4 ms·

If you are advocating for European products, I would expect you to use Plausible or similar products instead of Google Analytics. This would allow you to avoid

If you are advocating for European products, I would expect you to use Plausible or similar products instead of Google Analytics. This would allow you to avoid displaying the cookie banner.

robin_reala 2y ago
Only if you’re not using cookies for anything else.
- holowoodman 2y ago
  Wrong. Functionally necessary cookies like login or shopping cart cookies need no banners.
  - dvh 2y ago
    $ wget -qO - https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... | pdftotext - - | grep -i banner | wc -l 0
    - pjc50 2y ago
      That says nothing useful. The legislation refuses to be specific and you have to know what all the relevant ICO decisions are, which is why compliance is so frustratingly vague.
      - SSLy 2y ago
        you can just not track the users, that might be easier.
    - hyperbrainer 2y ago
      You really think law would be such a highly sought-after and highly-compensated field if it was that easy?
      - sam_lowry_ 2y ago
        It should be easy.
        hyperbrainer 2y ago
        The law is written to prevent loopholes and exploits -- an extremely hard task, given the number of people willing to break it for even the slightest profits. The sheer number of these "false exits", that, then need to be covered, makes making reading and interpreting the law a hard endeavor. And a very precise one. It could be easier by some fraction, but never anywhere near easy.
      - Asraelite 2y ago
        There are competing incentives. Governments/politicians want to make it easy for companies to comply in order to encourage economic investment, and also to gain goodwill among their voters. Legal institutions want to make things appear as complicated and uncertain as possible so that they make more money selling lawyers. The end result is that you get mixed messages, depending on where the information ultimately came from. I personally don't know how hard it actually is to comply with GDPR, but I know that it has to be easier than it's made out to be.
      - kergonath 2y ago
        That’s cynical and edgy, but misses the mark. There are several reasons why rules tend to be more specific about the outcomes than the ways to get there. This decreases the attack surface for loopholes. What is desirable is the end result, not the technical details. The law is actually clearer because the intent is clearly spelt out. The point of the law is to protect privacy, not cover every screen with cookies banners. This leaves room for different implementations and flexibility (yay, competition). It makes the law more resilient, because it does not need to be re-engineered every time anything happens. 10 years from now, even if cookies and banners have completely vanished, the core of the law will still be relevant. This is why debates about the spirit and the letter of laws translate poorly across the Atlantic. Different places have different approaches.
        2y ago
    - 8organicbits 2y ago
      It doesn't mention "banner" because it doesn't prescribe the exact user interface. But people seeking to comply often choose the banner as a solution.
    - Mordisquitos 2y ago
      Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; Point (a) covers purposes that require cookie-banner. Point (b) covers login or shopping cart cookies, as these are necessary for the performance of a contract to which the data subject is party.
      - holowoodman 2y ago
        Also relevant to cookies, ePrivacy directive Article 5 (3): Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
    - m_mueller 2y ago
      absence of evidence != evidence of absence
  - robin_reala 2y ago
    Right, yes, I was thinking about advertising cookies and additional functionality but you are of course correct for those examples.
hans_castorp 2y ago
There are other listings like that, e.g.: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv...
risyachka 2y ago
They are used for different things. If you are doing paid marketing or other more or less complex marketing Plausible doesn’t cut it.
- mertbio 2y ago
  Could you be more specific? As far as I know, they have bunch of features like funnels, goals, revenue attributions etc.: https://plausible.io/docs/top-referrers https://plausible.io/docs/top-referrers
  - risyachka 2y ago
    When doing paid marketing you need to track users as hard as you can otherwise you have no clue which ads work and which don’t, what are profit margins etc. With GA, google uses cookies, fingerprinting and all other possible options to track correct attribution from various channels. So even with ad blockers you can get a pretty accurate picture. It is also tightly integrated with google ads. Plausible can tell you what users do inside your app. But honestly this is so basic you can pretty much build same functionality with a few sql queries.
birjolaxew 2y ago
> This would allow you to avoid displaying the cookie banner. That isn't actually true (or at least is only allowed in the "it's a small enough violation of the law that the enforcers have bigger fish to fry" sense). Cookie banners are required to gather informed consent, which is relevant for two EU legislations: the ePD, which requires it to access or store _any_ data from terminal equipment, and the GDPR which requires it for personally identifiable data. Most people only consider the latter, but the former is a much bigger hurdle to pass. Despite Plausible's claim of not requiring cookie banners, their processing still accesses data from the terminal equipment. That was made very explicitly clear in a 2023 guideline from the EDPB[1]. The one saving grace for Plausible is that the ePD is a Directive, so the actual implementation into law differs by Member country. The claim might be true for some EU countries, but certainly isn't for all. I've written a longer analysis of this in the context of Plausible for anyone interested[2] (although it might be worth skipping the first section, to get to the meat of the issue). [1] https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en https://www.edpb.europa.eu/our-work-tools/our-documents/guid... [2] https://jfagerberg.me/blog/2022-06-09-analytics-cookie-compliance/ https://jfagerberg.me/blog/2022-06-09-analytics-cookie-compl...
- rustc 2y ago
  > Despite Plausible's claim of not requiring cookie banners, their processing still accesses data from the terminal equipment. Since Plausible is selling a product that clearly claims this, who is on the hook in case a user of Plausible gets a fine?
  - jeroenhd 2y ago
    The user can always sue Plausible for lying about their product to get their damages back. In the end, the user of these services is responsible for maintaining the privacy of their customers/visitors.
  - Xelbair 2y ago
    I'm not a lawyer but Company using Plausible gets fined, but then they can sue Plausible. most likely. But GDPR enforcement is more like 'you need to fix this, if you don't you get the fine' - if you are actually helpful and do your duty to improve the process the fine is usually reduced.
zkid18 2y ago
folks mess "cookie banner" with "consent banner". many people do conflate them, but in some jurisdictions (e.g., the EU under GDPR), a "cookie banner" typically includes a consent mechanism. if you're tracking users for analytics using cookies, fingerprinting, or any other method that identifies them (even probabilistically), you generally need explicit consent under GDPR and similar privacy laws. The key point is that it's not just about cookies; any persistent tracking requires consent.
- shadowgovt 2y ago
  It was an interesting day when EU legislators made our Apache access logs questionably-legal.
- dumbledoren 2y ago
  > The key point is that it's not just about cookies; any persistent tracking requires consent. The law mandates that you inform the user if you are setting any type of cookies. So its necessary to have a banner even if you don't need to get consent. You could inform the user in other ways, but cookie banners are easier.

If you are advocating for European products, I would expect you to use Plausible or similar products instead of Google Analytics. This would allow you to avoid displaying the cookie banner.

robin_reala 2y ago

Only if you’re not using cookies for anything else.

holowoodman 2y ago
Wrong. Functionally necessary cookies like login or shopping cart cookies need no banners.
- dvh 2y ago
  $ wget -qO - https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... | pdftotext - - | grep -i banner | wc -l 0
  - pjc50 2y ago
    That says nothing useful. The legislation refuses to be specific and you have to know what all the relevant ICO decisions are, which is why compliance is so frustratingly vague.
    - SSLy 2y ago
      you can just not track the users, that might be easier.
  - hyperbrainer 2y ago
    You really think law would be such a highly sought-after and highly-compensated field if it was that easy?
    - sam_lowry_ 2y ago
      It should be easy.
      - hyperbrainer 2y ago
        The law is written to prevent loopholes and exploits -- an extremely hard task, given the number of people willing to break it for even the slightest profits. The sheer number of these "false exits", that, then need to be covered, makes making reading and interpreting the law a hard endeavor. And a very precise one. It could be easier by some fraction, but never anywhere near easy.
    - Asraelite 2y ago
      There are competing incentives. Governments/politicians want to make it easy for companies to comply in order to encourage economic investment, and also to gain goodwill among their voters. Legal institutions want to make things appear as complicated and uncertain as possible so that they make more money selling lawyers. The end result is that you get mixed messages, depending on where the information ultimately came from. I personally don't know how hard it actually is to comply with GDPR, but I know that it has to be easier than it's made out to be.
    - kergonath 2y ago
      That’s cynical and edgy, but misses the mark. There are several reasons why rules tend to be more specific about the outcomes than the ways to get there. This decreases the attack surface for loopholes. What is desirable is the end result, not the technical details. The law is actually clearer because the intent is clearly spelt out. The point of the law is to protect privacy, not cover every screen with cookies banners. This leaves room for different implementations and flexibility (yay, competition). It makes the law more resilient, because it does not need to be re-engineered every time anything happens. 10 years from now, even if cookies and banners have completely vanished, the core of the law will still be relevant. This is why debates about the spirit and the letter of laws translate poorly across the Atlantic. Different places have different approaches.
      - 2y ago
  - 8organicbits 2y ago
    It doesn't mention "banner" because it doesn't prescribe the exact user interface. But people seeking to comply often choose the banner as a solution.
  - Mordisquitos 2y ago
    Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; Point (a) covers purposes that require cookie-banner. Point (b) covers login or shopping cart cookies, as these are necessary for the performance of a contract to which the data subject is party.
    - holowoodman 2y ago
      Also relevant to cookies, ePrivacy directive Article 5 (3): Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
  - m_mueller 2y ago
    absence of evidence != evidence of absence
- robin_reala 2y ago
  Right, yes, I was thinking about advertising cookies and additional functionality but you are of course correct for those examples.

hans_castorp 2y ago

There are other listings like that, e.g.: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv...

risyachka 2y ago

They are used for different things. If you are doing paid marketing or other more or less complex marketing Plausible doesn’t cut it.

mertbio 2y ago
Could you be more specific? As far as I know, they have bunch of features like funnels, goals, revenue attributions etc.: https://plausible.io/docs/top-referrers https://plausible.io/docs/top-referrers
- risyachka 2y ago
  When doing paid marketing you need to track users as hard as you can otherwise you have no clue which ads work and which don’t, what are profit margins etc. With GA, google uses cookies, fingerprinting and all other possible options to track correct attribution from various channels. So even with ad blockers you can get a pretty accurate picture. It is also tightly integrated with google ads. Plausible can tell you what users do inside your app. But honestly this is so basic you can pretty much build same functionality with a few sql queries.

birjolaxew 2y ago

> This would allow you to avoid displaying the cookie banner. That isn't actually true (or at least is only allowed in the "it's a small enough violation of the law that the enforcers have bigger fish to fry" sense). Cookie banners are required to gather informed consent, which is relevant for two EU legislations: the ePD, which requires it to access or store _any_ data from terminal equipment, and the GDPR which requires it for personally identifiable data. Most people only consider the latter, but the former is a much bigger hurdle to pass. Despite Plausible's claim of not requiring cookie banners, their processing still accesses data from the terminal equipment. That was made very explicitly clear in a 2023 guideline from the EDPB[1]. The one saving grace for Plausible is that the ePD is a Directive, so the actual implementation into law differs by Member country. The claim might be true for some EU countries, but certainly isn't for all. I've written a longer analysis of this in the context of Plausible for anyone interested[2] (although it might be worth skipping the first section, to get to the meat of the issue). [1] https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en https://www.edpb.europa.eu/our-work-tools/our-documents/guid... [2] https://jfagerberg.me/blog/2022-06-09-analytics-cookie-compliance/ https://jfagerberg.me/blog/2022-06-09-analytics-cookie-compl...

rustc 2y ago
> Despite Plausible's claim of not requiring cookie banners, their processing still accesses data from the terminal equipment. Since Plausible is selling a product that clearly claims this, who is on the hook in case a user of Plausible gets a fine?
- jeroenhd 2y ago
  The user can always sue Plausible for lying about their product to get their damages back. In the end, the user of these services is responsible for maintaining the privacy of their customers/visitors.
- Xelbair 2y ago
  I'm not a lawyer but Company using Plausible gets fined, but then they can sue Plausible. most likely. But GDPR enforcement is more like 'you need to fix this, if you don't you get the fine' - if you are actually helpful and do your duty to improve the process the fine is usually reduced.

zkid18 2y ago

folks mess "cookie banner" with "consent banner". many people do conflate them, but in some jurisdictions (e.g., the EU under GDPR), a "cookie banner" typically includes a consent mechanism. if you're tracking users for analytics using cookies, fingerprinting, or any other method that identifies them (even probabilistically), you generally need explicit consent under GDPR and similar privacy laws. The key point is that it's not just about cookies; any persistent tracking requires consent.

shadowgovt 2y ago
It was an interesting day when EU legislators made our Apache access logs questionably-legal.
dumbledoren 2y ago
> The key point is that it's not just about cookies; any persistent tracking requires consent. The law mandates that you inform the user if you are setting any type of cookies. So its necessary to have a banner even if you don't need to get consent. You could inform the user in other ways, but cookie banners are easier.