4 ms·

Because she’s using local storage…? If you don’t use cookies, you don’t need a banner. 5D chess move.

by reactordev 1y ago

amelius 1y ago
Sounds to me like a loophole in the law then. Which would be surprising too since not easy to overlook.
- reactordev 1y ago
  It’s not a loophole. localStorage is just that, local. Nothing is shared. No thing is “tracked” beyond your site preferences for reading on that machine. I say it’s a perfect application of how to keep session data without keeping session data on the server, which is where GDPR fails. It assumes cookies. It assumes a server. It assumes that you give a crap about the contents of said cookie data. In this case, no. Blast it away, the site still works fine (albeit with the default theme). This. Is. Perfect.
  - 0x073 1y ago
    Gdpr don't assumes cookies, if you misuse local storage you also need confirmation.
    - reactordev 1y ago
      only if you are storing personal information. Email, Name, unique ID. Something as simple as "blue" doesn't qualify.
      - dkersten 1y ago
        Correct. But you can also use cookies for that, without violating GDPR or the ePrivacy directive.
        reactordev 1y ago
        Then you have the problem of some users blocking cookies at the browser level. LocalStorage is perfect application for this use case.
        account42 1y ago
        Or maybe you could respect those user's preferences of not having shit stored for your website.
  - dkersten 1y ago
    > which is where GDPR fails. It assumes cookies. It does not assume anything. GDPR is technology agnostic. GDPR only talks about consent for data being processed, where 'processing' is defined as: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (From Article 4.2) The only place cookies are mentioned is as one example, in recital 30: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
    - reactordev 1y ago
      >GDPR only talks about consent for personal data being processed Emphasis, mine. You are correct. For personal data. This is not personal data. It’s a site preference that isn’t personal other than you like dark mode or not.
      - dkersten 1y ago
        I was responding to this bit: > It assumes cookies. It assumes a server.
  - sensanaty 1y ago
    > It assumes cookies. How can people still be this misinformed about GDPR and the ePrivacy law? It's been years, and on this very website I see this exact interaction where someone is misinterpreting GDPR and gets corrected constantly.
- alternatex 1y ago
  LocalStorage is per host though. You can't track people using LocalStorage, right?
  - reactordev 1y ago
    LocalStorage is per client, per host. You generally can't track people using LocalStorage without some server or database on the other side to synchronize the different client hosts. GDPR rules are around personal preference tracking, tracking, not site settings (though it's grey whether a theme preference is a personal one or a site one).
    - root_axis 1y ago
      > though it's grey whether a theme preference is a personal one or a site one In this case it's not grey since the information stored can't possibly be used to identify particular users or sessions.
- dkersten 1y ago
  The law is very clear, if you actually read it. It doesn't care what technology you use: cookies, localstorage, machine fingerprints, something else. It doesn't care. It cares about collecting, storing, tracking, and sharing user data. You can use cookies, or local storage, or anything you like when its not being used to track the user (eg for settings), without asking for consent.
roywashere 1y ago
That is not how it works. The ‘cookie law’ is not about the cookies, it is about tracking. You can store data in cookies or in local storage just fine, for instance for a language switcher or a theme setting like here without the need for a cookie banner. But if you do it for ads and tracking, then this does require consent and thus a ‘cookie banner’. The storage medium is not a factor.
root_axis 1y ago
There's no distinction between localstorage and cookies with respect to the law, what matters is how it is used. For something like user preferences (like the case with this blog) localstorage and cookies are both fine. If something in localstorage were used to track a user, then it would require consent.

Because she’s using local storage…? If you don’t use cookies, you don’t need a banner. 5D chess move.

amelius 1y ago

Sounds to me like a loophole in the law then. Which would be surprising too since not easy to overlook.

reactordev 1y ago
It’s not a loophole. localStorage is just that, local. Nothing is shared. No thing is “tracked” beyond your site preferences for reading on that machine. I say it’s a perfect application of how to keep session data without keeping session data on the server, which is where GDPR fails. It assumes cookies. It assumes a server. It assumes that you give a crap about the contents of said cookie data. In this case, no. Blast it away, the site still works fine (albeit with the default theme). This. Is. Perfect.
- 0x073 1y ago
  Gdpr don't assumes cookies, if you misuse local storage you also need confirmation.
  - reactordev 1y ago
    only if you are storing personal information. Email, Name, unique ID. Something as simple as "blue" doesn't qualify.
    - dkersten 1y ago
      Correct. But you can also use cookies for that, without violating GDPR or the ePrivacy directive.
      - reactordev 1y ago
        Then you have the problem of some users blocking cookies at the browser level. LocalStorage is perfect application for this use case.
        account42 1y ago
        Or maybe you could respect those user's preferences of not having shit stored for your website.
- dkersten 1y ago
  > which is where GDPR fails. It assumes cookies. It does not assume anything. GDPR is technology agnostic. GDPR only talks about consent for data being processed, where 'processing' is defined as: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (From Article 4.2) The only place cookies are mentioned is as one example, in recital 30: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
  - reactordev 1y ago
    >GDPR only talks about consent for personal data being processed Emphasis, mine. You are correct. For personal data. This is not personal data. It’s a site preference that isn’t personal other than you like dark mode or not.
    - dkersten 1y ago
      I was responding to this bit: > It assumes cookies. It assumes a server.
- sensanaty 1y ago
  > It assumes cookies. How can people still be this misinformed about GDPR and the ePrivacy law? It's been years, and on this very website I see this exact interaction where someone is misinterpreting GDPR and gets corrected constantly.
alternatex 1y ago
LocalStorage is per host though. You can't track people using LocalStorage, right?
- reactordev 1y ago
  LocalStorage is per client, per host. You generally can't track people using LocalStorage without some server or database on the other side to synchronize the different client hosts. GDPR rules are around personal preference tracking, tracking, not site settings (though it's grey whether a theme preference is a personal one or a site one).
  - root_axis 1y ago
    > though it's grey whether a theme preference is a personal one or a site one In this case it's not grey since the information stored can't possibly be used to identify particular users or sessions.
dkersten 1y ago
The law is very clear, if you actually read it. It doesn't care what technology you use: cookies, localstorage, machine fingerprints, something else. It doesn't care. It cares about collecting, storing, tracking, and sharing user data. You can use cookies, or local storage, or anything you like when its not being used to track the user (eg for settings), without asking for consent.

roywashere 1y ago

That is not how it works. The ‘cookie law’ is not about the cookies, it is about tracking. You can store data in cookies or in local storage just fine, for instance for a language switcher or a theme setting like here without the need for a cookie banner. But if you do it for ads and tracking, then this does require consent and thus a ‘cookie banner’. The storage medium is not a factor.

root_axis 1y ago

There's no distinction between localstorage and cookies with respect to the law, what matters is how it is used. For something like user preferences (like the case with this blog) localstorage and cookies are both fine. If something in localstorage were used to track a user, then it would require consent.