "anti-business" law as the GDPR is almost an American duty.
Zak 4y ago
Then the site is probably violating the GDPR.
happymellon 4y ago
Remove the word cookie as that has nothing to do with the GDPR. The EU rule was to prevent someone collecting personal identifying information and then sell it on without consent. A really simple read can be found at the ICO. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/ https://ico.org.uk/for-organisations/guide-to-data-protectio... The "cookie banner" is to work around the fact that there are 3rd parties who would have access to your information without your consent and they want it to be awkward so that you consent. If your application is a fitness tracker then of course you are going to have a lot of personal information. You are not allowed to sell it without consent, tracking in this case is selling information to Google et al. You tracking a logged in user, via a shopping cart as a cookie, does not violate the GDPR.
- jefftk 4y ago
  > You tracking a logged in user, via a shopping cart as a cookie, does not violate the GDPR. Not the GDPR, the ePrivacy Directive. More: https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners
  - youngtaff 4y ago
    The reality is most EU cookie banners aren’t cookie banners but requests for consent under GDPR
    - jefftk 4y ago
      I think you'd have trouble finding a banner that wasn't also asking for cookie consent.
      - youngtaff 3y ago
        That doesn't mean the banner is correct though - many just ask for Cookie Consent when they need a wider consent Event making a TCP connection to a non-critical third-party requires consent
janosd 4y ago
You may be able to argue a GDPR Art. 6 lit 1b (necessary to perform a contract) or a 1f (legitimate interest) reason to track, but you will need to, at the very least, inform the user. Storing data on the user's device (cookies, local storage, etc) also requires the user to be notified thanks to the ePrivacy directive.
oezi 4y ago
What matters is the intended purpose for which the data was collected. It is a violation to use it for another purpose than the one you collected consent for (or have another reason for collecting).

What if cookies which are required for a service to function are also used for tracking?

by YPPH 4y ago

What if cookies which are required for a service to function are also used for tracking?

It looks like you have identified the workaround that a ton of sites are using to track even users who deny non-essential cookies.

_v7gu 4y ago
Doing that is a clear GDPR violation
- rendall 4y ago
  As an American living in Europe who supports the GDPR, I suspect that most of the violations are driven by American companies and these violations are in part ideological. The concept of a government sincerely passing a law that genuinely and competently protects the privacy of its individual citizens seems absurdly unlikely to many of us. Laws are not created for individuals except when a cynical politician wants votes from the gullible. Circumventing such a "stupid", "anti-business" law as the GDPR is almost an American duty.

Zak 4y ago

Then the site is probably violating the GDPR.

happymellon 4y ago

Remove the word cookie as that has nothing to do with the GDPR. The EU rule was to prevent someone collecting personal identifying information and then sell it on without consent. A really simple read can be found at the ICO. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/ https://ico.org.uk/for-organisations/guide-to-data-protectio... The "cookie banner" is to work around the fact that there are 3rd parties who would have access to your information without your consent and they want it to be awkward so that you consent. If your application is a fitness tracker then of course you are going to have a lot of personal information. You are not allowed to sell it without consent, tracking in this case is selling information to Google et al. You tracking a logged in user, via a shopping cart as a cookie, does not violate the GDPR.

jefftk 4y ago
> You tracking a logged in user, via a shopping cart as a cookie, does not violate the GDPR. Not the GDPR, the ePrivacy Directive. More: https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners
- youngtaff 4y ago
  The reality is most EU cookie banners aren’t cookie banners but requests for consent under GDPR
  - jefftk 4y ago
    I think you'd have trouble finding a banner that wasn't also asking for cookie consent.
    - youngtaff 3y ago
      That doesn't mean the banner is correct though - many just ask for Cookie Consent when they need a wider consent Event making a TCP connection to a non-critical third-party requires consent

janosd 4y ago

You may be able to argue a GDPR Art. 6 lit 1b (necessary to perform a contract) or a 1f (legitimate interest) reason to track, but you will need to, at the very least, inform the user. Storing data on the user's device (cookies, local storage, etc) also requires the user to be notified thanks to the ePrivacy directive.

oezi 4y ago

What matters is the intended purpose for which the data was collected. It is a violation to use it for another purpose than the one you collected consent for (or have another reason for collecting).