No Cookie for You
github.blog
github.blog
I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture.
I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties.
Presumably Microsoft has access to those metrics, though? I wonder how deeply that gets parsed in conjunction with everything else they collect.
If only you could export some of that culture back to your corporate overlord. I'd love if MS Teams stopped exploding it's RAM usage until it eventually has to be killed if it's unable to get an OK response from its analytics endpoint.
And I'd love to turn off analytics in Windows altogether. Even getting to the minimal analytic configuration is an exercise in futility spread out across a million different settings, some of which decide to reset themselves in obfuscated ways sometimes. eg, some think updates reset them, either directly or by doing things like changing default programs to ones which require analytics (eg Office). Or a change to one setting requires additional changes elsewhere to be effective.
Just like they have an excuse for allowing the NSA direct access to all of your data, right?
You disagree with your own government that's perfectly fine, and for the record I agree with you on the issues themselves, but if you want embargoes against Iran to be lifted or for the NSA to stop hoarding Americans' data you have to do the boring work of convincing the people to vote for people who share those ideas.
Real change will not come from corporations, it simply cannot because their mission if profitability, they support movements if there is no financial risk to do so.
See my comment below for details: https://news.ycombinator.com/item?id=25458635
Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request.
Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side.
We have no visibility into how they associate this data with analytics data collected on the server-side, and that's where an updated privacy policy would also help.
[1] https://docs.github.com/en/free-pro-team@latest/github/site-...
That's pretty much true. And why shouldn't a group try to limit their liability?
>"I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy."
That's often, but not always true. For example, here's a [sanitized] privacy policy I wrote for a website I set up for a specific (noncommercial) purpose:
"[Site] Privacy Policy
No personal information^ will be stored on the https://www.[site] web server (except as specifically authorized), and every effort will be made to protect the integrity and privacy of such information.
[Site], its management or assignees will never sell personal information collected on this site, nor will they use such information for purposes other than specifically related to the operation of the [Site] website and/or to facilitate the dissemination of information regarding [purpose of site] and other group activities related to [potential users] and other [user purpose] related group activities.
Under no circumstances will street address or telephone number information be stored on the www.[site] by [Site], its management or assignees.
[Site], its management and assignees will never, under any circumstances reveal email addresses, street addresses and/or telephone numbers to anyone without explicit authorization. From time to time, [site] may offer services to allow [potential users] to contact each other. For these services, [Site], its management and assignees makes no warrantee of fitness for any purpose, including maintaining the privacy of users' personal information.
All personal information will be held in confidence and will only used for the purposes of the [potential users] [purpose of site] and official [membership organization] business.
This business includes (but is not limited to) providing personal information for inclusion (by the [membership organization]) in a printed work to be published at a later date. If this published work is then used for illegal and/or nuisance purposes, [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose.
If a subscriber (limited to members of the [potential users]) chooses to share their personal information with other subscribers via any mechanism made available through the [Site] web site, mailing list or other conveyance provided by [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose.
Under no circumstances will [Site], its management or assignees be liable or otherwise legally responsible for the theft, misuse or other unauthorized use of personal information.
Any person or entity registering on, providing contact information, or subscribing to the [Site] web site explicitly agrees to all the terms of this privacy policy.
This policy applies to the www.[Site] web site and the [Purpose of site]@[Site] mailing list.
If any portion of this policy is found, by any competent jurisdiction, to be invalid or unlawful, the remainder of this policy will continue to be in force.
The terms of this policy may be modified at any time at the discretion of [Site]. It is the responsibility of the subscriber to review the terms of this policy on a regular basis. Current versions of this policy can be found at https://www.[site]/privacy.html.
^Personal Information: Data such as street address, email address and telephone number which would enable direct contact with the subject of that information."
It does two specific things:
1. Informs users how their PII will (and will not) be used;
2. Clarifies the liability of those who own/run the site.
Unlike most "privacy" policies, there's nothing underhanded or privacy invading/data stealing involved.
I wish more privacy policies were like that.
When it's unethical to do so :)
... unrelated to your privacy policy btw, which I think is pretty good.
GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint.
GitHub's claims about not tracking users are false, they do identify users in tracking requests. See this tracking URL, it's full of unique identifiers and personal data, and it is currently sent after every page load, without user consent:
https://collector.githubapp.com/github/page_view?dimensions[page]=https://github.com/&dimensions[title]
=GitHub&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[user_agent]=Mozilla/5.0
(X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0&dimensions[screen_resolution]=1000x518&dimensions[pixel_ratio]
=1&dimensions[browser_resolution]=1000x518&dimensions[tz_seconds]=0&dimensions[timestamp]
=1608247177900&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[request_id]=
9CF8:4938:4516EA:5FD134:5FDBE77E&dimensions[visitor_id]=6475638196559144773&
dimensions[region_edge]=fra&dimensions[region_render]=iad&&measures[performance_timing]=
1---600-600-600-400-400-----600-0----1608247177200--1608247176900--1608247176900--400-
400&&dimensions[actor_id]=47727044&dimensions[actor_login]=dessantbot&dimensions[actor_hash]=
a274a9ae03a3b361483e273a53aba70534c609670c058fe667d8bce4d6f33bad&dimensions[cid]=1507727009.1608247109
The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.
the law is simple to break and appear as if you're not. they're a big company and will have this covered if needed
the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
That's not how informed consent works, you can't just mention the collection of personal data in a privacy policy. Consent must be explicitly requested for this type of tracking, and you must be able to reject it, and continue using the service.
> the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
The request can be blocked with uBlock Origin, but it's still important to draw attention to tracking that may be illegal, since not everyone has a content blocker installed.
you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise
This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
from my understanding of the rules even a lot of the informed consent popups today aren't compliant.
If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out.
IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.
also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include:
-Using tracking/advertising cookies"
this document may help you understand the difference between should and must: https://www.ietf.org/rfc/rfc2119.txt
And there is no room for ambiguity in the actual law:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%...
> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
of course not, it was an example to demonstrate the difference and easier to include one link for both definitions than e.g. two for each from a dictionary
> Never mind the difference between "should" and "must"
given the context I believe the difference is of paramount importance
> do you understand the difference between an RFC and the law?
slightly reworded first question but yes, I do, thanks
> And there is no room for ambiguity in the actual law: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%...
that seems a good example for a better source which actually bolsters my point on bad sources, but alas, it's irrelevant. note that it refers to personal data and not (third time lucky) the original argument concerning tracking consent. in fact, I cannot even find any personal data in the OP's URL, probably because no personal data is required to create a GitHub account. let's just ignore that one for now
Not being able to get implicit consent by hiding some terms in a long legal document is the entire fucking point of the GDPR.
Consent is a voluntary action. Usage itself is a form of consent. However a user disagreeing with what the company requires to provide that service but still being entitled to and actively using that service is not workable. User can decide to stop using a service entirely though, if they don't agree with the requirements.
That's meaningless. Usage is already a form of consent. The discrepancy is between the user and the company in what is consented. Forcing the company to provide service to the user even if the user disagrees with an upfront description of what the company requires to provide that service is a completely valid objection.
Also GDPR applies to any organization providing to citizens of the EU, not companies operating there, but that's yet another example of poor design which results in GDPR having little enforcement.
nobody because they are pretty much meaningless in the EU
we got laws to protect consumers, not laws for businesses to trick users into making some meaningless gesture
> the bottom line is, do you place more trust in your local lawmakers and the website you are visiting than you do in yourself
what do you mean by "local lawmakers"? these laws are EU-wide. or did you mean "local" to mean, "non-US"
anyway, these lawmakers are fighting the shitty corporations that pull this tracking stuff
and your bottom line is not really a choice one way or the other. I can use blockers and other plugins to protect myself, AND cheer on the people fighting the fuckfaces that think it's in any way honourable to make a profit by merely following the letter of our laws
but we got some really good consumer protections in the EU. and we try to keep it that way. we're not going to simply roll over because some US corporations are used to being able to track the hell out of US customers
It does though make tracking by third parties so they can sell things to me (or sell information about me to other parties for that use) more difficult. Not impossible though, of course.
Except the GDPR and cookie directive, obviously, undeniably, unmistakably, weren't intended to give websites a "bad UX" obstacle to work around.
It's not even about cookies. It's about letting users AGREE to being tracked and then track them, OR (with the same amount of effort and without denying them service vs tracked people) DISAGREE and then not track them.
If they're still tracking me and keeping data about me that they can match to the PI that is my github account, then this "no cookie" thing is just more "letter of the law" bullshit.
I think it's pretty damn clear to Github and MS what the intention of these EU laws are. They can't just say "oh it's worded in a way that gives us wiggle room, so fuck your intentions". Well they can but they'll find out whose faces they told "fuck your intentions" to.
We're trying to protect consumers from tracking bullshit, here. Not throwing up obstacles for large corporations to work around.
They say no "non-essential" cookies, but an anonymous user just landing on the homepage gets a cookie with some unique-looking tokens.
I've seen many companies just hire the right lawyers that would sign off on all sorts of tracking cookies as "yeah, this is essential, since we can't track users without it, and tracking users is essential to our business model".
This is true to every advertiser or data seller, Including obvious ones like Google, FB, Amazon... and less obvious ones like your ISP, Apple, etc.
The industry call it persistent ID (as opposed to cookie, which are transient ID): https://digiday.com/marketing/wtf-persistent-id/ (random result, i do not endorse it)
The trick is: the publisher/intermediary have even more information about you, but they call you User-A instead of your name, so they can sell your history, zip, DNA, etc... just pretend not labeling the data with your name or some other personal identifiable information already listed in a Law somewhere makes everything fine.
There's no specific list of information regarded as PII, it's PII if it can be used to identify the user, even if only in combination of the other PII.
The GDPR is really quite broad there, other laws may be more lenient. However, the GDPR is not yet very strictly enforced or tested in court.
fortunately, "undermining the spirit of the law in order to continue to make a profit" is generally frowned upon in the EU, and lawmakers don't take too kindly to it. sometimes I get the feeling that in the US it's almost acceptable to publicly brag about doing this, like it's even more "socially" acceptable.
I see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property.
What's the problem you have with that?
It's perfectly possible for GitHub to process personal information without explicit consent while not violating the GDPR. Several options come to mind:
1) consider analytics part of the "contract legal" basis, arguing that analytics to improve the usability of the website is a fundamental part of running a website.
2) The "legitimate interest" lawful basis, which states:
> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Arguing that improving the accessibility/usability is in the legitimate interest of both company and user.
I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.
I believe they must also show that they don't store this data strictly longer than necessary.
Which, in the case of analytics/usability would mean aggregating (and thus depersonalising) the data almost immediately.
And if they do that, it will indeed be fine. Both with the letter, as the spirit of the law.
I might 1‰ buy that if they restored the Widevine repos they snuck down for Google under cover of the controversy caused by complying with the MS-funded RIAA’s quasi-legal youtube-dl takedown request.
Hi everyone, thanks for all the enthusiasm about this change. We are happy to have removed cookie banners from GitHub, and not to participate in third-party tracking of user behavior.
Our privacy policies and subprocessor list will be updated next week following our customary 30 day user notice period. We do this in the open in a pull request, so you can see the changes now:
Why is it not GDPR compliant. You do not need consent under the GDPR. You need a (documented) "lawful basis for processing" personal information. Consent is just one of several lawful bases and honestly it's the most useless one, if you need consent your business model is screwed. It's perfectly possible for GitHub to process personal information without explicit consent while not violating the GDPR. Several options come to mind:
1) consider analytics part of the "contract legal" basis, arguing that analytics to improve the usability of the website is a fundamental part of running a website.
2) The "legitimate interest" lawful basis, which states:
> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Arguing that improving the accessibility/usability is in the legitimate interest of both company and user.
I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.
Sure, you can argue that, but it has no merit.
The only reason that you can write that sentence with a straight face is due to the current affairs of the web. You know the thing that GDPR tries to rectify.
And analytics do not need personally identifiable information.
Try the three-part test suggested here: https://ico.org.uk/for-organisations/guide-to-data-protectio...
Purpose test: You can argue it has legitimate interest. And with a big enough loop-hole it might even pass despite it having no merit.
Necessity test: Absolutely not.
Balancing test: No chance.
I'm a regular visitor to GitHub from the EU, most of the time not logged in and in private browsing mode, so I usually appear like a completely new entity that hasn't consented to anything. I only started noticing cookie banners on GitHub in the last month or two.
So... in the past, did you not have cookie banners because you didn't have tracking cookies until recently, and all this is a big publicity stunt? Or were you breaking the law up until a month or two ago by having tracking cookies but not asking for my consent?
The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com.
The privacy policy page which lists third party data subprocessors and cookies used on GitHub [1] seems to be outdated. Does the announced change also mean that Google Analytics and other subprocessors have been eliminated, or has some of the tracking merely moved server-side?
[1] https://docs.github.com/en/free-pro-team@latest/github/site-...
But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwise - then the score is down to D-. The intent of EU cookie regulation is to make tracking and data collection transparent and opt in. Changing the implementation to server side might comply with the letter of the law but it violates the spirit.
It would be good if GitHub would clarify their position.
Then recently they have introduced a consent popup, which was actually one of the most refreshing cookie consent popups I have ever seen: it contained two buttons, Accept and Reject. This popup has now been removed.
I think a lot of developers may have clicked on Reject, though removing tracking cookies will not absolve GitHub of the requirement to continue asking for informed and free consent under GDPR, if they will continue to process personal data, and share it with third-party services from their servers.
The current website code points to the same data still being sent to GitHub, only the implementation has changed.
GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.
You also should be trying to scrub IP adresses from those logs as that counts as PII.
That counts as personal data.
The GDPR doesn't care about "PII", as that is a US legal term and not something defined or references in EU law.
You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means.
Rationale:
1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I don't know CCPA well enough to comment.
2. The sub-processors statement [2] says this includes Google (and Google Analytics specifically), LinkedIn and Eloqua (marketing analytics firm) among others.
3. Cookies and - possibly? - other client-side technologies are only used for running and improving the service. Justification: Line 238 in the privacy statement. (There's a typo in there btw: "complie" should be "compile" I think).
3. You respect DNT - line 244. Which, presumably, means you do not track user behaviour on any sites other than github? i.e. those in which you are a 3rd party.
4. However, the privacy statement line 31 [1] states: "GitHub may also collect User Personal Information from third parties." Interpretation: whilst you're not collecting 3rd party personal information using cookies, you are (or "may") do so through other means.
[0]: https://github.com/github/site-policy/pull/336/commits/fe1b6...
--
EDIT: clarified GDPR point.
[1]: https://github.com/github/site-policy/pull/336/commits/79a99...
[2]: https://github.com/github/site-policy/pull/336/commits/e98e3...
I believe this is actually fine if they can show they don't hold this data longer than necessary and have a process for destroying it in a timely fashion.
But IANAL either
In case of Youtube there is a no-cookie domain that can be used for embedding and then, while client still sends the request to them, no additional cookie is set.
Removing Google Analytics is a good thing, thanks for that. I also appreciate that you use DoNotTrack to give users a choice (even if this is not available on Safari any more).
As it is explained the privacy policy. Basically you now use the same cookie "_octo" both for session management and first part tracking: https://github.com/github/site-policy/pull/336/files#diff-8b...
EU guidelines require that you offer granularity of choice for different “processing purposes”. See in this "Guidelines on consent under Regulation 2016/679" https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
In section "3.1.3 Granularity" paragraph #44. "If the controller has conflated several purposes for processing and has not attempted to seek separate consent for each purpose, there is a lack of freedom. [...] When data processing is done in pursuit of several purposes, the solution to comply with the conditions for valid consent lies in granularity, i.e. the separation of these purposes and obtaining consent for each purpose"
You grouped cookies together and removed granularity of choice. I think this is against the spirit of the regulation.
Overall I think the the change is positive, but grouping cookies to avoid a banner is still against the regulation.
I've had clients straight up demand I should add an ugly cookie warning to the beautiful site I spent a month designing "because it's the law". Then, when I asked them to provide a full privacy policy to go with it, I've often gotten the response to "just leave it empty, nobody actually reads that". Thankfully, I'm stubborn enough to have always been successful in convincing them that maaaybe they should listen to the person who does this stff for a living and not a sensationalist Medium article...
There could be a standard header such as cookie-privacy-policy which would point to url containing the policy in standadrd format (html?) and the browser could show it in standard way (by user's settings). Personally I would be happy with just a little "privacy policy" icon in url bar, similar to https lock icon and reader view icon (in Safari).
There is also `Do Not Track` header but it is not respected by most of websites.
You can also reject all cookies in any web browser, but then majority of web pages will not work properly.
The naivety of this approach almost makes me laugh. I mean, it's good intention, but really we cannot just trust the "bad" party. Active client-side measures are needed (e.g. as Safari does).
So I get a lot of cookie policy banners and I always click the full 'accept all' option because at best it'll just eat into their database storage and I'll arrive with no stored cookies the next time I visit the site.
The browser allows me to accept all cookies or non-third-party cookies automatically but I still get these stupid cookie policy banners that cover half the screen at the worst.
I'd really like a standardized way to accept all cookie policies with no questions asked.
(And, for the matter, something that automatically says 'no' each and every time a site decides that the best first thing to do is to ask me to give some feedback of the site before I've even used the said site.)
Also, having too many extensions slows down the browser (because they need to parse/manipulate DOM) and extensions themselves are also a security/privacy risk and finding the good ones for every browser can be tedious.
Besides, my mom has no idea what's "a browser extension".
Most people just need one extension: uBlock Origin (or built-in Opera/Brave adblock) with a filter list from prebake.eu. No more ads and cookie banners. Easy as that.
www.google.com###lb
www.google.com##html:style(overflow-y: visible !important;)Under GDPR, this requires a clear, unambiguous consent, freely given. How can you understand what you consent to if you blanket-accept everything? And thus the consent is invalid. And they need a new banner.
They're not allowed to make it harder to withdraw consent than to give it.
I've also found, on the few times I humoured their "consent" system, found that each of these "tracking providers" (?) needed to make a request to a different domain to withdraw consent, and some of them simply wouldn't load.
That's basically what happens in private mode (incognito), I guess. Would be nice if browsers used private mode by default, and you could "whitelist" certain sites you trust / want to remember your login.
Just sell your product instead of wasting time and money on bike shedding your website with whatever you believe is going to "skyrocket your sales".
E.g. I've started using Fathom [1]. It's very basic, but for the sites I use it on all I really want to know is if traffic is going up or down or if any specific pages are suddenly getting lots of traffic.
Looks like they're only targeting large websites. I've never build a 100k/month traffic website, just lots of (maybe 300+) mom and pop websites.
Wish there was a $12/yr plan for websites that are lucky to get 500 visits a month.
But I agree, it'd be nice with a smaller option.
> Avoid having to put annoying EU cookie consent dialogs on your website with one weird trick: > Don't use cookies on your website.
> If you want users to be able to sign in to access your premium paywalled/onlyfans content, put that on a subdomain that has cookies and requires login.
> (yes this isn't applicable to all websites with cookies; it's just a nice idea worth considering)
=> https://pleroma.envs.net/notice/A1sZxGnSQ2Oi0oWMy0 originally written here
One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio's location settings. If it is truly unmasking people's location I think it should be opt-in only, since it is private information. An employer or state may have issues with someone opening a PR from a specific country at a specific time, for example.
[0] It may be required to open this in an incognito browser.
The users might not know it's being used for marketing on the home page, but it seems to be (again, just spot-tested) information that they provided for their /public/ profile.
Edit: NEVERMIND! Just checked a fourth and code from someone with "United States" in their profile showed as coming from Minneapolis.
If anyone wants to do any further analytics on it, it's easy enough to pull PRs and lat/lon from that.
It does look like lat/lon might be a fixed value for each city (from spot checking a couple). If it's not, that would be surprising and a pretty egregious leak of user info.
Just don't include facebook like buttons or any of these widgets
(I had to do it here too.)
But note there are other reasons you can have for collecting data other than consent (something often overlooked) - for example I would guess GitHub would log IP addresses in the back end for a limited time for spam fighting reasons, and I think that would be fine.
I agree with you by the way, but ...
On my personal web sites I'm using GoAccess, which is basically a new spin on a very old idea -- just analyzing the server's web logs.
That's not as accurate as throwing around cookies and JavaScript, but I rarely check the log pages anyway, and when I do I'm less interested in raw numbers than I am in the relative performance of various pages. (And that's mostly just idle curiosity, e.g., are there some old articles that keep getting steady traffic from somewhere?)
I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day."
But where is that ID stored?
The salt must be treated like a password to make sure it's not that easy to brute force it and no one should get access to your database of course ;) It's not the strongest anonymization, but good enough considering that the hits will be deleted once a day by batch processing.
> So if you don’t use cookies how do you count the number of website visitors and report on metrics such as the number of unique users?
> Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies.
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. This generates a random string of letters and numbers that is used to calculate unique visitor numbers for the day. Old salts are deleted to avoid the possibility of linking visitor information from one day to the next. We never store IP addresses in our database or logs.
...
> In our testing, using IP addresses to count visitors is remarkably accurate when compared to using a cookie. Total unique visitor counts were within 10% error range with IP-based counting usually showing lower numbers.
From here: https://plausible.io/blog/google-analytics-cookies#can-you-g...
Mine gives one public ipv4 per device that access the internet on the network (with some exceptions). Strategies varies but if you have a lot of addresses why not use them.
I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing stuff into the ether.
and it wasn't even running on wordpress
you'll need a cookie banner then
These third parties will take what you give them and _also_ take what they can get from your browser if you're embedding their script. Are you going to proxy those scripts as well to stop them getting the user's IP address and then geolocating it to grab even more info?
The cookie warning banner is bullshit only in the sense that it achieves nothing. Accept it or deny it, it won't change a thing. Same with the tracking consent popups: despite the law saying they should be opt-in by default, they're still treated as opt-out by default, meaning that all of these sites _still_ collect your data because you're blacklisting individual sites from tracking, as opposed to whitelisting them. You need to set a cookie to say that you don't want tracking and not thousands of cookies to say you do want it?
That's being tracked... it's all wrong. Literally everything you offer as information, or don't offer, is another node in their graph.
WTF is that...
Completely at odds with the whole "informed consent" thing.
That seems to be the advice of the UK ICO: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
Analytics cookies are not strictly necessary.
Alternatively your pagecount will shoot to the millions if you have someone holding f5.
> I currently don't know whether anyone is looking at it
You don't need tracking cookies to track simple metrics like pageview numbers.
So yes, use of tracking cookies, first or third party, would require a Cookie Consent Banner.
Seems like a cool company/project to me.
But, it's not free :( $19/mo Still thought it's worth pointing out.
It is self-hosted but on firebase and taking advantage of the free tier. Of course there is no personal data collected at any point.
There are still improvement to do, but as it works perfectly for me I have not be able to gather enough motivation to do that.
Panelbear is privacy-friendly, and has a free plan with 5,000 page views per month. Commercial use is allowed.
Full-disclosure: I’m running this service. Feel free to ask me anything :)
Thank you for providing this service.
I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I'd be interested to hear what others think.
If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn't need consent.
In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.
I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.
I don’t believe that one should automatically conclude that just because a cookie requires active consent, any kind of ‘logging’ (local and temporary storage of IPs in order to track website usage) requires active consent. Those are two fundamentally different things.
I’m not saying you should hide the fact that you’re doing it. I’m saying it should be stated in the privacy policy.
Also remember that there is a big difference between ‘personally identifiable information’ and ‘sensitive information’ which are clearly separated concepts in GDPR. Not all collection of data requires active consent.
I did read my EU state’s guideline on GDPR in full, but I’m not an expert. I would suggest reading up on the ePrivacy Directive though, which is still in effect.
However regardless of whether you're using cookies, I still think you need to collect explicit consent as GDPR requires a lawful basis of processing, and I don't see how analytics would fall under any of the other lawful basis's other than consent (_maybe_ legitimate interests?)
If you are using cookies, then my understanding is you need to collect consent where necessary under _both_ ePrivacy and GDPR.
Only if there is a bijection between the identifier and the IP address, so that you could re-derive the IP address from the identifier. Otherwise, I do not see how the identifier itself would count as PII.
This way of divorcing data from PII by replacing it with pseudonymous identifiers which cannot be linked back is a relatively standard technique for this.
The GDPR does not count anything as "Personally Identifiable Information", which isn't surprising as that's a US legal term.
What you mean is "Personal Data", and yes IP addresses are considered personal data under the GDPR.
>so deriving an identifier from this for a use case such as analytics would likely require consent.
Consent isn't the only legal basis for processing personal data, though, there are 5 others available.
Not that I am pro-privacy invasion, I'm not, but I'm definitely anti-annoying-popups.
Do you have an authoritative source which i can show our team regarding this?
Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively)
Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”"
Through non compliance can only be enforced if the entity behind the website/app or similar does enter the EU or does business with the EU.
The practical question is just if they can get hold of the people acting unlawfully.
Which means that you can't say a user is not residing in the EU (without a popup asking the user if they are residing there... ;=) ).
On the other hand if there would be such a law it would have kinda interesting consequences.
https://www.independent.co.uk/life-style/gadgets-and-tech/fa...
Once the UK leaves the EU, they're no longer obliged to keep their implementation of the GDPR. The government can choose to keep their implementation, and in practice keep the same regulations as the GDPR, or they could reduce or remove their privacy protection laws as they see fit.
With London being famous for their camera surveillance, I expect the UK to reduce some if not all of the privacy protections the GDPR brought to the world.
It became UK law as soon as it was passed by the EU, and it didn't need to be implemented in to UK law.
The UK has already passed their amendments to the GDPR,[0] which will effectively fork it into the "UK GDPR". These will come in to force on the 1st of January.
There's a "Keeling Schedule" available[1], which is effectively a diff between the EU GDPR and the UK GDPR.
[0] https://www.legislation.gov.uk/uksi/2019/419/introduction/ma...
[1] https://assets.publishing.service.gov.uk/government/uploads/...
It's related to the ePrivacy Directive, which is deeply intertwined with GDPR but a separate piece of legislation. It's not clear whether the GDPR's territorial applicability also holds for ePD. France in particular is drawing a divide between GDPR and ePD, because ePD lets them fine Google directly but GDPR require they mediate through the Irish DPA.
It's also not entirely correct that the GDPR would require going through the Irish DPA or wherever a company in violation has their primary EU presence for tax purposes. True, the GDPR says the nation where a company has the primary presence of business within the EU take lead within the EU should take lead, but the French courts figured out that Google's Irish subsidy is actually not making any decisions, the US parent is, and therefore it's fine for the French watchdog to issue fines skipping Ireland [1].
[1] https://techcrunch.com/2020/06/19/french-court-slaps-down-go...
GDPR does not supercede the ePD. The ePD is, according to its own text, a law that extends the general privacy regulations to certain aspects of internet technology. So in many cases it defers out to the general privacy law in effect.
When ePD was passed, that law was the DPD, Data Privacy Directive. When GDPR was passed, all ePD references to the DPD became references to GDPR instead (this is Article 94 of GDPR). But ePD remains entirely in effect, just with updated references.
Most importantly, ePD requires Consent in certain cases, but defers to DPD/GDPR for what is the definition of consent. GDPR's definition of consent is much more stringent.
In cases where the ePD did not refer out to DPD, it remains unchanged by the passage of GDPR. So, according to CNIL, it does not include the one-stop-shop mechanism. See section "The competence of the CNIL" in the link below:
https://www.cnil.fr/en/cookies-financial-penalties-60-millio...
The EU law:
- doesn't require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it's tracking people in any way are such opt-ins needed
- if you login you are known to have accepted the terms of service and as such after login no opt-in pop-up is needed either
- is not limited to cookies btw.
All in all this means that for any site not based on ad-revenue they fully can get away without needing any annoying popups, if they don't do some sneaky questionable things.
Even for ad's there are ways to do them without annoying popups, you just need to not track people, tracking the number of times a website was loaded doesn't require annoying popups, just tracking who opened it does.
Similar if you track people only after they clicked on the ad you don't need annoying popups on the site the add is one but only on the site the app navigates to (through only start tracking after opt-in). Which given that many adds try to sell you stuff and buying thinks only requires a account isn't that big of a problem as it might seem.
In the end you can say the only reason there are so many annoying popups is because most companies have not intention to respect the privacy of their users. Actually if you look into it and realize that many popups are not legally conform or borderline illegal it becomes clear that they do not only not respect the users privacy but the users themself.
Through I have to note, that while many (most?) companies can switch to respectable advertisement, some companies can't as easily do so.
Apologies if I've misunderstood your claim here but it seems to me that you are saying you can bury consent to processing inside your legalise.
That doesn't comply with the GDPR as I understand it; the consent must be informed and freely given. Informed in that case is debatable since you are lumping a lot of terms together. You certainly can't claim it's freely given if accepting the terms of service is not optional.
But I still believe you can do it once on account creation and then never again if people are logged in and nothing changed.
It's the popups that actually annoy me, especially because they keep on popping up -- ironically they need to store a cookie to remember that the user has accepted/denied, and my cookie-blocking blocks that cookie as well.
I think browsers blocking cookies by default and asking for permission before storing cookies is a better solution to this issue than a GDPR popups all over the web, and leaves far less room for malicious websites to track you in spite of the user denying.
It's a common misconception that it's about cookies. It's about data processing, i.e. tracking. There is a different law then GDPR which is about storing data on user PC's but that is also not about cookies but about any browser storage and more or less got superseded(1) by GDPR.
(1): Ok, that is quite a oversimplification, but most popups are now about GDPR and having them also covers the other law.
The problem is the "only" part(s) ;=)
Oh, and you must reasonable convey that DDoS protection is essential for your service etc. Which if you ever had any (non super small) DDoS attack should be reasonable easy.
But I'm no lawyer and a bit of time passed since I last looked into it, so if I now would need to do a cooperate decision I would look it up again.
By law it's default opt out for non-essential usages specifically to deal with people who are annoyed, but not everyone plays by the rules.
They want you to have a bad experience if you decide to opt-out of detailed behavioural tracking, so that you'll feel pressured to "consent" to detailed behavioural tracking, and so you'll feel like the GDPR is to blame, even though it isn't.
I've put "consent" in quotes because it's not freely given consent if you are heavily pressured into it, and it's not consent at all if you end up believing you don't really have a choice.
These banners/dialogs do not even comply with the GDPR (despite saying the GDPR requires them), as GDPR says consent to non-essential personal data collection about you must be as easy to withdraw as it is to give, and the service you get must be the same if you don't consent as if you do.
I wrote a bit more about this here: https://news.ycombinator.com/item?id=25441131
More importantly IMO they are also contacting entities up front to tell them about violations and how to get compliant, the fines we have seen yet seems (again IMO) to be only for particularly nasty cases and/or cases where the entities in question refuses to change.
This means the fines we are seeing is just the top of the iceberg: most changes happens underneath the surface and only trickles up in the form of less annoying websites (or fines) little by little.
You have to love how the regulator did not even try to define what they mean by "annoying". Thus making the whole law completely useless.
In my book, any single pixel of my limited screen real estate that gets dedicated to this useless regulation is annoying. If the EU wants to enforce this, they need to provide a way for me to basically say "Yes, I agree with all tracking cookies for all sites forever", and never see a banner again.
>>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services.
But you’re still only allowed to use the cookies for the purpose the user gave you them for, right?
So, if:
a) the cookies are essential for the user session, and
b) you collect the cookies, without explicit permission, to maintain that session
then you still can’t use those cookies for other purposes, like analytics, right?
Edit: sorry for all the “rights?”, just want to make clear I don’t convey high confidence in this claim.
The reason I find that believable is that their core business is selling a git server with bells and whistles. From Microsoft's perspective, Github doesn't need to be doing any marketing because they kind of are the marketing.
I would be really, really surprised if Github were the only Bay Area unicorn that lacked a product manager nagging them for more analytics. The fact that they don't need to sell the analytics is irrelevant.
I do believe Github is legitimately trying not to use that data for analytics. But whether some PM in there is querying that data for analytics purposes: at that point we're just speculating based on how cynical you or I want to be. I don't think that's a meaningful point.
Also: I'm not saying I don't think they do analytics. I'm saying I don't think they are using users' personal data for analytics. That's an important difference with respect to GDPR.
1. GDPR requires the consent check to be somewhere obvious and in plain language. That was specifically to deal with EULA's given to you in tiny legally compliant text boxes.
2. GDPR requires that you cannot make consent for non-essential usages of data mandatory as a condition for providing your services. Tracking only logged-in people for analytics falls into the category of non-essential purposes. That requires explicit consent, even if consent is not required to use the exact same data for authentication checks.
1. Consent must be separate from other terms being agreed to. So consent in the EULA would not be valid.
2. Consent must be an affirmative, unambiguous action. Pre-ticked boxes or bundled consent are not valid.
3. Consent can be revoked at any time. Revoking consent must be as easy as giving it.
So yes, you can ask for it from a user when you're having them agree to the EULA. However you can't have it as part of the EULA, it has to be an optional add-on. And you still need to let people turn it off afterwards.
Not even then - there are plenty of analytics you can do without a cookie banner, as long as they don't identify the user.
Conversely, anything you do other than your obvious business requirements (e.g. if you buy something physical I need some address or identity to verify at pickup) requires consent whether or not it's analytics.
(Not a lawyer, not legal advice, jesus just don't track people...)
The difference is if you can deny access for those opting out or not.
Yes. It’s not the cookies, it’s what you make the use of them.
The wording even predates GDPR. You could even dispense of the banner if you had DNT set to 1 or 0, since that would count as consent/not consent resp.
Because I can’t imagine that they don’t.
You can anonymize data if you really want to and use it for understanding trends, usage etc in a privacy respectful way. Few companies bother these days though. And yes if you want a 100% watertight way, it’s hard.
Another question is how exactly can Github be trusted to not send this tracking to Microsoft? It's not like this is something that we can check... I don't think that the EU is going to send inspectors to Microsoft?
Then I realized I should probably clear all the cookies for Github, and start over with a fresh session. So I deleted all cookies that Github had given me (which was 12) and refreshed the page. As expected, I was now logged out and Github immediately issued you me 4 new cookies.
• _gh_sess (a fresh session cookie)
• _octo (not sure what this is, might have something to do with cache-busting? Looks like it contains something resembling a version id/string)
• logged_in (my logged in status, now false)
• tz (my timezone)
So then I logged in. I now have 10 cookies. None of them appear to be tracking cookies.
• __Host-user_session_same_site (14 day session token)
• device_id (this contains a random string to differentiate this device. Initially I was concerned with this, thinking it might be a fingerprint. But it is far too short for that, and it appears to be a flash cookie. It expires as soon as it is issued, so it only lasts one request. This is likely used to improve your experience in the case that you are logged in across multiple devices to differentiate which device is making a request within the current session)
• gh_sess (same as before, session)
• _octo (same as before, presumably cache-busting)
• dotcom_user (contains a string with my github username)
• has_recent_activity (boolean value, likely used to display "unseen notifications" on the front-end)
• logged_in (same as before, except now true)
• tz (same as before, timezone for frontend time displays)
• tz (now have 2 timezone cookies. Both are currently the same timezone, although I assume the first one is a timezone gathered from my system clock and the new one is a timezone gathered from my github settings which they now have since I logged in. This is probably a bug where they expect to overwrite the first one, but since one is set to the github.com domain and the other is set to all github subdomains then it didn't overwrite)
• user_session (yet another session token with 14 day expiration. However the session token in this cookie and the __Host-user_session_same_site cookie are the same. Not sure reason for the duplication)
At the beginning I mentioned that I had two tracking cookies before I cleared my cookies. These are gone after the refresh. So it looks like github has in fact stopped issuing tracking cookies altogether. They also seem to have removed Google Analytics entirely as I don't see the script on their website at all.
So all-in-all this definitely checks out. I don't see any GDPR violations here or reason to display a cookie banner anymore.
I assume they still have analytics, but the analytics are all happening server-side which provides them basics like pageviews and visitors. And since you have to be logged in to do almost anything in github they don't need cookies to track what you do while logged in, thats all going through their servers and databases anyway.
I know plenty of people here have problems with Github, but I think it is exciting to see a large company like Github (Microsoft) take this step.
Considering Microsoft's size, wouldn't this still be a concern, and might even still violate GDPR if they were to use identifiers like IP or Microsoft accounts between their various services ?
For an even more extreme version: see Google or Amazon (AWS).
I dropped all third-party crap from my site way back and haven't ever needed a cookie banner.
The question is not "how long". The question is what data, and what happens to it.
It doesn't matter how long it's active either, unless you use it to track users activity elsewhere
However, as you say, it might be allowed by GDPR without requesting extra approval, depending on the way that it's being used and who it is shared with?
Hence my question about whether the length of time that you store this data legally matters (because since databases can be stolen, it eventually does). Compare with how ISPs must store all your connection logs for a specific amount of time.
Length of time you store the data doesn't matter, except in the sense where you can prove that effectively you do not store it at all - for example by anonymization of logs so that you do not effectively store IP addresses, even if of course they have to exist in full in the system at some point to keep the connection open.
You're serving articles, there's no reason for session tracking!
https://ec.europa.eu/justice/article-29/documentation/opinio...
(The §29 WP is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Maybe they are waiting for a forthcoming ePrivacy Regulation. Also: IANAL.)
A lot of people also have the misconception that the EU cookie law applies to them, even if they are not in the EU and have no EU physical presence.
If so, why did everyone scramble to meet the requirements. Was it a scam?
If you're small enough, then the EU won't bother doing anything.
If you don't even depend on any 3rd party that is vulnerable to EU will then you can fully ignore everything. That can be tricky to achieve though. No common money transfer methods and you must be self-hosting.
Also, all of this isn't new. The US has been enforcing its will globally in a similar fashion for a long time.
Technically, the law applies to everyone worldwide, regardless of location. However, if you have no business in the EU and don't plan to expand your current business operations to the EU, you don't need to worry.
Hell, if you don't meet the requirements, the relevant enforcement departments generally give you plenty time to implement the necessary requirements or block access if you're a dick. The exception, of course, is data brokers and huge companies like Facebook or Google where the impact is much larger.
The GDPR doesn't expose you to lawsuits from anyone but the privacy monitoring instances of EU member states. The average American blog or news site isn't nearly large enough for any government instance to start a lawsuit.
You can also ask yourself: so what if they fine my company a €10.000. They're not going to send a team of special forces over the Atlantic or through Russia just to extract the cash from you. You only need to pay the fine if your company ever needs to do business in the EU. If your company structure makes your personally liable, this also impacts your future holiday destination decisions, but you can live perfectly fine without seeing the Eiffel tower.
A lot of very similar laws are also being passed in California right now, which will probably be a lot more dangerous than any GDPR restriction, but if you follow the GDPR you're pretty much set to protect yourself from Californian lawsuits as well.
Most of the GDPR is just "don't be a dick with people's data". If the fear of not meeting requirements stops the free-for-all data exchange market, then I'm perfectly fine with that.
That doesn't mean that you're necessarily at risk of any lawsuits or effective action, but what you're stating is wrong. Physical presence has nothing to do with it.
With exception of large, international organizations, that doesn't apply to nearly all business outside the EU.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
>When the regulation does not apply
>Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
"In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."
EU laws simply do not apply to the world, even if the EU thinks they should.
Perhaps not, but the EU is the world's second-largest economy (only $2tn behind the US and $4tn ahead of China) accounting for about 1/5th of the global economy.
If one wants to operate a company that does international business, one will probably want to do business in the EU, which means following EU law in such matters.
And github wants us to look at them with big eyes who amazing they are.
There should have never been any other cookies first hand.
The end.
"The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."
—Another fake quote
Google being the biggest ad company does not give them the right to surveil all that walks the earth.
If that would be the case, maybe more sites would follow GitHub here.
And then Facebook takes out full-page ads attacking your company for allegedly hurting "small business."
Why not just let browsers controls who sets what cookies?
I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups?
Then browser vendors can ship a delete all non same origin cookies on tab close or something.
isn't that the 'allow 3rd party cookies' setting ?
At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that this is compliant with the law.
It failed horribly because it was voluntary. But now that it's a GDPR requirement, perhaps that might have a snowball's chance in hell of succeeding.
What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.
[0] https://ico.org.uk/action-weve-taken/enforcement/?facet_type...
https://www.openrightsgroup.org/blog/parliament-must-hold-th...
They also had a massive budget shortfall which meant they sent out what amounted to a protection racket letters demanding £40 per year from every UK business, even though almost none of those businesses should be paying it.
All this while simultaneously investigating the ad industry, finding it is egregiously breaking the law, but then doing nothing about it.
The UK's ICO is taking an extremely broad definition of who should be paying it, but an extremely narrow definition of who it should enforce against.
I might add that the £40 it is demanding is almost 3 times the normal £15 yearly fee for running a business in the UK.
Everything outside that field cannot, I guess, be considered as legitimate interest.
They have small print after each of their emails that says that GDPR allows them to email me because they believe I might be legitimately interested in purchasing their services.
Sharing is caring.
Does this mean that sites that offer free but ad-supported content still have to offer that content? So I can watch those free Youtube movies and listen to those Spotify tracks ad-free because EU Law says fuck you.
How is this fair?
Edit: Okay, okay, non-targeted (and no 3rd party) ads are okay, got it xD
The fact that spotify doesn't want to because it's less profitable is where EU law says fuck you.
Also Spotify can easily require a free login and associate everything with that, no tracking cookies required. They just can’t associate your playlist with your web browsing habits.
Tracking is not necessary to show ads. Certainly there are business models which depend on this, but hey who says our society benefits from those? Targeted advertisement and free informed democracies don't mix well IMO.
As in, this is the first GDPR banner I've seen that is actually legal under the GDPR.
1-click to opt-in.
multi-click and losing your current page to opt-out.
There's so much more pressing than just cookies imo.
The very long and well-sourced wikipedia article doesn't even contain the word "cookie": https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
This if from article 7 of the GDPR [0]. Clearly the situation described involves a much harder time withdrawing consent than giving it - which goes against the law.
I may have misunderstood what you meant but how is this being laser focused on cookies? This articles applies beyond the Internet anyway.
[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
One of the most precious things we have is time and the constant cookie interruptions are a nuisance that should be kept from sight.
I would like to store a cookie or a client-side cert to remain logged in, but not the other cr. Granted, they could use that cookie to track me, but this is what GDPR is about.
IIRC, Internet explorer used to ask you for each cookie, circa 2000. These pop-ups became more and more common with time. The web would be unusable with those nowadays.
That doesn't prevent Facebook or Twitter or advertisers in general from tracking you across dozens of pages or more, it just means that they'll have to issue you a new cookie each session.
1. A law that aims to prevent stealing should be deterring thieves, not just regulating padlocks.
2. Technical measures are insufficient because cookies are regulated by purpose. A third-party cookie for fraud detection is allowed; a first-party cookie for analytics requires consent. It also prevents using necessary cookies for secondary purposes, something that literally cannot be accomplished through technical means alone.
As a minor point, the so-called "cookie law" also regulates browser fingerprinting. I have a hard time imagining that you could legislatively mandate effective anti-fingerprinting approaches.
Browsers wouldn’t fall for dark patterns.
Because it doesn't have anything to do with cookies. You don't need a banner if you use CSRF cookies, you don't need a banner if you use them for stuff like CloudFlare's anti-DDoS script, and you certainly don't need a banner if your site requires cookies for basic functionality like logging in.
The browser can't possibly tell what the server is doing with its cookies. It might even be using a single cookie as CSRF protection and ad tracking at the same time.
This is actually the case, what do you mean? All browsers that I know of (firefox, chrome, elinks) allow the user to control what to do with cookies.
what I wanted to say is that cookies are not illegal by gdpr means and gdpr does not make a lot of stuff illegal, it's just that SAVING personal information or information that could identify somebody needs explicit permission.
edit: another thing ip addresses, by german law you are required to save it, when a user can register on your site and your site allows users to submit data. because authorities force you to give them out when a user did something illegal. (§ 7 Abs.1 Satz1 Nr.4 TKÜV, https://www.gesetze-im-internet.de/tk_v_2005/__7.html) In germany it's basically: fuck the privacy if they harmed our law! or at least you need a way to "activate" saving ip addresses.
of course that is forbidden. and that's exactly why it is really hard to tell if companies honor it.
Is disabling it there globally æquivalent to not accepting on such banners?
This is also why the GDPR requires consent forms instead of relying on browser cookie settings, as it covers the intent of tracking itself as opposed to any technical means by which it is achieved (and this is why functional cookies such as for logging in or shopping carts don’t actually need consent at all).
They talk about cookies, and little more.
The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.
Some sites don't even give you a "Disagree." Liberty of London has no way to opt-out: "By closing this box or by clicking accept and close, you agree to our use of cookies."
1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests.
2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling;
3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70);
4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism.
Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...
on mobile so can’t easily post links unfortunately. EDIT: here’s a couple of links
https://noyb.eu/en/noyb-files-complaints-against-apples-trac...
https://blog.gingerlime.com/2020/does-ios-14-protect-your-pr...
"We're not going to lie to you. Your privacy isn't our priority. It's not even close. Not because we want to track your every move. But because we simply don't care. We'd rather spend what limited time we have actually improving the web site. We're into taking pictures and adding content, not obsessing over what your dog had for lunch so we can sell it to MegaEnormousBigCo. We're not tracking you. We're not tabulating you. We're not folding, spindling, or mutilating you. Seriously, your personal life is not important to us. However, you may or may not be of interest to the people who advertise on this web site."
Here's the other perspective: Data brokers don't really want your data if you don't want them to have it. It's a legal liability for them, and most of them are struggling to work at the scale their customers demand already. But publishers want high advertising rates and that means advertisers want to make good bids and that means both actually want a data broker involved to deal with the technical (collection, filtering, aggregation, ETL) and legal (GDPR) bullshit.
But then publishers and advertisers don't do their due diligence or decent engineering and just shovel illegal shit to data brokers on the backend. The ones that shut up and launder it do well; the ones that actually try to do a good (technical, legal) job drown in account management and data processing overhead.
So fuck that site. They are the ones that care about your data, they're just making a show of keeping their hands clean while they pay someone else for the dirty work and hiding behind their (half willful half stupid) ignorance of how their own industry works.
GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.
Luckily where I work we are pretty serious about this stuff. Since one of our main revenue's is Data protection consulting, anything else would be idiotic anyway
If you block ad networks and analytics the site functions just fine -- they're not essential.
Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.
I love those systems. Especially when the unwary users share links, accidentally letting other users into the site as them. Or when google indexes it, and in addition to terrible security, the site uses regular GET links to perform site actions, so google deletes the user's content or buys a bunch of stuff as them while walking the links it finds as it indexes in beyond the user's initial account bearing link.
lol. no.
It also poses a security / opsec issue if anyone non-technical wants to send a link to a friend / co-worker. You may compromise yourself.
If people share their screen people would be able to hijack the session too.
You won't be able to distinguish device sessions from one another reliably neither. Think of "log out all other devices".
These are what I can think of. There's probably a handful more reasona NOT to do that.
You could, I think. Passing the session ID in the URL is the same as storing it as a cookie. You can invalidate both in the server.
Link sharing is an issue, for sure. You could tie the session id to the IP, but that doesn't work when people share their IP, which is more and more common every day. IP tied session would work better with IPv6, though.
The problem is it’s makes urls horribly unwieldy if a user wants to bookmark or paste in links from emails etc etc, or writing JS to interact with links, not to mention the security issues of being able to accidentally share your session.
Possibly, yes, but not at all user friendly.
Note GDPR never mentions cookies, or cookie banners. It regulates the control and processing of personal information (which can be stored in cookies).
https://gdpr.algolia.com/gdpr-article-6
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
This is not legal language or legal advice, but the gist of it is "if you don't have it, can your website still do what it claims to do?"
For a site like Github, if you can't use cookies to maintain session state, you'd have trouble implementing login sessions, so that's pretty squarely on the essential side of the fence.
But moving into murkier territory, how about logging the IP addresses you signed in from? If you're using it to detect new login locations or new devices as a security alerting thing, then I think you can make a strong enough claim that this is essential. (Again, not a lawyer, this is not legal advice.)
What if a PM wants to look in these logs for how many unique users show up in each country? That's pretty squarely on the side of analytics, and is probably not essential.
But... muddying the waters more, what about if an engineer wants to query unique users to figure out how many more racks of servers to buy? I have no idea. I'd be asking a lawyer.
- Any form of tracking people is generally non-essential.
What you can and can't do is not based on technical implementation details but practical usage of the information!!
The tricky part if when both overlap, i.e. if you track people but only for assuring a secure operation, i.e. you don't use the tracking information for anything besides their main purpose of assuring secure operation.
A lot (all?) of systems which provide such security specific tracking do not strictly limit their usage, access and collection of information and as such are also used for non-essential purposes and in turn need opt-in.
But then sometimes companies try to abuse it and will do do until taken to court.
For example Facebook argued that people use Facebook with the (main) intend to get customized ads and as such tracking them is essential for Facebooks service. As you can guess this argument is completely ridiculous especially given that they also track users which don't use Facebook, but if you are the size of Facebook you can try to bring that to court and maybe gain a bit more time before you need to comply.
https://ec.europa.eu/justice/article-29/documentation/opinio...
(The §29 WG is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Also: IANAL.)
In reality, the idea was to make people aware that they are being tracked across the web and and give them options and somehow everyone pretended that "No tracking, no banners" is not an option.
I am so glad that GitHub is coming forward and point out the elephant in the room: You don't need cookie banners or tracking consent forms if there's nothing to consent.
Or sell your data to interested parties. Maybe if you liked certain GitHub repos, you are more likely to vote Democrat or whatever.
My point is that you're moving the goalposts. Law enforcement generally always requires a complaint that justifies an investigation, and people and organisations get away with breaking the law all the time. However that has nothing to do with whether or not GitHub put their website behind a "consent" wall, or whether or not they're doing in-house as opposed to contracted-out analytics.
There is, but it is so in any law, because laws can't be specified as precisely as computer code, and an attempt to do so would make them so rigid as to be unenforceable, and hence ignored. But it seems that companies aren't even trying to use this wiggle room, just ignoring it or plastering the damned cookie banners, so I think that it's a good thing for future privacy-oriented laws—when given even the most generous possible leeway, businesses would still rather track their users than attempt to colour within the lines.
https://docs.github.com/en/free-pro-team@latest/github/site-...
I wouldn’t be surprised if the sales teams at Google, criteo etc told them to do so off the record.
Every time I see the banner I think is it really necessary to visit the website? So I’m also quite happy about this move by GitHub.
They are like CA Prop 65 lead warnings: useless spam that everyone ignores.
I came to the conclusion myself. I personally see no real need for laws like GDPR and see humanity dealing with cookie banners every day and lost ability for websites to be profitable as pure negatives.
I wonder what they’re using to track user activity instead, probably just a mix of server logs and the other goings on of the backend.
[1]: https://www.i-dont-care-about-cookies.eu/
[2]: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
[3]: https://chrome.google.com/webstore/detail/i-dont-care-about-...
I like the idea of the extension and used a for a few weeks, but ultimately decided to remove it again.
Presumably the most they're using this for is recommending potentially interesting repos to you.
[1] Potential concern would be if "Microsoft" was considered "their own", since Bing does have an ad network. But my guess is between still having separate accounts and being treated as separate companies, that is not the case here... yet.
My guess is that, at least, for now, it refers to GitHub, as you agree to GitHub's Terms of Service, which doesn't actually mention Microsoft as a party.
And while Google keeps it's data horde on you to itself, it definitely sells access to you in numerous harmful ways.
A session cookie that is also used for tracking would qualify as both a functional and a tracking cookie, and thus generally be illegal (since you can't consent to the tracking if it's under the threat of being unable to use the service).
"(And of course GitHub still does not use any cookies to display ads, or track you across other sites.)"
That exactly leaves out "track you on our own site". But honestly, I have absolutely zero issue with them tracking my behavior on their own site. I know how valuable it is to be able to learn/see what users are doing, and they should absolutely be able to do that.
I also like the fact that all users get equal privacy rights!
_gh_sess "2RS32uKu1a6pH8js1RreBWXcr4EdQMHXr/6PdyOeH7tgLbeIdxTaYni5fcFWff4wXTvqv8+lSeJ2W0RWHu0hgN4toFeR8B22x/HGuIx6gdIi4dvd2xQ4gtnuvhBVLTwnYjNGNcnT7ODFlerX+Li9HL33KXUvP/LDMlXTxCP+sJycF1x83Wqh8r2JFTGpcKgaQ22maisp6gfNVJI6MLnFQrKu/LxnuuMfPcVHzCEBjxDejJ/19ucDUVGnZ5LwP4JGTp1+RumiuA8MPxUTaktbLg==--TmIIVNRcipKqc2yt--6HedWH9JiNkUgNKKyGf30A=="
_octo "GH1.1.1254465225.1608314039"
logged_in "no"
You could then nicely ask your users to agree to tracking in the places where there were the privacy intrusion banners of the shady tracking networks.
This EU law comes from a good idea, but it's terribly implemented - it implies that everybody out there is a lawyer and can make sense and agree on multiple pages of confusing legalese, and this every time they open a new website. This is so absurd, and the result is that we're trained to click "ok" on everything and we're tracked all the same. Back where we've started but with more popups.
I too find it quite annoying. The other issue is that sometimes the banners do not properly work with various aids for disability and keyboard-operated browsers.
That's how it was before and I'm not certain that it caused that much harm. Users can always block ads and third-party cookies anyway if they wish to do so.
Also, it isn't the law that has been terribly implemented, although that could be argued as well, but rather the fault lies with the companies that do not want to abide by the law.
There are a few easy ways to check if a website is breaking the law:
- Is it as easy to say "no" to the consent as it is to say "yes"? If not, it's not legal, as the consent is not freely given.
- Is the website setting tracking cookies, or tracking you in some other way, before you have made your choice about the consent? If it is, it's not legal, as the consent must be opt-in not opt-out.
- Is it confusing? Then it's probably not legal, as the consent must be informed.
- Is there a button to "accept all" with no clear list of what you're accepting? Then it's not legal, as the consent must be specific and unambiguous.
It's not rocket science, anyone can read it up for example here https://gdpr-info.eu/issues/consent/
In fact it says "it shall be as easy to withdraw as to give consent".
So you shouldn't attribute complexity to the EU law, when the law actually insists on simplicity.
It's a myth that the GDPR requires complex forms, or even just banners. One that website operators (mainly 3rd party advertisers and trackers who provide the banners/popups to sites) would like you to believe.
A genuine GDPR-compliant banner/popup is much simpler.
In fact you can make a GDPR-compliant site without any banner/popup/form at all, while still using cookies, logins, shopping carts and analytics etc. You just need to do it in a privacy-respecting way, which isn't hard.
The complexity is website operators attempt to half-comply and half-violate the law, frustrate and arm-twist users into something most people would not agree to if it was easy to decline. The obnoxious complexity is deliberate, to annoy and frustrate you so that you give in to the "easy" option they very much want you to "choose".
No it doesn't. EU Law requires you to not harvest data at will, and you either must have a basic functional requirement (i.e. 'remember my login'), or you must ask the user if you can have their data to profile them so the advertisements can make a few percent more money (yes, the whole profiling thing doesn't even add that much to the bottom-line!).
You can also add cookie warning filters to uBlock Origin, but those doesn't autoclick when CSS filters aren't sufficient.
"However, the Opinion also stated that currently there is no exemption to consent for cookies that are strictly limited to first party anonymised and aggregated statistical purposes. Therefore, first-party website analytics through device fingerprinting do not fall under the exemption defined in CRITERION A or B and consent of the user is required."
This seems quite clear that consent is required for any form of analytics where you can identify individual users.
Another commenter here mentioned that GitHub is only tracking individuals for 24 hours before the fingerprint changes. I would think that would probably qualify as being in the spirit of the ePrivacy directive, if not the letter of it.
Would be great if someone from GitHub could comment on the above? How are you handling this - do you maybe get consent as part of the terms you agree to when you signup? (which would mean not tracking anonymous users).
First and foremost, it's not about cookies. EU laws required you to inform visitors about "cookies" and have them acknowledge them long before GDPR passed into law.
Second, it's not about third parties or required cookies vs. marketing cookies.
What the law actually states is that you may not, in any form, make individuals using your service identifiable or track them without prior informed and active consent by the visitor, and you also may not make such consent mandatory for accessing your publications content. plain and simple.
all the "cookie banners" out there are ONE form of solving this problem but are in no way mandated by law. If you find another way of solving this issue, all the better.
But the way these banners are designed and implemented at large are geared towards soliciting consent by means of obfuscating actual selection (think: bright "accept all" buttons with tiny "save settings" links) and by making it hard and tedious to actually select and submit your preferences (think: giant lists of all trackers with opt-out for legitimate interest and optin for consent side by side). These are in clear violation of what the law states imho and are largely in use because there is still no juridical precedent that clarifies what goes and what doesn't.
what we are experiencing is a clash of ethical mandate and economical interest. GDPR is aimed at protecting you, the user, from beeing identified and tracked along your wen history, be it by cookies or fingerprint or whatever.
dropping functional cookies for logged in users is perfectly fine though, as registration itself is likely a process where users can be informed of such personal identification and is an active decision by the user.
saying "the site needs it to function" and tracking users first party only is NOT a way around GDPR, as much as this narrative gets retold.
in short: it's not about cookies and third parties. The law is purposefully formulated in a way that isn't scoped on technicalities and seeks to prevent such "workarounds".
I would love to see more details disclosed by GitHub about HOW exactly they implemented this, as i am certain they have enough professional legal councel to have digged deep into this question.
So my understanding is that there is a big difference between this and "they just don't use third-party analytics".
It would be super nice if they clarified this in the blog post. Maybe by adding something like "We do not use personal data in our analytics".
The argument that you need to follow users around every step of the way to build great products is simply untrue.
Ironically, these sites need to use additional cookies to remember that you clicked away the banner, and part of the problem is I also blanket block all cookies on sites that I don't need to log into, so they don't get to "remember" anything.
We recently removed Google Analytics and switched to apache server logs. It was the only 3rd party cookie our site was using, and the apache logs are far more transparent. (No one understands or trusts the analytics from google, and no one has the time, they only want to see certain bumps for certain pages).
uBlock Origin has prevented the following page from loading:
https://stats.wp.com/e-202051.js
Because of the following filter:
||stats.wp.com^
Found in: Peter Lowe’s Ad and tracking server list • MVPS HOSTS • Dan Pollock’s hosts file • EasyPrivacy
I think if they want to claim that they did this because they care about privacy it might be a little hypocritical to have trackers on the blog post where they're bragging about it.
It also looks like there are still several items on github.com that are beacons / stats tracking (and as such are blocked by privacy / ad blocking tools such as uBlock Origin):
Now if that realization just would dawn on other websites as well...
The rule is simple: If a website uses non-essential cookies, it must inform users and, in most EU jursidctions, collect consent prior to placing a cookie on the user's machine.
The rationale behind the rule is that companies should not store company information on end-user devices without the user's consent. The rule applies to all non-essential cookies regardless of whether the cookies collect personal data or are used for tracking. The rule does not cover cookieless server-side tracking of users. Sites do not violate the law when they track users without consent using server-side tools. Sites do violate the law even without tracking users if the site does not collect consent for non-essential cookies.
GDPR enhanced the cookie rules by applying GDPR consent requirements to all cookies that involve personal information. Many sites ignored the old cookie rule because EU law did not give data protection authorities much enforcement power. GDPR increased the power of the DPAs to issue fines of up to 4% of annual turnover. Sites previously ignoring the rules put out cookie banners once GDPR came into effect.
edit: To be clear, Github isn't saying that it stopped tracking users. It's saying that it doesn't do cookie-based tracking and therefore it does not need a banner.
It would be awesome if this started a trend.
Many people told you so. Remove third party scripts and cookies and suddenly things become easy.
If that were functioning, whereby the two buttons presented to you were a "Continue without cookies" and "I want to opt in", the annoyance would be worth it. But as it stands, most sites just _pretend_ their tracking is opt-in through an "I agree" button, with "I don't agree" generally leading to a mess of check boxes in front of partners the general public has no idea about.
I do hope regulators end up cracking on this...
I don't understand why the regulators are ignoring this. It's destroying the entire principle of the regulation.
I am quite interested at finding out whatever exactly this means.
(It was pretty clear to me that the GDPR would eventually rid us of the most flagrant of the abuses like the ones that you mention, via the stick of fines.)
Right now I think a lot of sites are thinking “If we don’t use these tracking ads we aren’t going to be able to keep the lights on, so it’s better to use that pretend compliance banner everyone else is using, than to have to close”. And that’s the problem. The regulation should make bankruptcy or a massive risky change of business Model look attractive and low risk compared to “agree and continue”. Otherwise why would shady sites not try to do exactly what they are doing.
Tracking ads are unfair competition. It’s like a business not paying their taxes. The reason you can’t start a site paid by non-tracking ads, is that the competitor uses tracking ads.
When tracking ads aren’t an option, the money in “good” advertising goes up. (Or, all the money is concentrated to Apple and Facebook, the bad scenario).
I wonder if they built the analytics system themselves or are using a COTS.
Cookie dialogs are indeed horrible and out of control. Good on them for making the jump. But I doubt many others can justify the cost associated with the change. We need a better solution that gives users choice but reduce the friction caused by annoying prompts.
Especially given that they have shown that they are capable of delivering a good experience based on the Electron platform with VSCode.
My only explanation would be that it was cobbled together by interns, never meant for public release, then some project manager discovered it and said "Ship it!".
VSCode was made with the explicit intent of attracting software developers, who not always but generally get to use whatever editor they want. If VSCode was not snappy and responsive, it would never have been a viable product for its target market.
Chat is the other way around. Slack is on my computer and there’s nothing stopping me from using it, but every org I’ve been at has mandated official communication channels, and for me it’s teams. Chat platform decisions are not made by the same metrics that software developers use for editors. I’m not excusing it, but I don’t see how it could work another way. I would assume teams project managers are incentivized to deliver a list of features and integrations that are targeted squarely at the desires of mid to senior level enterprise IT execs.
I would still like to improve any application I might create depending on how it's being used (to know what features to improve, which ones could potentially be removed or changed, etcetera). Keeping logs of this kind of usage would still go against the GDPR? I thought that it wouldn't as long as it was aggregated data without using any of the users' personal information. But some comments here have led me to believe that it would go against the GDPR regardless because it would still mean separating unique users.
Hoping someone more familiar with the law sees this comment. I mean, I can think of multiple ways to aggregate that data, even with unique users, without using personally identifying information, but I'm not sure anymore if that's enough.
(source: I read the directive way back when it came out, and also skimmed large sectoins of GDPR)
Other sources: https://softwareengineering.stackexchange.com/questions/2905... and https://law.stackexchange.com/questions/30739/do-the-gdpr-an...
So I see this more like a warning, than a positive thing.
Google Analytics offers an `anonymizeIp` setting [0] to tell it to not store IP addresses of your users. This might be a good default in light of GDPR.
[0] https://developers.google.com/analytics/devguides/collection...
Thanks, github, for setting the example.
As good as GDPR was for privacy, it's equally bad for UX.
They're a consequence of the ePrivacy directive from 2002.
The reason why they're more prevalent now is because GDPR 1) made people aware of data protection issues; and 2) made people more scared of fines.
Sometimes there is no conspiracy theory. :)
The ICO responded. They said that they accomplished the goal of bringing awareness to cookies and it’s usage.
That was the ePrivacy Directive. From 2002.
The alternative to asking permission to do intrusive things is to avoid doing intrusive things.
Just no.
Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32.
Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and technically you don't need cookie banners how they are now. Purely informational banners would be enough, but the directive already _should_ have passed but was delayed, and since gdpr spooked everyone, everything and everyone is using cookie banners now anyway
The ePrivacy Directive passed in 2002. It was amended in 2009 to include the cookie rule. The ePrivacy Regulation which would codify cookie requirements as an EU-wide regulation has not passed yet.
Just like people thought that the data protection was a new concept when the GDPR was created, ignoring the fact that the Data Protection Directive had been around for decades.
- github.com
- githubusercontent.com, DNS pointing at github.map.fastly.net
- githubapp.com
- githubassets.com
All these are GitHub-owned, so from a privacy / customer relationship standpoint it looks fine (except github.map.fastly.net , which is probably for CDN purposes), isn't it? I mean: there is zero googleanalytics / zendesk / tracking saas nonsense here. Or are you making this point from a performance standpoint?
By the way, I haven't used SourceHut yet, but thanks a lot for your opensource work.
_gh_sess=eAAHHEQEjZlQKwq8kaSMpTeHC7tyMGwhVexbpZMVfDbjWCf764z4UMG7S%2FeLZpE0ML5y8%2FnmSEd2ZhiDLBHlZyA08Dj8cGob%2BGXSbGSjztMyc5pdd8uxj8qgxc78SHYw01E6pnOnWHRo7XoeTjKje%2FktOx5wObpjZj8JhfOnngdIlhfxSc1EctIth6RDFIsr2HPw9pbDczMfDwwKuswMrkMIt1JEOglF2L%2BxAdscMjeuXu2zFei58AR%2FwRQ%2FGgY3RbQigWt2w%2BKHDIY7a6pISw%3D%3D--H9M6LNV7YPDc1Dvm--vbgFN9CpCkCxTdfhdlvJkg%3D%3D; _octo=GH1.1.770191202.1608243985; logged_in=no; tz=America%2FLos_Angeles
This could easily be used for tracking on the backend... It would be better to not store a large opaque string.
It could get rather big of course. They could not store sessions on the backend for anonymous users.
This is part of the web, when creating legislation that attempts to block/censor or circumvent technology that is already widely used it's in the highest degree repressive and when there are good intentions behind those laws it's just plain dumb.
I wonder how better EU tax payer money would have been used if they were spent on advocating a change to the browser vendors/W3C instead of on law makers exerting their power way beyond their rein.
What is the best Chrome ext to auto accept cookies?
The fact that this laws' reach is almost global is something called the Brussels Effect: https://en.wikipedia.org/wiki/Brussels_effect
But there is also the other way: simply not show a website in Europe at all. I see this sometimes when I click a link: https://imgur.com/a/A5S4drS
It literally takes 3 seconds to analyze the game theoretical effect of such a law to recognize its reach is well beyond Europe and therefore also clearly understood it to be such when passed.