5 ms·

I was always confused by GDPR. What are the minimum requirements to avoid the banner? Anonymising the IPs and not keeping anything else, or you can keep anythin

I was always confused by GDPR. What are the minimum requirements to avoid the banner? Anonymising the IPs and not keeping anything else, or you can keep anything as long as you don't share them with third-parties?

blkhawk 2y ago
well AFAIK a simple session cookie doesn't need a banner. Also i think if you do everything local to your system you don't need one either. The point where you need one if you use any system that utilizes third parties to track the user. So if you store and analyze everything "locally" to your server you don't need cookies and therefore no banner no matter how much you "track" since its all request made to your own server you merly use the telemetry of. You can't share that data without consent but thats a seperate data protection thing from the cookie banners.
- blkhawk 2y ago
  Oh and the GPDR is mostly confusing because it was interpreted with malicous complyance by the whole industry - at least in effect if not intention. it is simply easy for upper management to take a "better safe than sorry" approach and by now the banners have reached a degree of dark pattern development that is horrifying in their relentlessness.
  - yardstick 2y ago
    Yup. What’s that? We need users consent for ad cookies? Ok let’s also make them consent to the session cookie too as a way to confuse them or get them to lazily just click the accept all cookies button rather than find the exact cookies the site needs to run without ads.
  - omnimus 2y ago
    So much this. The whole ad industry is afraid that most websites would switch to simpler more private compliant alternatives which would break their business (of reselling snooping data). So they are on marketing campaign to paint these alternatives as non compliant and requiring banners too. Basically every fart now needs a consent banner and when you already have a banner why not have this most invasive visitor screen recorder analytics that we send to our 743 partners in real time.
shafyy 2y ago
Essential cookies (e.g. a cookie that saves the cart's content in an e-commerce app) are fine. PII (personally identifable information) is never fine (this includes IP addresses, email addresses, more or less exact geolocations) - so anonymized IP is ok.
- gmokki 2y ago
  What is an anonymized IP? And how would that be useful? I think simple hash(IP) is only pseydonymiztion and can be reversed with a bit of work. And thus cannot be stored without consent. Of course mapping each IP to random id and not storing the mapping should be completely ok. And legitimate reasons allow storing the mapping for a short period for debugging and attack detection.
  - ralferoo 2y ago
    > Of course mapping each IP to random id and not storing the mapping should be completely ok. If it was a different random id for every request, then sure, OK. If it's the same random id used on multiple requests, then it becomes PII, as its purpose is to uniquely identify and individual. It should not be logged or stored.
    - omnimus 2y ago
      Services like Plausible add time into the mix. So you know that someone visited these 5 pages in 20 min. But you wont know about returning visitors. I think thats pretty significant difference. But if what you are saying is true then it's impossible to know how many people visited your website unless you have banner. What about logs then? Sounds like everybody is happily using those because they are "legitimate interest" because servers couldn't work without them but its way more identifying data than what Plausible saves.
      - shafyy 2y ago
        It's not a clear and cut case with IPs. As you say, if your servers logs IPs that seems to be classified as "legitimate interest" (for security reasons). But if you use that data to track unique users for product dev, marketing etc. reasons, that's not "legitimiate" interest anymore. At least, this is my understanding. For example, it would make stopping a DDoS attack much harder if you would need to anonymize IPs. Here's some interesting discussion on this very topic: https://law.stackexchange.com/questions/28603/how-to-satisfy-gdprs-consent-requirement-for-ip-logging https://law.stackexchange.com/questions/28603/how-to-satisfy...
ben_w 2y ago
IANAL, but for me the thing is mostly clear* and the only question is "what counts as 'legitimate interest'". https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ 1) If it's strictly necessary, e.g. logging in or legal obligation, you're fine and don't need to ask 2) If the data can be associated with a specific human, and it isn't covered by #1, then ask 3) ??? legitimate interest ??? * but I know from experience that this means "don't trust my own feelings of clarity, ask a lawyer"
- bryanrasmussen 2y ago
  legitimate interest - anything to make your application function. you have an online mail service, you have to save email accounts of emails you receive so you can respond to those. you allow people to forward their emails received to other email addresses, you need to save those other email addresses. This would be in dbs for that stuff if you have third party marketing analytics, just because you have legitimate interest to save email to make application work doesn't mean you can pass that email into third party marketing analytics. That is not legitimate interest. if you have a newsletter service and someone signs up to receive newsletter then you need to save their email to send that newsletter. you don't need to ask, they have implicitly given you permission by asking you to send them the newsletter. If you have a process for removing users from service for violation of terms then you probably need to be able to keep information about them otherwise they can just say get rid of info and then sign on again - this would come into the parts of the Digital services acts about obligations to users and appeals process for removal etc. but different thing, if you have removed someone you need to be able to identify when they try to come on again.
  - troupo 2y ago
    > legitimate interest - anything to make your application function. Plus the data that you're required to retain by other laws. E.g. banks/financial institutions might be required to retain a lot of data for several years for audit and compliance purposes.
    - bryanrasmussen 2y ago
iamacyborg 2y ago
The banner has nothing to do with GDPR, it’s more to do with PECR.

blkhawk 2y ago

well AFAIK a simple session cookie doesn't need a banner. Also i think if you do everything local to your system you don't need one either. The point where you need one if you use any system that utilizes third parties to track the user. So if you store and analyze everything "locally" to your server you don't need cookies and therefore no banner no matter how much you "track" since its all request made to your own server you merly use the telemetry of. You can't share that data without consent but thats a seperate data protection thing from the cookie banners.

blkhawk 2y ago
Oh and the GPDR is mostly confusing because it was interpreted with malicous complyance by the whole industry - at least in effect if not intention. it is simply easy for upper management to take a "better safe than sorry" approach and by now the banners have reached a degree of dark pattern development that is horrifying in their relentlessness.
- yardstick 2y ago
  Yup. What’s that? We need users consent for ad cookies? Ok let’s also make them consent to the session cookie too as a way to confuse them or get them to lazily just click the accept all cookies button rather than find the exact cookies the site needs to run without ads.
- omnimus 2y ago
  So much this. The whole ad industry is afraid that most websites would switch to simpler more private compliant alternatives which would break their business (of reselling snooping data). So they are on marketing campaign to paint these alternatives as non compliant and requiring banners too. Basically every fart now needs a consent banner and when you already have a banner why not have this most invasive visitor screen recorder analytics that we send to our 743 partners in real time.

shafyy 2y ago

Essential cookies (e.g. a cookie that saves the cart's content in an e-commerce app) are fine. PII (personally identifable information) is never fine (this includes IP addresses, email addresses, more or less exact geolocations) - so anonymized IP is ok.

gmokki 2y ago
What is an anonymized IP? And how would that be useful? I think simple hash(IP) is only pseydonymiztion and can be reversed with a bit of work. And thus cannot be stored without consent. Of course mapping each IP to random id and not storing the mapping should be completely ok. And legitimate reasons allow storing the mapping for a short period for debugging and attack detection.
- ralferoo 2y ago
  > Of course mapping each IP to random id and not storing the mapping should be completely ok. If it was a different random id for every request, then sure, OK. If it's the same random id used on multiple requests, then it becomes PII, as its purpose is to uniquely identify and individual. It should not be logged or stored.
  - omnimus 2y ago
    Services like Plausible add time into the mix. So you know that someone visited these 5 pages in 20 min. But you wont know about returning visitors. I think thats pretty significant difference. But if what you are saying is true then it's impossible to know how many people visited your website unless you have banner. What about logs then? Sounds like everybody is happily using those because they are "legitimate interest" because servers couldn't work without them but its way more identifying data than what Plausible saves.
    - shafyy 2y ago
      It's not a clear and cut case with IPs. As you say, if your servers logs IPs that seems to be classified as "legitimate interest" (for security reasons). But if you use that data to track unique users for product dev, marketing etc. reasons, that's not "legitimiate" interest anymore. At least, this is my understanding. For example, it would make stopping a DDoS attack much harder if you would need to anonymize IPs. Here's some interesting discussion on this very topic: https://law.stackexchange.com/questions/28603/how-to-satisfy-gdprs-consent-requirement-for-ip-logging https://law.stackexchange.com/questions/28603/how-to-satisfy...

ben_w 2y ago

IANAL, but for me the thing is mostly clear* and the only question is "what counts as 'legitimate interest'". https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ 1) If it's strictly necessary, e.g. logging in or legal obligation, you're fine and don't need to ask 2) If the data can be associated with a specific human, and it isn't covered by #1, then ask 3) ??? legitimate interest ??? * but I know from experience that this means "don't trust my own feelings of clarity, ask a lawyer"

bryanrasmussen 2y ago
legitimate interest - anything to make your application function. you have an online mail service, you have to save email accounts of emails you receive so you can respond to those. you allow people to forward their emails received to other email addresses, you need to save those other email addresses. This would be in dbs for that stuff if you have third party marketing analytics, just because you have legitimate interest to save email to make application work doesn't mean you can pass that email into third party marketing analytics. That is not legitimate interest. if you have a newsletter service and someone signs up to receive newsletter then you need to save their email to send that newsletter. you don't need to ask, they have implicitly given you permission by asking you to send them the newsletter. If you have a process for removing users from service for violation of terms then you probably need to be able to keep information about them otherwise they can just say get rid of info and then sign on again - this would come into the parts of the Digital services acts about obligations to users and appeals process for removal etc. but different thing, if you have removed someone you need to be able to identify when they try to come on again.
- troupo 2y ago
  > legitimate interest - anything to make your application function. Plus the data that you're required to retain by other laws. E.g. banks/financial institutions might be required to retain a lot of data for several years for audit and compliance purposes.
  - bryanrasmussen 2y ago

iamacyborg 2y ago

The banner has nothing to do with GDPR, it’s more to do with PECR.