Hacker News Reader

Comment by jefftk | Hacker News Reader

I think this is probably illegal in EU countries. The ePrivacy Directive requires consent before storing data on a user's machine that isn't strictly necessary for providing the service the user requested. Analytics isn't "strictly necessary", and ePrivacy doesn't care whether you use the Cookie header or some other method of storage.

I do think this is better for privacy than standard id-based approaches, but the law is very strict. More: https://www.jefftk.com/p/why-so-many-cookie-banners

(Not a lawyer)

View on HN

Here is the ePrvacy Directive. I can’t find anything in it to back up your assertion, though.

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32...

The directive is a bit hard to read, but its widely understood to require at least notification before storing information on a user's device, probably consent. The guidance is a lot clearer: https://ec.europa.eu/justice/article-29/documentation/opinio...

I'm not sure the guidance applies in this case, as this technique is an edge case which the writers probably didn't foresee.

The ePrivacy directive itself has in article 3.1:

  This Directive shall apply to the processing of personal data [...]

which would mean it doesnt apply here, as there is no personal data.

In practice, I assume this one is for the judges.

Assuming you're correct, can anyone think of a way to count unique visitors without storing data on a users machine or using identifiable user information? Identifiable user information should include hashes that can be re-computed given the original information.

This isn't a criticism of the law, I'm just curious what options there could be, because I can't think of any.

Something like HyperLogLog might be fine assuming you don't need perfect accuracy.

https://en.wikipedia.org/wiki/HyperLogLog

Hi there, Marketing Company Intern!

Tell them you'd rather make the coffee ;-)

Ha, that would explain that question. My first reaction was mostly confusion as there is so much prior art at this point, i.e. fingerprinting through installed add-ons, resolution/window size/system language, browser language, IP locality etc. There are even demo pages around which shows you just how unique your configuration is even without anything else.

https://amiunique.org/fp

Lol, I knew it would sound that way, but I don't work in this domain - just interested in privacy and this problem.

the only reason we could think of for wanting unique visitors was for the marketing people or investors/stakeholders/shareholders. Parsing the request logs should be sufficient for every other metric.

We had a bunch of meetings about this at what essentially amounted to a giant information superhighway billboard company. IIRC someone brought up using cache headers even back then, because it didn't require cookies or javascript, which we couldn't guarantee would be "up to date", this is back in "target IE6, still" days.

As one of my networking friends said, advertisers usually know everything about your metrics, even if you don't. You can't really fudge the numbers in your favor, so raw requests or QPS or whatever ancillary metric would be enough.

the method in the article is defeated by clearing your session when you're done browsing, or using incognito/private browsing tab, as that should mark all "cached" items for deletion.

I thought GDPR cared mostly about uniquely identifying visitors which this does not do. You still need a cookie banner to state that you will put some data on their machine but you always need one of those.

> you always need one of those

The withcabin.com landing page claims you don't need consent banners to use it.

That claim is false in Europe. You need to ask permission for this approach, because you're storing something on the user's device (the generated date in the cache) that isn't strictly necessarily. The ePrivacy directive says you need permission for that, nowhere does the law specify "cookies" it's about any kind of data stored on the user device.

True it does not matter if it’s a cookie, or whatever. You need to look to the ePrivacy directive article 5.3 for which exemption case applies. In the case of timestamps, it would be case A :

> when the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network” (“Exemption A“)

Since the timestamp is no longer used solely for this purpose, you need consent.

Uh, yes? That's exactly what I've been saying upthread.

Reply on news.ycombinator.com