5 ms·

Thats when every path (screw it, even /) gets swapped for a UUID so link sharing is always traceable.

LoganDark 3y ago
This is how marketing emails already work. Although outside of those, usually these are replaced by query parameters that are merely extraneous to the main path. Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.
- mandelbrotwurst 3y ago
  > Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though. Ugh, please don't give them any ideas
  - drexlspivey 3y ago
    This is going on for a while on facebook afaik. On youtube and twitter they are still a url param that you can strip out.
    - joshspankit 3y ago
      TikTok has possibly the most nefarious version of this: When someone shares a video, a link is created that’s specific to them. It’s a short link that looks like a regular one, while the tracking params are shown only after someone goes to the link and the shortener resolves it. If it opens in the app through deep linking the tracking has happened transparently.
      - explaininjs 3y ago
        This (ostensibly) empowers the user-facing "feature" whereby you're presented the "User XXX is on TikTok, you should join them!" modal when you click their link. Which is perhaps better than no end-user impact at all.
  - atoav 3y ago
    This is still illegal. GDPR is NOT about cookies ("the collection mechanism"), but about the data being collected ("personal information"). So as long as you are collecting personal information, there is no legal difference whether you do it via cookies or another different mechanism.
    - BGizzle 3y ago
      GDPR is not about consent or data being collected. If it were, the EU would not penalize violators based on a (largely irrelevant) PERCENTAGE OF GLOBAL REVENUE for a breach. I'm an external auditor. The GDPR is a cash grab. Regulations that actually incentivize organizations toward stronger privacy and protection practices are designed more like HIPAA or PCI where the MAGNITUDE OF THE BREACH is the primary factor determining the monetary fines imposed (e.g.,number of records exposed, was it PII, PHI, etc.). Taking 4% of the company's annual revenue from the previous year, irrespective of the size of the breach, results in a regulation about as effective as clicking those cookie consent boxes. "Oh thank goodness I gave my consent, I think now we can all rest easy that our data is being handled securely and appropriately!" No, the EU included the ticky tacky consent requirement to create major global visibility about itself so that when a company doing business with the EU has a breach, they won't be surprised when they then get an additional bill from the EU for not only having the breach, but now being in violation of the GDPR too. The GDPR is a despicable joke. And my use of 'the' gives me the right to that opinion. If anyone else out there was involved in GDPR's creation or implementation, I think you would agree: GDPR owns the Greatest Dung Pile Record, Grandma's Dildo Paste Replenisher, the Gagging Damaged Penis Rectum and one Gigabyte of Dick Punch Radiation in addition to €2.83 billion (as of 12/2022) collected from breached companies in 1,401 cases for "violating the GDPR".
      - atoav 3y ago
        I know that the fines are a percentage of global revenue. And I am totally on board with this. I wish we had dynamic fines like these in more areas of society. The other option would be to have fixed fines that Google et al. pay out of their small change, while it absolutly would torch their small competition. Sure, they could also jail CEOs for this. I would also be for that. If a fine doesn't grow with the income it is a fee. So if you want a corporation to follow your law, it needs to come with a fine that motivates those in charge enough to follow it. Money is the soft option there. It is totally possible to run websites in compliance with GDPR. I built multiple that require no consent whatsoever, because guess what: No personal data is collected, where it is not absolutely technically required. For me as an EU citizen the GDPR turned my data-related communications with companies from essentially begging into the void, to actually getting a response.
- 1vuio0pswjnm7 3y ago
  Assuming it remains legal. Many folks assumed DNT is useless. Yet here we are comenting in a thread about a court that is making it legally enforceable.
  - LoganDark 3y ago
    > Assuming it remains legal. How exactly do you legally enforce "each link must not be a unique UUID generated per-user or per-page-view"? Do you mandate how "generic" a link has to be, such that a visit to that link exposes less than a certain amount of information about that visit? What about things like order-specific links on a shopping website, that will naturally identify an account if all orders share the same namespace?
    - atoav 3y ago
      Easy. It is already forbidden by GDPR without consent. Contrary to popular believe the GDPR does not mandate anything about cookies, it talks about personal information, if you collect it through cookies or some intricate system of pulleys and levers doesn't matter at all. Simplified it says: if you collect personal information, you need to ask for consent. If someone doesn't consent they must not receive degraded service. Now there has been a ruling that the Do Not Track info users send you shall be honored by you (duh). This is true regardless of how you technically do it. So UUID URLs are okay, storing which IP adresses shared an UUID link with which other IP without consent is not. I think some in the IT world need to finally stop making excuses and stop coming up with new illegal ways of tracking users on a personal level. Just use the same creative energy for finding ways of pseudonymizing and anonymizing users (where possible — depending on what you are collecting deanonymization might always be possible).
      - explaininjs 3y ago
        Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.
atoav 3y ago
For a thousandths time: GDPR prohibits the collection of personal information without informed consent. It does not matter how you collect that personal information, so whether you use cookies, pen and paper, the digital equivalent of a rube goldberg machine or UUIDs in the URLs — totally meaningless. As soon as you process the IP and use that information for any purpose not considered legitimate interest you are on the hook (and no: if you are in doubt it is not legitimate interest). Many wrongly believe GDPR is about cookies. It is not. It is about the information and the consent. So whether you change the collection mechanism doesn't make any difference if you still collect the info. It just means you now have to update your consent banner to include that new way of data collection as well ; )
- explaininjs 3y ago
  Nobody here is talking about GDPR except you.
  - atoav 3y ago
    A interesting way to show that you got no clue why people put cookie consent banners on their websites. Let me give you a hint: Because they are required to do so by law (at least in the biggest free market on the planet). Now maybe you can figure out how that law is called and why it is relevant in a discussion where the topic is DNT and a German court ruling it needs to be honored. We are not discussing whether tracking is technically possible — that would be a pretty short discussion: Yes it is possible. So we are talking about something else. And if we are not talking about the law, why did you even feel a need to come up with a way of circumventing it?
    - explaininjs 3y ago
      You clearly haven’t been following along and instead jumped to beating the same dead horse you admit to having beat so many times before. To summarize: we’re talking about technical solutions to linking sessions across independent devices. What’s your “short discussion” answer to that?

This is how marketing emails already work. Although outside of those, usually these are replaced by query parameters that are merely extraneous to the main path. Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

mandelbrotwurst 3y ago
> Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though. Ugh, please don't give them any ideas
- drexlspivey 3y ago
  This is going on for a while on facebook afaik. On youtube and twitter they are still a url param that you can strip out.
  - joshspankit 3y ago
    TikTok has possibly the most nefarious version of this: When someone shares a video, a link is created that’s specific to them. It’s a short link that looks like a regular one, while the tracking params are shown only after someone goes to the link and the shortener resolves it. If it opens in the app through deep linking the tracking has happened transparently.
    - explaininjs 3y ago
      This (ostensibly) empowers the user-facing "feature" whereby you're presented the "User XXX is on TikTok, you should join them!" modal when you click their link. Which is perhaps better than no end-user impact at all.
- atoav 3y ago
  This is still illegal. GDPR is NOT about cookies ("the collection mechanism"), but about the data being collected ("personal information"). So as long as you are collecting personal information, there is no legal difference whether you do it via cookies or another different mechanism.
  - BGizzle 3y ago
    GDPR is not about consent or data being collected. If it were, the EU would not penalize violators based on a (largely irrelevant) PERCENTAGE OF GLOBAL REVENUE for a breach. I'm an external auditor. The GDPR is a cash grab. Regulations that actually incentivize organizations toward stronger privacy and protection practices are designed more like HIPAA or PCI where the MAGNITUDE OF THE BREACH is the primary factor determining the monetary fines imposed (e.g.,number of records exposed, was it PII, PHI, etc.). Taking 4% of the company's annual revenue from the previous year, irrespective of the size of the breach, results in a regulation about as effective as clicking those cookie consent boxes. "Oh thank goodness I gave my consent, I think now we can all rest easy that our data is being handled securely and appropriately!" No, the EU included the ticky tacky consent requirement to create major global visibility about itself so that when a company doing business with the EU has a breach, they won't be surprised when they then get an additional bill from the EU for not only having the breach, but now being in violation of the GDPR too. The GDPR is a despicable joke. And my use of 'the' gives me the right to that opinion. If anyone else out there was involved in GDPR's creation or implementation, I think you would agree: GDPR owns the Greatest Dung Pile Record, Grandma's Dildo Paste Replenisher, the Gagging Damaged Penis Rectum and one Gigabyte of Dick Punch Radiation in addition to €2.83 billion (as of 12/2022) collected from breached companies in 1,401 cases for "violating the GDPR".
    - atoav 3y ago
      I know that the fines are a percentage of global revenue. And I am totally on board with this. I wish we had dynamic fines like these in more areas of society. The other option would be to have fixed fines that Google et al. pay out of their small change, while it absolutly would torch their small competition. Sure, they could also jail CEOs for this. I would also be for that. If a fine doesn't grow with the income it is a fee. So if you want a corporation to follow your law, it needs to come with a fine that motivates those in charge enough to follow it. Money is the soft option there. It is totally possible to run websites in compliance with GDPR. I built multiple that require no consent whatsoever, because guess what: No personal data is collected, where it is not absolutely technically required. For me as an EU citizen the GDPR turned my data-related communications with companies from essentially begging into the void, to actually getting a response.
1vuio0pswjnm7 3y ago
Assuming it remains legal. Many folks assumed DNT is useless. Yet here we are comenting in a thread about a court that is making it legally enforceable.
- LoganDark 3y ago
  > Assuming it remains legal. How exactly do you legally enforce "each link must not be a unique UUID generated per-user or per-page-view"? Do you mandate how "generic" a link has to be, such that a visit to that link exposes less than a certain amount of information about that visit? What about things like order-specific links on a shopping website, that will naturally identify an account if all orders share the same namespace?
  - atoav 3y ago
    Easy. It is already forbidden by GDPR without consent. Contrary to popular believe the GDPR does not mandate anything about cookies, it talks about personal information, if you collect it through cookies or some intricate system of pulleys and levers doesn't matter at all. Simplified it says: if you collect personal information, you need to ask for consent. If someone doesn't consent they must not receive degraded service. Now there has been a ruling that the Do Not Track info users send you shall be honored by you (duh). This is true regardless of how you technically do it. So UUID URLs are okay, storing which IP adresses shared an UUID link with which other IP without consent is not. I think some in the IT world need to finally stop making excuses and stop coming up with new illegal ways of tracking users on a personal level. Just use the same creative energy for finding ways of pseudonymizing and anonymizing users (where possible — depending on what you are collecting deanonymization might always be possible).
    - explaininjs 3y ago
      Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

atoav 3y ago

For a thousandths time: GDPR prohibits the collection of personal information without informed consent. It does not matter how you collect that personal information, so whether you use cookies, pen and paper, the digital equivalent of a rube goldberg machine or UUIDs in the URLs — totally meaningless. As soon as you process the IP and use that information for any purpose not considered legitimate interest you are on the hook (and no: if you are in doubt it is not legitimate interest). Many wrongly believe GDPR is about cookies. It is not. It is about the information and the consent. So whether you change the collection mechanism doesn't make any difference if you still collect the info. It just means you now have to update your consent banner to include that new way of data collection as well ; )

explaininjs 3y ago
Nobody here is talking about GDPR except you.
- atoav 3y ago
  A interesting way to show that you got no clue why people put cookie consent banners on their websites. Let me give you a hint: Because they are required to do so by law (at least in the biggest free market on the planet). Now maybe you can figure out how that law is called and why it is relevant in a discussion where the topic is DNT and a German court ruling it needs to be honored. We are not discussing whether tracking is technically possible — that would be a pretty short discussion: Yes it is possible. So we are talking about something else. And if we are not talking about the law, why did you even feel a need to come up with a way of circumventing it?
  - explaininjs 3y ago
    You clearly haven’t been following along and instead jumped to beating the same dead horse you admit to having beat so many times before. To summarize: we’re talking about technical solutions to linking sessions across independent devices. What’s your “short discussion” answer to that?