6 ms·

Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises a

Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information: https://friendlycaptcha.com/privacy/gdpr/ https://friendlycaptcha.com/privacy/gdpr/

TheRealPomax 3y ago
That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering.
- omoikane 3y ago
  Then I have no idea. Sounds like more captcha vendors should be advertising themselves as "GDPR compliant". Reminds me of "asbestos free" labeling: https://xkcd.com/641/ https://xkcd.com/641/
  - hot_gril 3y ago
    The website also advertises "made in Europe," so it seems like a national(-ish) trust/pride thing.
- cccbbbaaa 3y ago
  I'm pretty sure a session ID is personal data since it can be linked to a specific user by the service provider (see GDPR article 4(1)), and can be processed under the “legitimate interest” legal basis (article 6(1)f). Cookies don't violate GDPR, but are subject to ePrivacy 2002/58/CE, article 5(3). “Strictly necessary” cookies (eg. session ID cookies) are exempt from consent.
  - TheRealPomax 3y ago
    Fun fact: if you have user accounts, the act of logging in is literally the act that consents to storing and handling PII (unless you're so bad at writing a signup agreement that you forgot to put that in there). If you don't require users to be logged in to serve content, e.g. the overwhelming majority of web content, then a visitor's session id, by definition, cannot be linked to their personal information, because there is no personal information to link to. However, if a session id is used to track "the same user across different websites", building up a behavioural profile, THAT would require explicit consent. But since cookies are per-domain, and browsers have severely locked down cross domain access, that's basically a non-existence concern (as both a blessing and a curse. The wild west web is long gone, for better and for worse).
    - cccbbbaaa 3y ago
      With a visitor session ID, you can identify a single user, so it's personal data under GDPR. Yes, even if you don't have a detailed profile of them. It's not even ambiguous, it's spelled in article 4(1).
- hot_gril 3y ago
  Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.
  - JohnFen 3y ago
    I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.
    - hot_gril 3y ago
      If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in doubt, consult an attorney that works with these issues. If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.
      - cccbbbaaa 3y ago
        Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also applies to local storage or any other way to store and retrieve data on a user's device. The issue is not that the law is unclear, it's people that can't help but speculate on its content even though they never read it. Google is full of links to this, and HN is bad in this regard. And to be honest, this is not exclusive to GDPR. I've found Stackexchange law and /r/gdpr to be okay-ish. Otherwise, there is a guide on the commission's website, there is gdpr.eu, there is the commented version of GDPR on gdprhub.eu: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... https://gdpr.eu/ https://gdpr.eu/ https://gdprhub.eu/index.php?title=Article_1_GDPR https://gdprhub.eu/index.php?title=Article_1_GDPR You can find a lot of advice on various DPAs website (ICO, and even the CNIL publishes stuff in english sometimes). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr...

TheRealPomax 3y ago

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering.

omoikane 3y ago
Then I have no idea. Sounds like more captcha vendors should be advertising themselves as "GDPR compliant". Reminds me of "asbestos free" labeling: https://xkcd.com/641/ https://xkcd.com/641/
- hot_gril 3y ago
  The website also advertises "made in Europe," so it seems like a national(-ish) trust/pride thing.
cccbbbaaa 3y ago
I'm pretty sure a session ID is personal data since it can be linked to a specific user by the service provider (see GDPR article 4(1)), and can be processed under the “legitimate interest” legal basis (article 6(1)f). Cookies don't violate GDPR, but are subject to ePrivacy 2002/58/CE, article 5(3). “Strictly necessary” cookies (eg. session ID cookies) are exempt from consent.
- TheRealPomax 3y ago
  Fun fact: if you have user accounts, the act of logging in is literally the act that consents to storing and handling PII (unless you're so bad at writing a signup agreement that you forgot to put that in there). If you don't require users to be logged in to serve content, e.g. the overwhelming majority of web content, then a visitor's session id, by definition, cannot be linked to their personal information, because there is no personal information to link to. However, if a session id is used to track "the same user across different websites", building up a behavioural profile, THAT would require explicit consent. But since cookies are per-domain, and browsers have severely locked down cross domain access, that's basically a non-existence concern (as both a blessing and a curse. The wild west web is long gone, for better and for worse).
  - cccbbbaaa 3y ago
    With a visitor session ID, you can identify a single user, so it's personal data under GDPR. Yes, even if you don't have a detailed profile of them. It's not even ambiguous, it's spelled in article 4(1).
hot_gril 3y ago
Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.
- JohnFen 3y ago
  I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.
  - hot_gril 3y ago
    If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in doubt, consult an attorney that works with these issues. If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.
    - cccbbbaaa 3y ago
      Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also applies to local storage or any other way to store and retrieve data on a user's device. The issue is not that the law is unclear, it's people that can't help but speculate on its content even though they never read it. Google is full of links to this, and HN is bad in this regard. And to be honest, this is not exclusive to GDPR. I've found Stackexchange law and /r/gdpr to be okay-ish. Otherwise, there is a guide on the commission's website, there is gdpr.eu, there is the commented version of GDPR on gdprhub.eu: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... https://gdpr.eu/ https://gdpr.eu/ https://gdprhub.eu/index.php?title=Article_1_GDPR https://gdprhub.eu/index.php?title=Article_1_GDPR You can find a lot of advice on various DPAs website (ICO, and even the CNIL publishes stuff in english sometimes). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr...