4 ms·

Session cookies do not require a banner.

tempestn 2mo ago
Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
- tappio 2mo ago
  There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
  - tempestn 2mo ago
    My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
    - jason_oster 2mo ago
      It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
      - ApolloFortyNine 2mo ago
        How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
        literallywho 2mo ago
        >How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
        tappio 2mo ago
        That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, recognizing users across days requires consent. But is that really necessary?
        anonreplier 2mo ago
        In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
        inigyou 2mo ago
        Or use some JS to put the time-on-page in the next request, right? Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
    - micromacrofoot 2mo ago
      that's not true at all, plausible can be configured to require 0 consent
- preg_match 2mo ago
  You don't need cookies for basic aggregated analytics. Now if you want to track and record mouse movement, you do, and that's a privacy concern. The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.
  - TurdF3rguson 2mo ago
    Actually you can't send any cookie that is not essential to the operation of the website without consent and that would include analytics regardless of PII. same for pixel tracking / fingerprinting, it's all a no-no.
    - inigyou 2mo ago
      There's "legitimate business interest" which I think is a catch-all for things you want to do as long as they don't invade privacy?
      - TurdF3rguson 2mo ago
        Most of those things involve tracking users I imagine but if there's any that don't, go for it.
  - evcaldera 2mo ago
    You need cookies if you simply want to run conversion analytics or any kind of performance marketing for media/ecommerce.
    - preg_match 2mo ago
      Sure, and you can use cookies! Just not to store PII. Ultimately these things are actually optional - I don’t have a cookie banner on my site. Neither does my company I work for, because it’s an application.
- yjftsjthsd-h 2mo ago
  > Aggregated analytics do, Good. > and you can't run a serious website without some kind of analytics. I don't believe you. > Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved. IANAL, but I'm given to understand that this is untrue.
  - tempestn 2mo ago
    You're right about explicitly set preferences. What do you see as the harm in website owners using aggregated analytics data to improve their sites?
    - yjftsjthsd-h 2mo ago
      Abstract: It's still spying on users. Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.
      - tempestn 2mo ago
        The practical argument I can understand. From the abstract argument though, it sounds like you'd be opposed even if the anonymization could be guaranteed, which I don't understand. Why is it "spying" to try to understand in aggregate how users are using your website? How are you supposed to eg. identify usability problems without this information? And what is the harm to users? (Again, in the abstract case where we leave aside any possibility of individual users being identified.)
        micromacrofoot 2mo ago
        because no one has shown an anonymization guarantee yet

Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.

tappio 2mo ago
There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
- tempestn 2mo ago
  My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
  - jason_oster 2mo ago
    It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
    - ApolloFortyNine 2mo ago
      How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
      - literallywho 2mo ago
        >How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
      - tappio 2mo ago
        That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, recognizing users across days requires consent. But is that really necessary?
        anonreplier 2mo ago
        In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
        inigyou 2mo ago
        Or use some JS to put the time-on-page in the next request, right? Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
  - micromacrofoot 2mo ago
    that's not true at all, plausible can be configured to require 0 consent
preg_match 2mo ago
You don't need cookies for basic aggregated analytics. Now if you want to track and record mouse movement, you do, and that's a privacy concern. The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.
- TurdF3rguson 2mo ago
  Actually you can't send any cookie that is not essential to the operation of the website without consent and that would include analytics regardless of PII. same for pixel tracking / fingerprinting, it's all a no-no.
  - inigyou 2mo ago
    There's "legitimate business interest" which I think is a catch-all for things you want to do as long as they don't invade privacy?
    - TurdF3rguson 2mo ago
      Most of those things involve tracking users I imagine but if there's any that don't, go for it.
- evcaldera 2mo ago
  You need cookies if you simply want to run conversion analytics or any kind of performance marketing for media/ecommerce.
  - preg_match 2mo ago
    Sure, and you can use cookies! Just not to store PII. Ultimately these things are actually optional - I don’t have a cookie banner on my site. Neither does my company I work for, because it’s an application.
yjftsjthsd-h 2mo ago
> Aggregated analytics do, Good. > and you can't run a serious website without some kind of analytics. I don't believe you. > Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved. IANAL, but I'm given to understand that this is untrue.
- tempestn 2mo ago
  You're right about explicitly set preferences. What do you see as the harm in website owners using aggregated analytics data to improve their sites?
  - yjftsjthsd-h 2mo ago
    Abstract: It's still spying on users. Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.
    - tempestn 2mo ago
      The practical argument I can understand. From the abstract argument though, it sounds like you'd be opposed even if the anonymization could be guaranteed, which I don't understand. Why is it "spying" to try to understand in aggregate how users are using your website? How are you supposed to eg. identify usability problems without this information? And what is the harm to users? (Again, in the abstract case where we leave aside any possibility of individual users being identified.)
      - micromacrofoot 2mo ago
        because no one has shown an anonymization guarantee yet