4 ms·

Does the no-cookie thing mean you can't count e.g. unique/returning visitors? Or is there any privacy-friendly way of doing that?

remon 2y ago
This almost always resolves to "not using actual cookies, but exactly the same privacy and security paradigm as cookies"
- alkonaut 2y ago
  I mean you can probably do something clever with this like rainbow tables on fingerprints or something like that which is more probabilistic so you never store individual fingerprints. Would be interesting to know what the solution is.
  - remon 2y ago
    Sure but any probabilistic approach is either relatively inaccurate reduces it's usefulness for this use case, or accurate which raises the same identifiability concerns cookies would introduce. I guess my point was; this has been thought about already. (Pseudo) anonymized attribution is a bit of a solved problem and you can do it with or without cookies. That's mostly a implementation detail rather than a distinguishing feature.
    - alkonaut 2y ago
      > (Pseudo) anonymized attribution is a bit of a solved problem and you can do it with or without cookies. How is it typically done without cookies then? > any probabilistic approach is either relatively inaccurate reduces it's usefulness for this use case, or accurate which raises the same identifiability concerns cookies would introduce How so? Even if it's accurate you wouldn't be storing anything the information (random id or fingerprint) for the individual user, so you would only be able to answer with reasonable certainty whether you saw the user before or not. You can't identify anyone from that (other than identify them as a new vs returning user) so there is no identifiability concern, unless of course one thinks that constitutes a concern in itself which I don't think the GDPR does.
      - remon 2y ago
        Maybe we're disconnecting. Cookies are just a standardised way to communicate a small key/value set between client/browser and server through HTTP headers. It's not inherently (in)secure, sensitive, etc. There are zero things you can do with cookies that you cannot do without and there are no inherent differences in security, they're just very convenient if you're in HTTP world. And yes what you said is exactly right; you're allowed to fingerprint a unique user and track data with that fingerprint as the sole unique identifier without any PII legislation (GDPR, CCPA, etc.) compliance issues. You just cannot store any information that allows linking PII data to that fingerprint in either direction. In other words, attribution to a random UUID that just happens to represent an anonymous user is not an issue. Circling back to the original comment; there is no (good) argument against cookies if you're basically doing exactly what cookies are doing. Umami using it as a USP is, at best, a little odd.
        pbowyer 2y ago
        > you're allowed to fingerprint a unique user and track data with that fingerprint as the sole unique identifier without any PII legislation (GDPR, CCPA, etc.) compliance issues. That is not true. E.g. 1. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/ https://ico.org.uk/about-the-ico/media-centre/news-and-blogs... 2. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr... specifically https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-storage-and-access-technologies/#device_fingerprinting https://ico.org.uk/for-organisations/direct-marketing-and-pr... This is for the UK, I am not up to date with other European regulators.
        alkonaut 2y ago
        As far as I'm aware, any online identifier, even a random number created by me, falls under the GDPR. This answer lays it out pretty well https://law.stackexchange.com/questions/82133/are-auto-generated-identifiers-pii-if-they-cannot-be-linked-to-an-identity https://law.stackexchange.com/questions/82133/are-auto-gener...
gbalduzzi 2y ago
I don't know about Umami, Plausible describes how they solved this here: https://plausible.io/data-policy https://plausible.io/data-policy, under the section "How we count unique users without cookies" TL;DR: They derive an identifier from IP address and User Agent using an hash, allowing them to have a tracking identifier without storing Personal identifiers (the IP address)
- illusive4080 2y ago
  This seems like a worse approach to me than a cookie. My IP and UA don’t change, pretty much ever. I can delete a cookie anytime I want.
  - alkonaut 2y ago
    They salt the values and compute id = hash(daily_salt + IP + UA). Then they remove those every 24 hours. I think it sounds like a perfectly reasonable solution.
    - AznHisoka 2y ago
      If they remove those every 24 hours, then doesn’t that mean if I made two visits, separated by more than 24 hrs, it would count as 2 unique visits rather than 1?
      - ksec 2y ago
        Yes. I am still not aware how to track returning visitors if while still staying within some privacy framework. Unfortunately on HN the default answer is to say not to track at all.
        account42 2y ago
        You mean fortunately? Because that's the only correct answer.
- youngtaff 2y ago
maccard 2y ago
A user resettable cookie _is_ the privacy friendly way of doing it.

remon 2y ago

This almost always resolves to "not using actual cookies, but exactly the same privacy and security paradigm as cookies"

alkonaut 2y ago
I mean you can probably do something clever with this like rainbow tables on fingerprints or something like that which is more probabilistic so you never store individual fingerprints. Would be interesting to know what the solution is.
- remon 2y ago
  Sure but any probabilistic approach is either relatively inaccurate reduces it's usefulness for this use case, or accurate which raises the same identifiability concerns cookies would introduce. I guess my point was; this has been thought about already. (Pseudo) anonymized attribution is a bit of a solved problem and you can do it with or without cookies. That's mostly a implementation detail rather than a distinguishing feature.
  - alkonaut 2y ago
    > (Pseudo) anonymized attribution is a bit of a solved problem and you can do it with or without cookies. How is it typically done without cookies then? > any probabilistic approach is either relatively inaccurate reduces it's usefulness for this use case, or accurate which raises the same identifiability concerns cookies would introduce How so? Even if it's accurate you wouldn't be storing anything the information (random id or fingerprint) for the individual user, so you would only be able to answer with reasonable certainty whether you saw the user before or not. You can't identify anyone from that (other than identify them as a new vs returning user) so there is no identifiability concern, unless of course one thinks that constitutes a concern in itself which I don't think the GDPR does.
    - remon 2y ago
      Maybe we're disconnecting. Cookies are just a standardised way to communicate a small key/value set between client/browser and server through HTTP headers. It's not inherently (in)secure, sensitive, etc. There are zero things you can do with cookies that you cannot do without and there are no inherent differences in security, they're just very convenient if you're in HTTP world. And yes what you said is exactly right; you're allowed to fingerprint a unique user and track data with that fingerprint as the sole unique identifier without any PII legislation (GDPR, CCPA, etc.) compliance issues. You just cannot store any information that allows linking PII data to that fingerprint in either direction. In other words, attribution to a random UUID that just happens to represent an anonymous user is not an issue. Circling back to the original comment; there is no (good) argument against cookies if you're basically doing exactly what cookies are doing. Umami using it as a USP is, at best, a little odd.
      - pbowyer 2y ago
        > you're allowed to fingerprint a unique user and track data with that fingerprint as the sole unique identifier without any PII legislation (GDPR, CCPA, etc.) compliance issues. That is not true. E.g. 1. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/ https://ico.org.uk/about-the-ico/media-centre/news-and-blogs... 2. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr... specifically https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-storage-and-access-technologies/#device_fingerprinting https://ico.org.uk/for-organisations/direct-marketing-and-pr... This is for the UK, I am not up to date with other European regulators.
      - alkonaut 2y ago
        As far as I'm aware, any online identifier, even a random number created by me, falls under the GDPR. This answer lays it out pretty well https://law.stackexchange.com/questions/82133/are-auto-generated-identifiers-pii-if-they-cannot-be-linked-to-an-identity https://law.stackexchange.com/questions/82133/are-auto-gener...

gbalduzzi 2y ago

I don't know about Umami, Plausible describes how they solved this here: https://plausible.io/data-policy https://plausible.io/data-policy, under the section "How we count unique users without cookies" TL;DR: They derive an identifier from IP address and User Agent using an hash, allowing them to have a tracking identifier without storing Personal identifiers (the IP address)

illusive4080 2y ago
This seems like a worse approach to me than a cookie. My IP and UA don’t change, pretty much ever. I can delete a cookie anytime I want.
- alkonaut 2y ago
  They salt the values and compute id = hash(daily_salt + IP + UA). Then they remove those every 24 hours. I think it sounds like a perfectly reasonable solution.
  - AznHisoka 2y ago
    If they remove those every 24 hours, then doesn’t that mean if I made two visits, separated by more than 24 hrs, it would count as 2 unique visits rather than 1?
    - ksec 2y ago
      Yes. I am still not aware how to track returning visitors if while still staying within some privacy framework. Unfortunately on HN the default answer is to say not to track at all.
      - account42 2y ago
        You mean fortunately? Because that's the only correct answer.
youngtaff 2y ago

maccard 2y ago

A user resettable cookie _is_ the privacy friendly way of doing it.