Hacker News Reader

Comment by mnw21cam | Hacker News Reader

The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose, regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented, and the company is tracking you by other methods, then that is illegal. (It'd be illegal also if they hadn't given a consent popup at all.)

View on HN

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics).

Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data.

IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-el...

How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.

I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line.

A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find.

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

Does an IP alongside a HTTP request count as personal data?

An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/r...

Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.

GDPR

The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment:

Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.

That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.

If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.

Yes GDPR applies, but the part that I was replying to doesn't.

It's two different directives:

- ePrivacy Directive which is about local storage

- GDPR which is about information processing

Reply on news.ycombinator.com