3 ms·

The elephant in the room is that almost no one wants to host website without at least some sort of website analytics service, which does not fall under legitima

The elephant in the room is that almost no one wants to host website without at least some sort of website analytics service, which does not fall under legitimate use. So that's why even a small blog is going to have a cookie banner. There are some analytics companies out there that advertise cookieless analytics, but they are either a) too simple for enterprise or b) a much, much worse privacy and compliance risk.

ffsm8 2y ago
Even this can be done without a banner, as long as these analytics do not contain any way to link them to individuals/specific users It's admittedly sound advice to create a banner for such a usecase however, as sanitizing all user data from these events is hard to guarantee, and you'd have to do just that to keep it legal
- XCSme 2y ago
  I think it's impossible to be 100% legal. Many times, the user IP, which is considered PII, is stored in various servers/routers log that you have no access to...
  - deleted 2y ago
    [deleted]
  - ffsm8 2y ago
    Lots of misinformation on the internet wrt this, and I am not a lawyer either. It's especially tragic because Google serves you countless factually incorrect articles if you search for gdpr, which doesn't help with this endless amount of confusion. You might be interested to know that an IP address isn't actually PII, because that's a concept of California privacy regulation and they don't care about them https://techgdpr.com/blog/difference-between-pii-and-personal-data/ https://techgdpr.com/blog/difference-between-pii-and-persona... It's a different story for gdprs personal data however. Because there are individuals with static IPs - which makes it possible to link these IP addresses to individuals. If you could only omit these, you could technically use ipadresses however you want too. But I admit that that's kinda unrealistic ( • ‿ • )
Earw0rm 2y ago
The other elephant is that while everyone has analytics, only one in five companies pays someone with an actual clue how to interpret them to look at them regularly, and only one in five of those companies has a decision making structure that allows them to act meaningfully in response to insights gained.
account42 2y ago
Well, too bad. When it comes to processing other people's data you don't get to do whatever you want. Maybe try running a website without analytics before throwing a tantrum.
- ryandrake 2y ago
  Yea, companies are so used to laissez faire that when they're finally told "too bad, so sad" they throw a tantrum, sue, cry, and eventually comply as maliciously as the possibly can, to show the world how upset they are that they can't simply do whatever they want.

ffsm8 2y ago

Even this can be done without a banner, as long as these analytics do not contain any way to link them to individuals/specific users It's admittedly sound advice to create a banner for such a usecase however, as sanitizing all user data from these events is hard to guarantee, and you'd have to do just that to keep it legal

XCSme 2y ago
I think it's impossible to be 100% legal. Many times, the user IP, which is considered PII, is stored in various servers/routers log that you have no access to...
- deleted 2y ago
  [deleted]
- ffsm8 2y ago
  Lots of misinformation on the internet wrt this, and I am not a lawyer either. It's especially tragic because Google serves you countless factually incorrect articles if you search for gdpr, which doesn't help with this endless amount of confusion. You might be interested to know that an IP address isn't actually PII, because that's a concept of California privacy regulation and they don't care about them https://techgdpr.com/blog/difference-between-pii-and-personal-data/ https://techgdpr.com/blog/difference-between-pii-and-persona... It's a different story for gdprs personal data however. Because there are individuals with static IPs - which makes it possible to link these IP addresses to individuals. If you could only omit these, you could technically use ipadresses however you want too. But I admit that that's kinda unrealistic ( • ‿ • )

Earw0rm 2y ago

The other elephant is that while everyone has analytics, only one in five companies pays someone with an actual clue how to interpret them to look at them regularly, and only one in five of those companies has a decision making structure that allows them to act meaningfully in response to insights gained.

account42 2y ago

Well, too bad. When it comes to processing other people's data you don't get to do whatever you want. Maybe try running a website without analytics before throwing a tantrum.

ryandrake 2y ago
Yea, companies are so used to laissez faire that when they're finally told "too bad, so sad" they throw a tantrum, sue, cry, and eventually comply as maliciously as the possibly can, to show the world how upset they are that they can't simply do whatever they want.