3 ms·

ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing an

ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.

fogzen 3y ago
I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.
- frereubu 3y ago
  In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.
  - fogzen 3y ago
    The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone. What should matter is what’s logged. Every request contains an IP that’s how the web works.
    - frereubu 3y ago
      Ah yes - I misread your suggestion. Seems feasible in that case.
ttepasse 3y ago
Back in 2012 the EU’s Article 29 Data Protection Working Party* published an rather readable opinion about the different cookie consent exemptions. Yes, first party analytics are not essential. The WP29 even proposed to exempt them in a hypothetical future privacy directive. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”. Interesting. Maybe there is a possibility in the future. https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-privacy-and-electronic-communications https://digital-strategy.ec.europa.eu/en/library/proposal-re... https://edpb.europa.eu/sites/default/files/files/file1/edpb_statement_on_eprivacy_en.pdf https://edpb.europa.eu/sites/default/files/files/file1/edpb_...

fogzen 3y ago

I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.

frereubu 3y ago
In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.
- fogzen 3y ago
  The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone. What should matter is what’s logged. Every request contains an IP that’s how the web works.
  - frereubu 3y ago
    Ah yes - I misread your suggestion. Seems feasible in that case.

ttepasse 3y ago

Back in 2012 the EU’s Article 29 Data Protection Working Party* published an rather readable opinion about the different cookie consent exemptions. Yes, first party analytics are not essential. The WP29 even proposed to exempt them in a hypothetical future privacy directive. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”. Interesting. Maybe there is a possibility in the future. https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-privacy-and-electronic-communications https://digital-strategy.ec.europa.eu/en/library/proposal-re... https://edpb.europa.eu/sites/default/files/files/file1/edpb_statement_on_eprivacy_en.pdf https://edpb.europa.eu/sites/default/files/files/file1/edpb_...