4 ms·

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a l

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose, regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented, and the company is tracking you by other methods, then that is illegal. (It'd be illegal also if they hadn't given a consent popup at all.)

misja111 3y ago
Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.
- Yujf 3y ago
  GDPR
- robin_reala 3y ago
  The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.
  - Thorrez 3y ago
    That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.
    - cccbbbaaa 3y ago
      If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.
      - Thorrez 3y ago
        Yes GDPR applies, but the part that I was replying to doesn't.
    - pph 3y ago
      It's two different directives: - ePrivacy Directive which is about local storage - GDPR which is about information processing
dmattia 3y ago
This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...
- derefr 3y ago
  How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
  - kzzzznot 3y ago
    I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
    - cccbbbaaa 3y ago
      Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

misja111 3y ago

Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.

Yujf 3y ago
GDPR
robin_reala 3y ago
The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.
- Thorrez 3y ago
  That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.
  - cccbbbaaa 3y ago
    If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.
    - Thorrez 3y ago
      Yes GDPR applies, but the part that I was replying to doesn't.
  - pph 3y ago
    It's two different directives: - ePrivacy Directive which is about local storage - GDPR which is about information processing

dmattia 3y ago

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...

derefr 3y ago
How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
- kzzzznot 3y ago
  I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
  - cccbbbaaa 3y ago
    Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.