Hacker News Reader

Comment by frereubu | Hacker News Reader

This is fantastic, and I hope it stands up on the presumably inevitable appeal. It's the most obvious way of eventually getting rid of per-site cookie notices - make DNT legally enforceable and cookie notices become irrelevant for people who have it switched on. I run an agency that builds websites for non-profits and we respect DNT by not tracking and not even displaying the cookie notice. The only thing I've wondered about is whether we show a one-off notice saying "we note your DNT setting and we've disabled tracking" just because I wonder if users become suspicious that we're tracking them by default if they don't see a cookie notice!

View on HN

> and not even displaying the cookie notice

Better would be to not (try to) do anything that requires cookie notices in the first place. Might not always be your decision but at least try to push back on the notion that this kind of tracking is needed at all.

Need can only be assessed relative to one's goals. Many business models depend on tracking, so if your goal is to run such a business, then it's needed.

If your business model depends on tracking, you should go out of business.

My parking lot business depends on tracking the license plates of who enters and who exits

Cool, as long as you’re not tracking them everywhere else out in the world, shouldn’t be an issue.

Does it then proceed to track each license plate and their movements once outside the parking lot, keeping a note of every single place where the license plate goes and parks in order to build a profile on that license plate so that you can sell that info off and shove ads down their throats?

That’s not how most people use cookies, just google & co. I’m using an in-house analytics app platform that uses cookies to track how often visitors use the app but we do no tracking at all outside of our website, we just want to know how often people use our site

I think this is an actual example of 'legitimate interest' under GDPR (unlike most of the websites that claim it). There would still be an expectation that you didn't use that data for anything else and got rid of it as soon as it was no longer needed.

Arguing 'legitimate interest' in front of a non-tech judge in one of the many EU countries where a local agency implements GDPR would be... not fun.

I bet that kind of use of license plates is older than any judge still alive. The hard part is convincing the judge that you can't implement it without sharing the data with two dozen web services.

Do you retain the license plate information after they exit the business?

You don’t need consent for that under any data regulation I know of. So long as you don’t keep it any longer than you need to, don’t sell the info or use it to target people with ads etc then you are fine. What you are referring to here isn’t a problem.

Only for the purpose of tracking how much time each vehicle was parked so you can charge them for that time. Absolutely nothing else. You should also be legally required to delete that information immediately after the transaction is done.

You're more likely going to be required to keep that information for a period of time for audit purposes, or to be able to justify a credit card charge in case there is a claim of fraud, etc.

I could easily build you a system that has no dependency on license plates.

For most of my life, it's been done with tickets you buy at a booth and put in your dash, then you use the ticket to exit

That is a position that only the privileged can take. There are a lot of people who are happy to pay for services with personal info rather than cash because they have to save what little of the latter they have to pay for things like food and shelter.

"Happy to" is quite a stretch. Being forced into having your privacy invaded due to economic circumstances does not make such practices acceptable.

If all the privacy-violating companies go out of business, there will be plenty of underserved customers for companies with more legitimate business models.

> "Happy to" is quite a stretch.

No, I don't think so. I think most people would choose to pay with info rather than cash even if they have the cash simply because they don't fully grasp the actual cost to them. People make foolish (from my perspective) economic decisions all the time. I am currently traveling in the American south where I am surrounded by shockingly vast numbers of morbidly obese people who willingly trade their health for a sugar rush. No one is holding a gun to these people's heads and forcing them to drink sugary soda and eat fried food, but they do it anyway. They do it because they like it, and because they don't think about (or don't care about) the long-term consequences. People are (again, from my perspective) stupid. But I don't think it should be the role of government to save people from their own stupidity. That is a very slippery slope.

People don't have that choice so it's speculation either way.

Do you seriously doubt that if they had the choice that many people would willingly and knowingly avail themselves of it?

Maybe. But as of now: there is no choice.

People also chose to use Netflix or Steam (and other streaming platforms) instead of pirating. Last one would (and still is) be free. So it's not unprecedented.

People get the choice all the time with loyalty and reward points cards. It's pretty much a unique identifier that people carry in their pockets and handover willingly every time they make a purchase. It's more obvious and in-your-face sure, but the principle is the same and they have the choice.

Personally, I handover all my fitness information, driving habit information, spending and banking and investing information, my health information, even my location data, my STD statuses, etc to a company so I can get massive discounts on a bunch of stuff in various ways. It alters my behavior in a good way, it alters other peoples' behavior too, and I'm all the more happier about it. I much prefer this over stupid things like sin taxes, consumption taxes and laws that most people don't stick to or agree with (talk about choice and consent, huh).

> They do it because they like it, and because they don't think about (or don't care about) the long-term consequences. People are (again, from my perspective) stupid.

Another reason for this is addiction. Addiction has people doing things that aren’t in their best interest despite them being otherwise intelligent humans.

How much brainwashing does it take before you don't 100% blame the person making the poor decision?

I assume you are volunteering to pay taxes to compensate them for the extra expense for products and services?

Yes, I would love to see UBI happen, either with a new tax, or better yet the repurposing of existing ones.

Ads do not require pervasive and invasive tracking, or selling user data to the highest bidder

A lot of people simply don't care about "having your privacy invaded". I've yet to be convinced, and I'm even a technical person.

Even the words words "privacy" and "invaded" are such loaded and ambiguous language, I don't see how smart tech people are playing along with it as if it's some sort of innate human right in the electronic sense. You have to convince us, you don't get to just skip a few steps and tell us we're all crazy plebs that don't understand the implications of this thing you decided has to be the case. Hence the comment about this attitude being privileged (elitist).

And this law doesn't disallow that! It's just those people who are happy to do so need to opt-in.

Exactly!

Personally, I would love to see the kind of offers companies would start to make for opt-in tracking. In a much cooler world, people would be able to sell their data, as subscriptions, to companies, with premiums placed on more 'valuable' data at whatever given time, based on advertiser interest.

Of course, no data tracking would be ideal, for me. But if someone wants to sell their personal data, they should at least be able to sell it for a market price.

Being able to see the market price of their data would also help people to realize how valuable it is, which would enhance privacy awareness.

Right? And it's not like the equation changes, for advertisers. The only difference in this scheme than the current one is that it doesn't allow for such severe money-pooling. Still some! Obviously facebook would have a great and well-vetted network of advertisers that they could connect you with, which would surely incur some maintenance cost. But being able to opt-in to someone's ad services would be just another way to prove the cost of a service (in this case, social media) to consumers. It's just wins, all the way around.

GDPR actually disallows refusing service to people who opt out of tracking.

Isn't this German law specifically, not the gdpr?

It does in fact disallow that.

Choosing the least worse of two things is not fair consent.

That's true, but it doesn't apply in this case because there is a third option: don't use the service.

That’s why any reasonable regulation tries to address that by saying the provider basically can’t do that e.g in the example of behavioral advertising. Basically you can show the page with dumb ads to users who don’t consent but you can’t say “you need to let us show the ads which pay more because otherwise we can’t keep the lights on”.

> you can’t say “you need to let us show the ads which pay more because otherwise we can’t keep the lights on”.

Yeah, I get that. What I'm sating is: that's a stupid rule. Why should I not be able to say that, especially if it's the truth?

It happens that schools will provide updates only on Facebook, and ISPs only provide support on Twitter, so the there is not always a third option.

That's a problem with the school or the ISP, not Facebook.

That is a position only the privileged can take.

The only reason a company wants to track them is to extract more money from them than they spend on tracking them.

Yes, companies sell products for more money than they cost to produce. It's called "capitalism". And your point would be...?

That being tracked costs you more money than not being tracked

If you can't afford to pay $5 cash, you certainly can't afford to pay the $6 the firm that's tracking you will make from tracking you.

> That is a position that only the privileged can take. There are a lot of people who are happy to pay for services with personal info rather than cash because they have to save what little of the latter they have to pay for things like food and shelter.

What's the value of a persons data if that person cannot afford any of the products which are advertised using that data? On the other hand, persons on a limited budget are sometimes most happy to spend money unwisely.

Your views on the data market seem to be as narrow as your views on poor people.

The collection, buying, and selling of your personal data isn't always about ads. The data people have on you is increasingly used to determine what you can and cannot do, what opportunities you're offered, how much you pay for things, even how long you're left on hold when you call a company.

The data companies collect about you can get you arrested, can be used against you in family court, or prevent you from getting a job.

Even ads themselves aren't always about what you buy. Ads are often used to manipulate you, change the way you see the world, even change the way you vote.

Paying with personal data/advertising is an illusion.

People who buy ads or buy your personal data don't do so out of the goodness of their hearts. They do so in order to make up not only the cost of buying the ad/data in the first place but extract more money out of you, one way or another.

This means it should always be cheaper to just pay for the service yourself then "pay" via ads or exploitation of your personal data, since the latter involves more middlemen that want their cut.

The fact that poor people can currently "freeload" off the system is an artifact of imperfect targeting rather than intentional generosity on the advertisers' part to subsidize the poor population, and will be quickly closed off the second there will be a way to reliably distinguish the purchasing power of a user as to deny service to those whose ad views aren't profitable enough (as they would never be able to purchase the advertised products).

It is only the privileged that is allowed to have any choice in their live in what they can do and what can be done to them. When the option is to die to starvation or the elements then anything, really anything, is better.

This is why many governments are in general responsible to provide enough social support that turns all citizens into privileged people.

I urge you to step back and look at your comment, which is essentially "tracking as a business model is morally justified because it means that poor people can use Google", and think about other, potentially significantly more efficient, ways that this problem might be solved without needing to preserve the bottom-of-the-barrel status quo.

> tracking as a business model is morally justified because it means that poor people can use Google

No, that's not my position. My position is: tracking as a business model is morally justified if it is done with informed consent. A business arrangement is morally justified even if it has potentially deleterious side-effects to one of the parties so long as it is entered into with informed consent.

People buy and sell tobacco and firearms and motorcycles and junk food despite the fact that these products potentially have negative impacts on people's lives that are at least as serious as tracking. One could argue (and some do) that selling Coca Cola is not morally justified, but that position is hardly the slam-dunk that you imply.

It could be seen that way, although I disagree with that viewpoint. For the same reason I don’t think it’s privileged perspective to ban organ sales because someone would need to sell a kidney to eat.

I’m going to keep ensuring that this possibly-only-good-for-the-privileged world is realized and I think modern privacy regulation like the GDPR helps, which is why I’m supportive of it.

> I don’t think it’s privileged perspective to ban organ sales because someone would need to sell a kidney to eat.

We're going to have to agree to disagree about that. Have you ever actually faced that choice? I haven't. Until I have, I don't think I'm in a position to make that decision on someone else's behalf.

Here's another thing to consider: we allow people to put their lives at risk in exchange for money and social prestige by joining the military. The only substantive difference I see between that and selling an organ is that the latter doesn't provide any tangible benefits to the elites who make the rules whereas the former does.

I appreciate that this court decision will most likely be appealed and so the current state is not as clear as it could yet.

But if you assume the court decisions stands then if your business is based on tracking that means your business is based on illegal activities.

The only way out is to either change your business approach to comply with the law or go out of business. That’s no difference to many other activities that probably could earn money but are illegal.

> if your business is based on tracking that means your business is based on illegal activities

Why? Tracking is not illegal. It's just tracking without consent that's illegal.

Let's be real. How many websites/apps ask for real, informed consent for tracking? Tracking without consent is the norm.

Let's be real. How many users care?

I don't - and I am fully informed and prepared. A month into the cookie banners avalanche and I just started clicking OK without looking. Now I have the "I don't care about cookies" extension and that's it.

> Let's be real. How many users care?

I think this question is very context sensitive. The way privacy questions are usually presented ("we want to improve/personalize your experience"), I don't think most people care. But when presented with actual outcomes of loss of privacy (e.g. the Cambridge Analytica scandal) people seem to care a lot. For most people I suspect there's a gap in understanding between how people think their data is used and how it's actually used. Whenever this gap is closed by a major scandal where "how the sausage is made" is revealed, there's often a strong reaction.

But perhaps the biggest indication that people do care about privacy is that ad companies are so reluctant to allow them to opt out of tracking. If (almost) nobody cares, what's the harm in having clear consent or an opt out?

Lots. I have yet to come across someone who didn't care, after they understood what was happening. Virtual anonymous people in forums don't count ;)

I care a lot, and I like having the option to make the choice on a cookie banner and use it.

Not one person I've asked has responded that they would be willing to post their entire browser history on the open internet.

And even with that distinction, plenty of business models become (rightly) unviable because of how badly it tanks the conversion rate.

Does it tank the actual conversion rate, or just the ability to see/attribute certain conversions?

Also: who really wants to be tracked. I agree must people don't care if they are, but who actively wants that?

Who wants to pay for anything? All else being equal, people would rather get things for free. But you can't run an economy that way. It turns out that for many people the perception of getting something for nothing is an adequate substitute.

> All else being equal, people would rather get things for free. But you can't run an economy that way.

I have an alternative ideology to sell you...

something something share the wealths and seize the means of production

we product enough to feed everyone.

I think if interpretation and enforcement works the way we hope it will then that becomes a difficult business model.

That is: where you can’t track people without explicit consent, consent is as easy to not give as to give, and you can’t choose not to deliver the service or deliver a worse service to those who do not consent.

I'm okay with these business models failing.

Courts in Europe have lots of precedent on balancing the users' right to privacy with businesses desire to implement things like tracking. You don't just get to say to the court "I need to do it because otherwise I don't have a business"

Business models which depend on tracking should be illegal.

Never our decision you mean ;) Funnily enough, the nonprofit space can be even tricker to dissuade from tracking. ROI in nonprofits can be really ephemeral if the the aim is "raising awareness" whereas if you're selling something, there's a clear bottom line. In those circumstances if you want figures to present to the board in terms of ROI, something that requires tracking like "return visits" is a hard number. Nonprofits also have to make the best use of minimal funding, so efficient use of resources on publicity is absolutely key. The only site we've built that doesn't have opt-in tracking is one for a domestic violence prevention service which didn't want any tracking to reduce the traces in visitors' browsers.

"Awareness" nonprofits are scams.

By this logic, anybody who does any coordination with anybody is scamming. Some nonprofits are scams, and some businesses are scams. Most businesses are not scams, and most nonprofits are not scams either.

>anybody who does any coordination with anybody is scamming

Scam: "a dishonest scheme; a fraud; a swindle"

I would argue, outside of our closest relationships, the majority of people are attempting to, or engaging in some kind of scamming behavior in at least half of their interactions.

At this point, 2023 worldwide, fear and distrust are table stakes for social interaction

I've been around long enough to know that it's the same as it ever was. I don't think it's a majority, or ever has been a majority, that engage in scamming behavior. I could be wrong about that, but I don't think the ground truth has fundamentally shifted.

But that the majority must still behave rightly paranoid that it is the majority in order to protect themselves from a really pretty small minority.

>I've been around long enough to know that it's the same as it ever was

Yes well the whole point is to make things better - not just keep them the same

I'd say "cautious" rather than "paranoid".

This relates to a piece of advice I gave my children: most people are fundamentally good and decent. A small percentage are not. The problem is that you can't tell which is which just by looking at them.

I wouldn’t. The internet has been a game changer for scammers. Back I. The day, you could still run a boiler room, but it was an actual office in the US law enforcement could raid.

What a sad life it must be to be constantly fearful and anxious of every social interaction.

To be clear, I don't personally operate from this assumption nor does my community (generally)

However it is unquestionable that the default mode for humans in America to operate is out of fear - and the opposite is by exception

I'm a human in America and that's certainly not the "unquestionable" default mode that everyone operates on.

Is it really unquestionable?

Sounds like you're conflating scammy behavior with behavior that furthers one's goals. Just because something someone does furthers their agenda doesn't mean the person they interact with doesn't also get something out of the interaction, and it doesn't mean they were deceived in any way.

Even in human interaction amongst your closest friends and family, they only interact with you for their own benefit - that just happens to be in pursuit of the endorphins/dopamine gained when they spend time with the people they share memories with, and it happens to be reciprocal.

I refuse to make this assumption. Maybe I'm wrong, but I'm getting a lot of mileage from assuming kindness and honesty at the start of every interaction.

Well, with exception of those which need to be shot with Hanlon's handgun[0]. There's surprisingly many of those, and not where people would suspect (e.g. I see it more often interacting with small businesses than with larger ones) - but in most interactions with others, I find it best to not reach for the handgun until it's clear it's needed.

[0] - "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice." -- https://news.ycombinator.com/item?id=21691282

> in most interactions with others, I find it best to not reach for the handgun until it's clear it's needed

This is excellent advice for both metaphorical and literal handguns.

Our economic system is based on systemic incentives promoting malice. I'm surprised how people aren't more scammy given how greatly it's incentivized.

Large corporations where all human values are made illegal are quite shining examples how humans should operate in our system. This is sadly quite common in non-profits too.

> I'm getting a lot of mileage from assuming kindness and honesty at the start of every interaction.

I agree with this, but there are situations where because of obvious incentives you cannot make this assumption. Car salesman treating me like his best friend? I wonder why?

Damn, that's a dark worldview. My personal experience in life indicates it's not even close to true, fortunately.

"the majority of people are attempting to, or engaging in some kind of scamming behavior in at least half of their interactions."

I think the numbers are way lower, but it is an old, archaic idea, you do good for your tribe/family - by taking from anywhere outside of the tribe. Stealing from the tribe is very bad and might get you killed. Stealing from another tribe however is not stealing, but reputable work, as long as there are no established friendly relations to that tribe. Many people indeed operate with this mindset (consciously or not)

But all in all I would rather say, that the number of people who consider all of humanity their family, is increasing.

This just isn't true, certainly in the sense that I meant it. What about a breast cancer charity who wants to raise awareness of the early signs of breast cancer? A domestic violence charity who wants to raise awareness of the signs that a friend of yours is the victim of domestic violence? There are countless examples like that that I'm sure you could have come up with rather than a flippant dismissal.

“ In those circumstances if you want figures to present to the board in terms of ROI”

This sentence shouldn’t be associated with anything “non-profit”

Proving yet again that, unless you structure your organization differently than every other capitalist thing (which means you won’t get funding through traditional sources) then you’re just helping capital further entrench their positions of power

It makes perfect sense regardless of funding source.

You want to have some kind of impact, and you end up having to spending money to do that. You want the most impact and your funding is limited.

"Return on investment" has nothing to do with spending

It absolutely can do. You're trying to force a very narrow view of a simple but broadly applicable concept.

I'm suggesting that in the long run, any organization that is hierarchically "overseen" by humans with outsize power compared to the employees (aka a "Board" of special people that are better and smarter and more politically well placed than disposable employees), will inevitably exploit the structure for selfish gain with a probability of 1.

The STRUCTURE is wrong is the point.

The entire concept is built around would-be-aristocrats (Board) coercing the management and employees into allocating property (Money) based on their whim with no accountability or democratic function. It is built to exploit.

Instead they should organize as a non-stock cooperative so that is effectively impossible to exploit. That's the actual answer.

But you should want an ROI as a non-profit. If you spend $1000 on advertising to get people to write their Senator to help push for/against a bill, you want to make sure you're spending it on the most effective way. If it gets spent on mail ads and no one calls, then that is largely a waste of money (regardless of funding model and org structure). If you don't have a measure, you can't really know if money is being wasted. You can guess and have a gut feel, but not scientific, actionable data to change how the org is working to best further the non-profit's cause.

Maybe you can call it something else, but for a non-profit ROI is just answering the question "Are we spending our money wisely?

Or were you referring to the non-profit having a board?

Yes, you absolutely want a board and accountability on how the money is spent.

I trust a non-profit "board" about as much as a slave court judge

https://www.joangarry.com/dysfunctional-boards/

A board (no need for scare quotes) is a legal requirement for tax exempt (501c3) status. And not sure what point you're making with the linked article which is about (relatively mild) board dysfunction, not scamming or illegal behavior.

Presumably the board could be made of every single employee of the non-profit (perhaps with varying voting power depending on factors such as seniority or experience)?

"ROI" just means "return on investment". It doesn't automatically mean that return is monetary. A nonprofit getting results in terms of accomplishing their purpose is getting good ROI.

Most definitions of ROI refer to monetary return. That's why it's typically a percentage.

Using concepts like ROI for non-profit operations is one of the signs how everything is made to emulate business.

Are "return visits" really a big concern? I don't care if a site tracks my return visits, as long as it's local and not via a hidden Facebook pixel, Google Analytics, etc. that will get added to their global profile about me.

Doesn't matter if you care. IPs have been ruled to be personal information and GDPR mandates that the collection of personal information requires informed consent — regardless of whether you use cookies or some other mechanism to do so.

If you don't care, switch on DNT and never see those banners again (assuming this ruling preveils).

It’s practically impossible to track return visits anymore anyway. No cookie or localdb or browser fingerprinting is going to tell you whether someone looked at a site once on their home computer, again on their phone while commuting, and again on a work computer to show colleagues.

Thats when every path (screw it, even /) gets swapped for a UUID so link sharing is always traceable.

This is how marketing emails already work. Although outside of those, usually these are replaced by query parameters that are merely extraneous to the main path. Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

> Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

Ugh, please don't give them any ideas

This is going on for a while on facebook afaik. On youtube and twitter they are still a url param that you can strip out.

TikTok has possibly the most nefarious version of this: When someone shares a video, a link is created that’s specific to them. It’s a short link that looks like a regular one, while the tracking params are shown only after someone goes to the link and the shortener resolves it. If it opens in the app through deep linking the tracking has happened transparently.

This (ostensibly) empowers the user-facing "feature" whereby you're presented the "User XXX is on TikTok, you should join them!" modal when you click their link. Which is perhaps better than no end-user impact at all.

This is still illegal. GDPR is NOT about cookies ("the collection mechanism"), but about the data being collected ("personal information").

So as long as you are collecting personal information, there is no legal difference whether you do it via cookies or another different mechanism.

GDPR is not about consent or data being collected. If it were, the EU would not penalize violators based on a (largely irrelevant) PERCENTAGE OF GLOBAL REVENUE for a breach.

I'm an external auditor. The GDPR is a cash grab.

Regulations that actually incentivize organizations toward stronger privacy and protection practices are designed more like HIPAA or PCI where the MAGNITUDE OF THE BREACH is the primary factor determining the monetary fines imposed (e.g.,number of records exposed, was it PII, PHI, etc.).

Taking 4% of the company's annual revenue from the previous year, irrespective of the size of the breach, results in a regulation about as effective as clicking those cookie consent boxes. "Oh thank goodness I gave my consent, I think now we can all rest easy that our data is being handled securely and appropriately!" No, the EU included the ticky tacky consent requirement to create major global visibility about itself so that when a company doing business with the EU has a breach, they won't be surprised when they then get an additional bill from the EU for not only having the breach, but now being in violation of the GDPR too.

The GDPR is a despicable joke. And my use of 'the' gives me the right to that opinion. If anyone else out there was involved in GDPR's creation or implementation, I think you would agree:

GDPR owns the Greatest Dung Pile Record, Grandma's Dildo Paste Replenisher, the Gagging Damaged Penis Rectum and one Gigabyte of Dick Punch Radiation in addition to €2.83 billion (as of 12/2022) collected from breached companies in 1,401 cases for "violating the GDPR".

I know that the fines are a percentage of global revenue. And I am totally on board with this. I wish we had dynamic fines like these in more areas of society.

The other option would be to have fixed fines that Google et al. pay out of their small change, while it absolutly would torch their small competition.

Sure, they could also jail CEOs for this. I would also be for that.

If a fine doesn't grow with the income it is a fee. So if you want a corporation to follow your law, it needs to come with a fine that motivates those in charge enough to follow it. Money is the soft option there.

It is totally possible to run websites in compliance with GDPR. I built multiple that require no consent whatsoever, because guess what: No personal data is collected, where it is not absolutely technically required.

For me as an EU citizen the GDPR turned my data-related communications with companies from essentially begging into the void, to actually getting a response.

Respectfully, you're talking nonsense.

The GDPR doesn't mandate fines of 4% regardless of the nature of the breach. That's the maximum size of the fine.

You should go ahead and actually read the text of the GDPR. Specifically, Article 83.

Paragraph 1 states that "the imposition of administrative fines [...] in respect of infringements of this Regulation [...] shall in each individual case be effective, proportionate and dissuasive".

Paragraph 2 lists eleven factors that the SAs have to have regard to when setting fines, and top of the list is "the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them".

Assuming it remains legal.

Many folks assumed DNT is useless. Yet here we are comenting in a thread about a court that is making it legally enforceable.

> Assuming it remains legal.

How exactly do you legally enforce "each link must not be a unique UUID generated per-user or per-page-view"? Do you mandate how "generic" a link has to be, such that a visit to that link exposes less than a certain amount of information about that visit? What about things like order-specific links on a shopping website, that will naturally identify an account if all orders share the same namespace?

Easy. It is already forbidden by GDPR without consent. Contrary to popular believe the GDPR does not mandate anything about cookies, it talks about personal information, if you collect it through cookies or some intricate system of pulleys and levers doesn't matter at all.

Simplified it says: if you collect personal information, you need to ask for consent. If someone doesn't consent they must not receive degraded service. Now there has been a ruling that the Do Not Track info users send you shall be honored by you (duh).

This is true regardless of how you technically do it. So UUID URLs are okay, storing which IP adresses shared an UUID link with which other IP without consent is not.

I think some in the IT world need to finally stop making excuses and stop coming up with new illegal ways of tracking users on a personal level. Just use the same creative energy for finding ways of pseudonymizing and anonymizing users (where possible — depending on what you are collecting deanonymization might always be possible).

Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

And how do you track that amount of data without collecting the datum of which user shared what to whom? Sure you could anonymize it etc., but by that point you already processed data that has been ruled personal data without consent.

The truth is, that we had some rulings on what is considered personal data and what isn't and IP adresses, even parts of them can be regarded as such. Now you and I might think this is silly etc., but if we write software for corporations that have to pay fines as a feaction of their total revenue not knowing that can easily ruin our lives.

And I am merely reflecting the way how these laws have been interpreted and ruled on so far in the comment section for an article on, well another ruling by a court. Legal reality, like physical reality doesn't go away if you close your eyes.

For one, it'd be a potential way to maintain a sophisticated full-conversion lifetime A/B testing setup with no PII of any sort ever hashed/retained. No IP addresses required, or anything else.

Just counting the times someone requested that particular UUID could indeed work — provided you don't store which IP requested that UUID-endpoint anywhere on your webserver or elsewhere, because then we could infer that relationship again. So this sounds like a good idea.

Is this what you originally meant?

Nontheless I hope you can see in which way the whole thing is still deeply connected to the legal question of how one can still learn about their service without tracking single users when they don't give their consent, maybe now even via DNT header.

Yes, you get more persistent attribution data for ad campaigns/whatever without consuming any personal information.

> Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

That is personal information.

Elaborate?

For a thousandths time: GDPR prohibits the collection of personal information without informed consent.

It does not matter how you collect that personal information, so whether you use cookies, pen and paper, the digital equivalent of a rube goldberg machine or UUIDs in the URLs — totally meaningless. As soon as you process the IP and use that information for any purpose not considered legitimate interest you are on the hook (and no: if you are in doubt it is not legitimate interest).

Many wrongly believe GDPR is about cookies. It is not. It is about the information and the consent. So whether you change the collection mechanism doesn't make any difference if you still collect the info. It just means you now have to update your consent banner to include that new way of data collection as well ; )

Nobody here is talking about GDPR except you.

A interesting way to show that you got no clue why people put cookie consent banners on their websites.

Let me give you a hint: Because they are required to do so by law (at least in the biggest free market on the planet). Now maybe you can figure out how that law is called and why it is relevant in a discussion where the topic is DNT and a German court ruling it needs to be honored.

We are not discussing whether tracking is technically possible — that would be a pretty short discussion: Yes it is possible. So we are talking about something else. And if we are not talking about the law, why did you even feel a need to come up with a way of circumventing it?

You clearly haven’t been following along and instead jumped to beating the same dead horse you admit to having beat so many times before.

To summarize: we’re talking about technical solutions to linking sessions across independent devices. What’s your “short discussion” answer to that?

My answer to that is that this is trivial from a technical standpoint. Serving each endpoint with an UUID or URL parameters to figure out who shares what with whom is not a new thing and has been used for ages.

So when the headline says »German court prohibits Linkedin from ignoring DNT signals« the interesting point isn't what is technically ancient history, but what that new legal reality might mean in practise for those of us who build, maintain and run the things that are affected by said legal reality.

Or what more did you have to say than hint at one very obvious and noticable way to do tracking?

So you just jumped into a thread that had nothing to do with you to complain about how it doesn't solve your particular problems, despite never claiming to?

I don't know you and I am sorry if my multiple initial comments felt to aggressive, they were not about you per se. You believe my comments had nothing to do with your remark, I demonstrated and explained the opposite. I am open to reason, but you did not tell us once why your remarks have nothing to do with the laws mentioned inside this comment section.

So from my perspective: No. I jumped into a particular thread that seemed to imply one could "get around" that particular legal issue with a technical fix, which is just false. You sure can do that but it will not make the legal risk go away, just because you are not using cookies.

Now of course you could again go and attack the messenger instead of telling us why a technological workaround for a legal issue has nothing to do with the legal issue inside the comment section on said legal issue. Now because all of this could just be one great misunderstanding I am going to assume you don't know that much on the legal side of the issue and my comments on "your" thread came across as aggressive which raised the heat unnecessarily and was not my intention.

My remarks were in reply to the comment I replied to, which stated:

"No cookie or localdb or browser fingerprinting is going to tell you whether someone looked at a site once on their home computer, again on their phone while commuting, and again on a work computer to show colleagues."

My intention was to provide a mechanism for solving this problem. GDPR or even Europe in general has nothing to do with it.

This is how the cookie law should have been implemented and it was absolutely one hundred percent the fault of the lawmakers for not implementing it this way. The millions of hours bureaucracy has wasted having people click through banner pop-ups is entirely on the makers of the law, not the offenders.

Are you being sarcastic? Cultural mores are different in the EU, lawmakers there began with a presumption of basic good faith on the part of business which turned out to be lamentably lacking in the international market. This is 50% the fault of the people trying to circumvent/undermine the law rather than cooperate with it.

That is pure naivete and I'm saying this as a person who lives and works in the EU. It's time to get off our ethical high horse and treat corporations exactly as they expect to be treated.

> lawmakers there began with a presumption of basic good faith on the part of business which turned out to be lamentably lacking in the international market

Did they learn their lesson? Because that was an incredibly foolish assumption out of the starting gate; from old-guard developers and companies' points of view, they were stomping into a sandbox they hadn't built and upsetting the status quo that was working; of course malicious compliance should have been anticipated.

> EU, lawmakers there began with a presumption of basic good faith on the part of business

Are you telling me that EU lawmakers were utterly naive to common left wing critiques of capitalism? That beggars belief.

There is no “cookie law” and no mandate that banners are used etc. Regulation should try to avoid languages in specific technology as much as possible - and the GDPR does.

There's no mandate banners be used in the same sense that there's no "requirement" bungee jumping companies have you sign a waiver; they could just make the experience inherently safer, right?

The banners were an extremely predictable outcome of a badly-crafted law.

I’m not sure how I’d improve the formulation in a way that would remove explicit questions.

> It's the most obvious way of eventually getting rid of per-site cookie notices - make DNT legally enforceable and cookie notices become irrelevant for people who have it switched on.

I think this is unlikely to happen, because most websites actually want to track you. So they will display the banner anyway, or perhaps a slightly modified version like "we noticed you have your DNT turned on, but are you willing to make an exception just for us?"

That gives them a chance users will consent anyway to get rid of the cookie banner. And they will argue that a specific consent given on their website overrides the generic non-consent represented by DNT.

My mom actually texted me once that she didn't like a site I shared with her, because it did not allow her to disable cookies... After a quick investigation it was because they weren't collecting any.

Technical cookies don't need a cookie banner anyway. Sadly not all website operators know this.

They know this very well, but marketing/legal etc. force them to display it anyway, because they want to annoy you into just clicking "Accept all".

And because the law is written so unaccountable bureaucrats (often in another country) get to decide what is a "technical cookie," so better safe than sorry.

often in another country

Stop spouting nonsense. Enforcement is done by the DPA of the country where the company is located, hence why everyone is annoyed with how Ireland is handling Facebook but can't do anything about it.

My company is located in the United States; which DPA has authority over the way my site handles Europeans' private data?

> The only thing I've wondered about is whether we show a one-off notice saying "we note your DNT setting and we've disabled tracking"

How would you make it one-off?

Store a cookie that notes it has been displayed, but with no ID which can link between sessions.

Enough ID-less cookies become a de facto ID pretty quickly. ID cookies are just the easiest method of fingerprinting users.

This is one of the most harmless uses of a cookie one could imagine. It can only be used to identify someone in combination with other fingerprinting techniques, but applying those without consent would be illegal. Accordingly, its danger can be entirely dismissed here.

Only if one actively uses them that way, in defiance of the laws in question.

purely functional cookies (eg dismissed_banner=true) don't require consent

It's important to note that Cookie banners and GDPR are separate things and that these pop-ups are covering both purposes in a lot of cases. So even with a DNT flag, many sites will still need explicit, advance permission to process data, and cookies will still be a method for technical enablement.

In an ideal world, respecting DNT would instantly bin 95% of the cookies and data processing requests, but I'm still getting automatic (and permissionless) marketing subscriptions from companies when I make purchases, and the British ICO seems unwilling to intervene, so it seems unlikely that DNT being case law is going to have any quick effect on things.

I wouldn't worry about that last concern. The overwhelming signal from users is that they don't actively think about tracking most of the time. If you show no banner, they'll assume nothing one way or the other.

Just put up a `Privacy` link for those actually conscious of the topic to give them details; you'd be doing both categories of users a solid tucking that info out of the way.

You are one of the good people. Unfortunately, many will go the easy route: What it will do is that even more websites won't be available over here, and direct to a 451 ("Unavailable due to legal restrictions") error. This fragmentises the net.

The best way to fix that is for other countries to start improving their consumer protection laws so cutting off "problem" countries becomes less and less feasible for unscrupulous businesses. Meanwhile (slightly) more ethical companies can take over the EU market.

Do you have any examples for that phenomenon?

I use a lot of news aggregators, and never once got a link to a 451.

I think part of that is also that it's not foolproof to identify where a user is connecting from. Because I think legally, you can't use "but that user had an US IP address" as an excuse why you broke EU law against an EU citizen connecting from inside the EU.

Why not ?

Because if you're not sure where a user is, you can do the right thing instead of guessing.

EU is a massive market. If some unscrupulous businesses don't provide their services here, I'd say good riddance. If there's enough demand, other businesses will take over.

Who has taken over from Threads?

I find it a bit hypocritical to associate the unauthorised tracking of visitors, usually for advertising purposes, with the themes of the Fahrenheit 451 book, which are are censorship, conformity vs individualism, the destructive role of technology, and the loss of critical thinking.

On the contrary, I think it's very true to the spirit of lost critical thinking.

Every single consumer protection has people show up on the side of the giant corporations. Usually a libertarian type with no clue how furious they would be if they got what they were asking for.

Most of us were getting what we asked for before the EU dropped the GDPR on us to claim ownership of the sandbox they didn't build. ;)

Isn't that just what advertising does?

I would love that. Makes more money for us since we can now build competitive service more easily.

We shouldn’t do consumer protections because then businesses who ignore consumer protections might not do business

Isn’t quite the argument you think it is.

We should get rid of cookies in general! And the web. Hear me out.

The Web makes it so that there is one server and lots of customers. It has to be hardened against SPAM, DDOS, etc. It pays all the costs. But also recoups them by tracking, it’s called surveillance capitalism.

Every site should have no idea how many people visited, actually. Just a bunch of static front-end content that gets passed around.

If people want to store their data, they can pay dumb pipes to store encrypted data.

Get rid of email too. Anyone who gets ahold of your email address can spam you. Instead people should pay for the dumb pipes to store messages, and you can give out capabilities for your attention. They can be transferable but if they are abused then you cut off the root of that tree. And you should charge for using them, too. Just cause someone has your public address doesn’t mean they can reach you.

In short, DNS and the Web and Email promote a certain dynamic where people invest in an upfront service and then take advantage of extreme power disparities forever, to recoup costs. And if they take on equity investors in a ponzi scheme until they IPO then they have more and more costs to recoup. There is no end to it. Wall street earnings depend on surveillance capitalism to continue.

It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor

As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.

This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.

That's not really what anyone means when they say tracking...

The recent case against Criteo in the Netherlands has some interesting definitions of cookie types:

This case revolves around (third party) tracking cookies.

The Dutch Data Protection Authority (AP) defines 2 cookies as follows:

“Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor.

Bottom of form

There are 3 types of cookies:

- functional cookies;

- analytical cookies;

- tracking cookies.”

The AP says about tracking cookies 3 :

“If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time.

Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data.

Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).”

https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...

For anyone wondering what the Dutch DPA (called the Autoriteit Persoonsgegevens, or Authority personal data) itself says about cookies (and user tracking in general really): https://www.autoriteitpersoonsgegevens.nl/themas/internet-sl...

(It's in dutch, translate at your own liberty, I'll give my own below + the stuff the authority for consumers and the market demands, which is linked from their page.)

Basically of the three cookie types, functional cookies require no consent whatsoever. A cookie to set up a user session (the page uses a shopping cart in a webshop as an example and the details mention things like saved passwords and language choices) is totally fine. The AP still recommends informing the users, but it's not required.

Analytical cookies are permissible insofar that they aren't used to profile the user. You're not required to ask for permission as long as they don't contain any uniquely identifying information. You are required to inform the visitor that you are placing these cookies though.

The final category are tracking cookies. These fall under the full scope of the GDPR; you must ask for consent before placing them, you must tell people how you are collecting their data (cookies, scripts or beacons are listed as examples) and you need to tell people what you do with them.

Pre-checking consent forms in general is expressly forbidden (on the same logic that you can't pre-check people into signing up for physical spam mail or paid subscriptions) and consent must be clearly stated, not hidden in some terms of services page or privacy statement.

Those are all requirements on top of the rights the GDPR (in Dutch called the AVG) grants consumers, although obviously most of this overlaps with the GDPR already.

Storing previous_visitor=1 into local storage is not the type of tracking most people are objecting to, nor is it against the gdpr until you start having user specific indicators or trying to use a collection of values as a fingerprint.

And it is enough to get you in trouble if it’s a website you are not supposed to see.

Is that so? Event if you check that on the client side without sending that data to the server?

A wife can find out a husband is trying to cheat on them for example.

The data you choose to store with your software on your local machine is your responsibility.

Tracking is server side behavior.

3P cookies aren't a problem, per se. Using 3rd party cookies to join data with other server side data is the problem.

Well you can still reject all cookies then, making all of these cookies popup nonsense.

Not GDPR, but probably does require consent under the ePrivacy Directive.

> Storing previous_visitor=1 into local storage is not the type of tracking most people are objecting to

Who are you to speak for "most people". I do object to that kind of cookie being placed without my explicit consent. It provides at least some identifying information that might allow multiple websites working together to uniquely identify you.

… and once it’s used by multiple sites to uniquely identify you, it becomes a tracking cookie in (most of) the laws on the books.

The law judges intent as well as technology.

No, a cookie with default settings attached to https://example.com saying "previous_visitor=true" does not provide any information whatsoever to any sites other than https://example.com.

There are various techniques to place "cookies" (sometimes not technically cookies) that can be correlated by multiple websites working together, but the website has to go out of their way to proactively do that, this is not something that gets enabled by simply placing a standard non-personalized cookie.

> Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor

It is arguably tracking required for the functioning of the site which is a clear exception to the ban.

It's clearly not required. The site would function without it. Therefore an activist will eventually argue to a court that it's a GDPR violation and win, meaning you have to pay up a fraction of your revenue (possibly sending you under).

GDPR threads on HN are always like this. Tons of people saying "no no it doesn't work that way it wouldn't be reasonable" and then when that thing ends up being ruled illegal, "of course it's illegal everyone knew that it's all very clear".

GDPR is written in such a way that you can't ever know what is or isn't allowed.

That’s setting a cookie/local storage that can be used purely client side to determine whether to show the message or not. No tracking required because the server never has to see or store this.

local storage maybe, but cookies are sent on every request. there are no purely client side cookies.

Tracking cookies identify you across multiple sites. If some front-end JavaScript sets and checks a cookie for "has visited" on a single site, that's not considered tracking. It's non-identifying and harmless.

Reply on news.ycombinator.com