Hacker News Reader

Comment by speedgoose | Hacker News Reader

> This is great for privacy as we don't need to use cookies, IP addresses, fingerprinting or unique identifiers. In our tests, this method proved durable enough to be the most reliable method of counting unique visitors without using cookies.

The differences with a cookie are that the header is named Last-modified instead of Set-Cookie and Cookie, and the value must be a datetime in the RFC2616 format.

How is it good for privacy? I think it’s worse because it’s invisible for the user. I would bet tracking visitors using such an hack isn’t compatible with GDPR, that requires an informed consent for tracking. And good luck explaining your hack to the average visitor.

View on HN

You seem to slightly misunderstand how GDPR works. Tracking in and of itself is not the problem, it's personal data and personally identifying data that is. You can count how many hits your server receives no problem, this is roughly the same idea.

This is equivalent to setting a cookie with a hit count. It's still storing & submitting information, it's just not using a unique identifier (Which is pretty privacy-respecting, I'm not saying it's a terrible thing or something).

I assume it will be treated as such, too. If you can use a cookie to do this without consent, this is fine too. If you can't then it's not. The same happens for local/session storage: it's cookie-equivalent.

The user with the highest visit count will always be uniquely identifiable, though.

Only on the same day. Everything is reset the next day.

I don't follow how this is a problem.

By that measure, any users behind a unique single IP (no IP pooling, no CGNAT, etc) will always be uniquely identifiable. And for IP there's much fewer steps to personally identify the user. The server necessarily sees the user IP.

Yes, the IP can be used to identify people. If you want to track users using their IP and respect GDPR, you need to get their consent first.

The best is to not store them before you get consent. Having a temporary access log with a few IPs is probably fine. But keeping all your access logs forever for analytics purposes is not fine anymore.

I will quote the law:

> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

Basically the “cookie consent” part in the EU stems from the e-privacy directive. Article 5.3 refers to GDPR (through the directive that is replaced by GDPR) and reads:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

In short, this method may fall under the EU “cookie law” above. The use of timestamps may require consent if they are used to distinguish users (even if only for counting purposes). The timestamps may then also be personal data under the GDPR.

Reply on news.ycombinator.com