Hacker News Reader

Comment by snek_case | Hacker News Reader

I've been wondering about that. I have a simple web app and I'd like to gather some basic statistics about what users do, which pages they visit... Not to spy on people, not to share with anyone else, just to have some insight on how to make the app better. The app is just a toy program people use for fun, you couldn't possibly argue that any stats I'd be collecting could be used maliciously. It seems to be difficult to do that while respecting the GDPR and without some annoying pop-up though?

View on HN

Technical answer: You can use Differential Privacy[1] to collect such data (“what percentage of users used this feature?”, “What is the distribution of time between visits?”, etc) without collecting any data about individuals. Some projects already do this and there are open source libraries that do the math for you.

However, I don’t think the regulations have an explicit safe harbor along the lines of “You’re fine as long as the math checks out”. Perhaps if it did, we wouldn’t be in such a mess.

(A passive observer that sees a JSON POST wouldn’t know that you’re using differential privacy. It would look like typical telemetry. They’d have to read your code or look at multiple samples and notice that the data looks random)

https://en.m.wikipedia.org/wiki/Differential_privacy

Do you really need cookies for this or could you also use your server logs for this?

Per default you could not gather statistics but ask inside you app if people are willing to participate in making the app better and if they would agree to accept some cookies for this reason.

I don't need cookies for this. However, AFAIK the GDPR doesn't just apply to cookies, it applies to any data retention, or at least anything that could be tied to an IP address or a certain user.

Maybe the key is to have stats that are purely anonymous, eg, how many people visited this page.

Right, I focused on cookies here. Yes you could just cut the IP out of the logs and check the visited sites and requested resources.

If you're using server logs, without any cookies or other client-side storage, then the ePrivacy Directive is not relevant and you're thinking about the GDPR. Unlike ePrivacy, the GDPR is specifically concerned with personal data, so if you are careful in how you set up your logs you can generally still collect good analytics on how people use your site without accidentally collecting data on how a specific person uses your site.

(still not a lawyer)

plausible analytics claims to not need consent as it does not do user level tracking or issue clienside state.

https://plausible.io/

Do you really need to know which pages a particular user visits, or just which pages are visited frequently.

The latter is easily gathered from web server logs, the former sounds like a case of "I want to do this bad thing (spying on users) for good reasons", and the law only cares that it's a bad thing, not about your reasons (or arguably it does care slightly about your reasons, but not in enough detail to accommodate your use case). Laws being rather blunt tools and reasons being rather hard to divine.

You might want to know, in aggregate, which paths users take through your site so you can make it better. This requires cookies, and the cookies are not, in my reading, essential for the site to function.

Yes... Agreed on both points.

You can get a bit of that via referrers, but not as much as you would like.

Just do it server side, with a unique session token.

How do you assign individual web requests to a session without cookies?

Add a session id to the URL and all generated links, I'd guess. Still probably not any more legit than a cookie, though.

I wouldn't be surprised if that fell under "similar devices", just like localStorage.

generate a random ID in js when your page starts, set it in the context and send it as a header on every request

While might not be caught easily, you‘r still not compliant with GDPR by doing it all on the server without consent.

GDPR only applies to PII. If you're just collecting anonymous session tokens you're fine (it's what comes "out of the box" if you host your webapp on AWS for example, you'll see an AWS correlator ID in the request headers)

Cookie banners predate the GDPR: they were initially for the (much older) ePrivacy Directive, though many sites now have combination consent gathering flows for ePrivacy+GFPR.

For your specific question, I think the Planet49 ruling gets pretty close. "It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual's device." [1]

(still not a lawyer)

[1] https://www.twobirds.com/en/news/articles/2019/global/planet...

Reply on news.ycombinator.com