Comment by GordonS | Hacker News Reader

Comment by GordonS | Hacker News Reader

Parent Full thread

> We're not ignoring the guidance, it's just such a grey area when it comes to PECR / ePrivacy. Even the ICO's guidance, it talks about "cookie-like" technology. Our technology isn't cookie-like. And our processing isn't cookie-like either. We've had lawyers look at our documentation and all of them have said it's a grey area.

That sounds like you are trying to pick and choose the bits you want to hear :)

There have been several ammendments since the original ePrivacy guidance. There is at least one such directive that is very explicit about fingerprinting specifically. If doesn't use ambiguous language, it states clearly that consent is required for fingerprinting.

As I said, I personally think it's just bonkers, and I think your service is absolutely in the spirit of the ePrivacy rules. But you can't say the rules on fingerprinting are not clear.

I'm keen to see what you've got coming, as the only way I see to avoid consent is not to associate identifiers with users at all - so each page hit would be a completely independent object. Can you say anything about your plans here?

Like I say, we've had lawyers review our docs. Even the term "fingerprinting" has more nuance to it. Fingerprinting is used as a way to attempt to set a permanent cookie / identify an individual, and their actions. We don't do this.

And we definitely agree that it's bonkers.

I can't say anything here until we've got our press release out.

> Like I say, we've had lawyers review our docs. Even the term "fingerprinting" has more nuance to it. Fingerprinting is used as a way to attempt to set a permanent cookie / identify an individual, and their actions. We don't do this.

Ouch, I kind of wish you hadn't said that, because it sounds like you're straying dangerously close into weasel words and deliberately incorrectly interpretations. Sorry if that sounds harsh, but what I've read is very clear.

As before I like your solution, and I think it's absolutely in the spirit of privacy. But the guidance is really clear here, and gives examples of fingerprinting. Nobody said a fingerprint has to be a permanent identifier; as far as I recall, Fathom does use fingerprinting to identify individuals, so that a sequence of page views can be attributed to a single visitor. I understand that those fingerprints include a timestamp, and so are only valid for some time (2 hours, or whatever it is).

Thanks for your input here, Gordon. It doesn't sound harsh at all, you clearly care about privacy regulations and you're trying to help. Ultimately, we had moved based on conversations with lawyers. But as I say, we are rolling out changes this week & next, so it doesn't matter what we think about the regulation :) And thanks again for the challenge.

Thanks for the debate, and I'll be looking out for what you've got coming next!

Reply on news.ycombinator.com