4 ms·

It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're t

It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor

littlestymaar 3y ago
As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.
- M2Ys4U 3y ago
  This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.
louis-lau 3y ago
That's not really what anyone means when they say tracking...
- youngtaff 3y ago
  The recent case against Criteo in the Netherlands has some interesting definitions of cookie types: This case revolves around (third party) tracking cookies. The Dutch Data Protection Authority (AP) defines 2 cookies as follows: “Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor. Bottom of form There are 3 types of cookies: - functional cookies; - analytical cookies; - tracking cookies.” The AP says about tracking cookies 3 : “If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time. Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data. Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).” https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true#!/details?id=ECLI:NL:RBAMS:2023:6530 https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...
  - noirscape 3y ago
    For anyone wondering what the Dutch DPA (called the Autoriteit Persoonsgegevens, or Authority personal data) itself says about cookies (and user tracking in general really): https://www.autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies https://www.autoriteitpersoonsgegevens.nl/themas/internet-sl... (It's in dutch, translate at your own liberty, I'll give my own below + the stuff the authority for consumers and the market demands, which is linked from their page.) Basically of the three cookie types, functional cookies require no consent whatsoever. A cookie to set up a user session (the page uses a shopping cart in a webshop as an example and the details mention things like saved passwords and language choices) is totally fine. The AP still recommends informing the users, but it's not required. Analytical cookies are permissible insofar that they aren't used to profile the user. You're not required to ask for permission as long as they don't contain any uniquely identifying information. You are required to inform the visitor that you are placing these cookies though. The final category are tracking cookies. These fall under the full scope of the GDPR; you must ask for consent before placing them, you must tell people how you are collecting their data (cookies, scripts or beacons are listed as examples) and you need to tell people what you do with them. Pre-checking consent forms in general is expressly forbidden (on the same logic that you can't pre-check people into signing up for physical spam mail or paid subscriptions) and consent must be clearly stated, not hidden in some terms of services page or privacy statement. Those are all requirements on top of the rights the GDPR (in Dutch called the AVG) grants consumers, although obviously most of this overlaps with the GDPR already.
Macha 3y ago
Storing previous_visitor=1 into local storage is not the type of tracking most people are objecting to, nor is it against the gdpr until you start having user specific indicators or trying to use a collection of values as a fingerprint.
- hartator 3y ago
  And it is enough to get you in trouble if it’s a website you are not supposed to see.
  - norman784 3y ago
    Is that so? Event if you check that on the client side without sending that data to the server?
    - hartator 3y ago
      A wife can find out a husband is trying to cheat on them for example.
  - lupire 3y ago
    The data you choose to store with your software on your local machine is your responsibility. Tracking is server side behavior. 3P cookies aren't a problem, per se. Using 3rd party cookies to join data with other server side data is the problem.
    - hartator 3y ago
      Well you can still reject all cookies then, making all of these cookies popup nonsense.
- closewith 3y ago
  Not GDPR, but probably does require consent under the ePrivacy Directive.
- account42 3y ago
wkat4242 3y ago
> Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor It is arguably tracking required for the functioning of the site which is a clear exception to the ban.
- nvm0n2 3y ago
  It's clearly not required. The site would function without it. Therefore an activist will eventually argue to a court that it's a GDPR violation and win, meaning you have to pay up a fraction of your revenue (possibly sending you under). GDPR threads on HN are always like this. Tons of people saying "no no it doesn't work that way it wouldn't be reasonable" and then when that thing ends up being ruled illegal, "of course it's illegal everyone knew that it's all very clear". GDPR is written in such a way that you can't ever know what is or isn't allowed.
  - deleted 3y ago
    [deleted]
dkersten 3y ago
That’s setting a cookie/local storage that can be used purely client side to determine whether to show the message or not. No tracking required because the server never has to see or store this.
- cowl 3y ago
  local storage maybe, but cookies are sent on every request. there are no purely client side cookies.
smolder 3y ago
Tracking cookies identify you across multiple sites. If some front-end JavaScript sets and checks a cookie for "has visited" on a single site, that's not considered tracking. It's non-identifying and harmless.

It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor

littlestymaar 3y ago

As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.

M2Ys4U 3y ago
This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.

louis-lau 3y ago

That's not really what anyone means when they say tracking...

youngtaff 3y ago
The recent case against Criteo in the Netherlands has some interesting definitions of cookie types: This case revolves around (third party) tracking cookies. The Dutch Data Protection Authority (AP) defines 2 cookies as follows: “Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor. Bottom of form There are 3 types of cookies: - functional cookies; - analytical cookies; - tracking cookies.” The AP says about tracking cookies 3 : “If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time. Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data. Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).” https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true#!/details?id=ECLI:NL:RBAMS:2023:6530 https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...
- noirscape 3y ago
  For anyone wondering what the Dutch DPA (called the Autoriteit Persoonsgegevens, or Authority personal data) itself says about cookies (and user tracking in general really): https://www.autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies https://www.autoriteitpersoonsgegevens.nl/themas/internet-sl... (It's in dutch, translate at your own liberty, I'll give my own below + the stuff the authority for consumers and the market demands, which is linked from their page.) Basically of the three cookie types, functional cookies require no consent whatsoever. A cookie to set up a user session (the page uses a shopping cart in a webshop as an example and the details mention things like saved passwords and language choices) is totally fine. The AP still recommends informing the users, but it's not required. Analytical cookies are permissible insofar that they aren't used to profile the user. You're not required to ask for permission as long as they don't contain any uniquely identifying information. You are required to inform the visitor that you are placing these cookies though. The final category are tracking cookies. These fall under the full scope of the GDPR; you must ask for consent before placing them, you must tell people how you are collecting their data (cookies, scripts or beacons are listed as examples) and you need to tell people what you do with them. Pre-checking consent forms in general is expressly forbidden (on the same logic that you can't pre-check people into signing up for physical spam mail or paid subscriptions) and consent must be clearly stated, not hidden in some terms of services page or privacy statement. Those are all requirements on top of the rights the GDPR (in Dutch called the AVG) grants consumers, although obviously most of this overlaps with the GDPR already.

Macha 3y ago

Storing previous_visitor=1 into local storage is not the type of tracking most people are objecting to, nor is it against the gdpr until you start having user specific indicators or trying to use a collection of values as a fingerprint.

hartator 3y ago
And it is enough to get you in trouble if it’s a website you are not supposed to see.
- norman784 3y ago
  Is that so? Event if you check that on the client side without sending that data to the server?
  - hartator 3y ago
    A wife can find out a husband is trying to cheat on them for example.
- lupire 3y ago
  The data you choose to store with your software on your local machine is your responsibility. Tracking is server side behavior. 3P cookies aren't a problem, per se. Using 3rd party cookies to join data with other server side data is the problem.
  - hartator 3y ago
    Well you can still reject all cookies then, making all of these cookies popup nonsense.
closewith 3y ago
Not GDPR, but probably does require consent under the ePrivacy Directive.
account42 3y ago

wkat4242 3y ago

> Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor It is arguably tracking required for the functioning of the site which is a clear exception to the ban.

nvm0n2 3y ago
It's clearly not required. The site would function without it. Therefore an activist will eventually argue to a court that it's a GDPR violation and win, meaning you have to pay up a fraction of your revenue (possibly sending you under). GDPR threads on HN are always like this. Tons of people saying "no no it doesn't work that way it wouldn't be reasonable" and then when that thing ends up being ruled illegal, "of course it's illegal everyone knew that it's all very clear". GDPR is written in such a way that you can't ever know what is or isn't allowed.
- deleted 3y ago
  [deleted]

dkersten 3y ago

That’s setting a cookie/local storage that can be used purely client side to determine whether to show the message or not. No tracking required because the server never has to see or store this.

cowl 3y ago
local storage maybe, but cookies are sent on every request. there are no purely client side cookies.

smolder 3y ago

Tracking cookies identify you across multiple sites. If some front-end JavaScript sets and checks a cookie for "has visited" on a single site, that's not considered tracking. It's non-identifying and harmless.