Hacker News Reader

Comment by fanf2 | Hacker News Reader

I am confused. What do you mean by “browser URL”? Do you mean the URL of the page that the user accessed? How is that not essential? How is it specific to the user’s device?

View on HN

Yes: the location information on the browser. You cannot access it for non-essential purposes without user consent. See Article 5 / Statement 3 in the ePrivacy directive[1]

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

The browser sends the URL to the server to download the page so you can’t avoid receiving the URL before receiving consent from the user. You get to see the URL without accessing the user’s device.

Your citation does not mention URLs or clarify why they might be non-essential.

ePrivacy talks about "information stored in the terminal equipment", which includes any information you can get from the device. For example the user agent, location, and operating system. It's not about the information itself being essential or not, but what you do with it: is it for essential purposes (consent not needed) or non-essential purposes (consent needed).

An example:

If you're using it to display a page (say: React Router), then it's essential functionality.

If you're using the URL to propagate a unique hash between pages that is used to identify the user for marketing purposes, then it requires consent.

Ah, this would make sense. They mean if I put data in the url and retrieve it from there. www.example.com/search?q=abcd would be fine in that interpretation.

Reply on news.ycombinator.com