Hacker News Reader

Comment by rrwo | Hacker News Reader

> Alternatively, you can just not track the behaviour of every person who lands on your website.

Tracking behaviour is useful to ensure the site is working, that people are able to use the site and make purchases, or even to know what parts of the site people are using. There is nothing wrong with that, so long as the logs are not shared and not kept for longer than necessary.

Tracking people's use of the site to build a profile of them and share with third parties, without consent, is where the privacy problem comes from.

View on HN

"Tracking" that is necessary to ensure the service is functioning does not require consent. That is for example why logging IPs for things like rate-limiting or DDoS protection does not require consent, but that data cannot be used for anything else.

If you do not track users but just track usage that should not require consent. So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. You can also track usage of certain site functions without tying that data to a specific user or session.

So the actually necessary tracking does not require consent, but since companies got used to tracking everything and tying it to users/sessions before these laws it seems like they try to continue on that path instead of adapting.

> So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular.

Yeah, nice for you! But you're requiring my collaboration in your investigations; sorry, but I can't tell which cookies (or web-storage blocks) are for checking whether my behaviour is "irregular", and which are intrusive data-collectors.

I'm not going to scrutinise every cookie a site serves; life's too short. I configure my browser to accept first-party session-cookies only. My web-storage pool is zero bytes. If your site doesn't work with those settings, your site is broken (and I'll find a better one).

I think you misunderstand my point. The "tracking" I mentioned is only "actions per {time unit}", for all users. Basically aggregating how many times the "/api/checkout" endpoint is hit. It requires no cookies, it requires no checking of any individuals behavior. The only point of it is if action $FOO decreases dramatically then $FOO might be broken.

At no point does that require cookies or personal data or personal tracking. My point was that you don't need cookies or personally identifiable info to be able to make sure a website runs well.

I think I did misunderstand your point, by about 180deg. Sorry. Thank you for clarifying.

> Tracking behaviour is useful to ensure the site is working

If that's the only way you can tell the site is working, then something's obviously wrong.

> There is nothing wrong with that

Indeed, there's nothing wrong with that, except that I'm not OK with cookies that are served by third-parties, or by some framework or analytics script that you've thrown onto the site.

You need logs of some form to know what users did, or tried to do.

I'm not talking about 3rd party analytics.

And I'm not talking about logs. Logs are fine and necessary; I'm a sysadmin.

Reply on news.ycombinator.com