Hacker News Reader

Comment by frereubu | Hacker News Reader

Never our decision you mean ;) Funnily enough, the nonprofit space can be even tricker to dissuade from tracking. ROI in nonprofits can be really ephemeral if the the aim is "raising awareness" whereas if you're selling something, there's a clear bottom line. In those circumstances if you want figures to present to the board in terms of ROI, something that requires tracking like "return visits" is a hard number. Nonprofits also have to make the best use of minimal funding, so efficient use of resources on publicity is absolutely key. The only site we've built that doesn't have opt-in tracking is one for a domestic violence prevention service which didn't want any tracking to reduce the traces in visitors' browsers.

View on HN

It’s practically impossible to track return visits anymore anyway. No cookie or localdb or browser fingerprinting is going to tell you whether someone looked at a site once on their home computer, again on their phone while commuting, and again on a work computer to show colleagues.

Thats when every path (screw it, even /) gets swapped for a UUID so link sharing is always traceable.

This is how marketing emails already work. Although outside of those, usually these are replaced by query parameters that are merely extraneous to the main path. Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

> Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

Ugh, please don't give them any ideas

This is going on for a while on facebook afaik. On youtube and twitter they are still a url param that you can strip out.

TikTok has possibly the most nefarious version of this: When someone shares a video, a link is created that’s specific to them. It’s a short link that looks like a regular one, while the tracking params are shown only after someone goes to the link and the shortener resolves it. If it opens in the app through deep linking the tracking has happened transparently.

This (ostensibly) empowers the user-facing "feature" whereby you're presented the "User XXX is on TikTok, you should join them!" modal when you click their link. Which is perhaps better than no end-user impact at all.

This is still illegal. GDPR is NOT about cookies ("the collection mechanism"), but about the data being collected ("personal information").

So as long as you are collecting personal information, there is no legal difference whether you do it via cookies or another different mechanism.

GDPR is not about consent or data being collected. If it were, the EU would not penalize violators based on a (largely irrelevant) PERCENTAGE OF GLOBAL REVENUE for a breach.

I'm an external auditor. The GDPR is a cash grab.

Regulations that actually incentivize organizations toward stronger privacy and protection practices are designed more like HIPAA or PCI where the MAGNITUDE OF THE BREACH is the primary factor determining the monetary fines imposed (e.g.,number of records exposed, was it PII, PHI, etc.).

Taking 4% of the company's annual revenue from the previous year, irrespective of the size of the breach, results in a regulation about as effective as clicking those cookie consent boxes. "Oh thank goodness I gave my consent, I think now we can all rest easy that our data is being handled securely and appropriately!" No, the EU included the ticky tacky consent requirement to create major global visibility about itself so that when a company doing business with the EU has a breach, they won't be surprised when they then get an additional bill from the EU for not only having the breach, but now being in violation of the GDPR too.

The GDPR is a despicable joke. And my use of 'the' gives me the right to that opinion. If anyone else out there was involved in GDPR's creation or implementation, I think you would agree:

GDPR owns the Greatest Dung Pile Record, Grandma's Dildo Paste Replenisher, the Gagging Damaged Penis Rectum and one Gigabyte of Dick Punch Radiation in addition to €2.83 billion (as of 12/2022) collected from breached companies in 1,401 cases for "violating the GDPR".

I know that the fines are a percentage of global revenue. And I am totally on board with this. I wish we had dynamic fines like these in more areas of society.

The other option would be to have fixed fines that Google et al. pay out of their small change, while it absolutly would torch their small competition.

Sure, they could also jail CEOs for this. I would also be for that.

If a fine doesn't grow with the income it is a fee. So if you want a corporation to follow your law, it needs to come with a fine that motivates those in charge enough to follow it. Money is the soft option there.

It is totally possible to run websites in compliance with GDPR. I built multiple that require no consent whatsoever, because guess what: No personal data is collected, where it is not absolutely technically required.

For me as an EU citizen the GDPR turned my data-related communications with companies from essentially begging into the void, to actually getting a response.

Respectfully, you're talking nonsense.

The GDPR doesn't mandate fines of 4% regardless of the nature of the breach. That's the maximum size of the fine.

You should go ahead and actually read the text of the GDPR. Specifically, Article 83.

Paragraph 1 states that "the imposition of administrative fines [...] in respect of infringements of this Regulation [...] shall in each individual case be effective, proportionate and dissuasive".

Paragraph 2 lists eleven factors that the SAs have to have regard to when setting fines, and top of the list is "the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them".

Assuming it remains legal.

Many folks assumed DNT is useless. Yet here we are comenting in a thread about a court that is making it legally enforceable.

> Assuming it remains legal.

How exactly do you legally enforce "each link must not be a unique UUID generated per-user or per-page-view"? Do you mandate how "generic" a link has to be, such that a visit to that link exposes less than a certain amount of information about that visit? What about things like order-specific links on a shopping website, that will naturally identify an account if all orders share the same namespace?

Easy. It is already forbidden by GDPR without consent. Contrary to popular believe the GDPR does not mandate anything about cookies, it talks about personal information, if you collect it through cookies or some intricate system of pulleys and levers doesn't matter at all.

Simplified it says: if you collect personal information, you need to ask for consent. If someone doesn't consent they must not receive degraded service. Now there has been a ruling that the Do Not Track info users send you shall be honored by you (duh).

This is true regardless of how you technically do it. So UUID URLs are okay, storing which IP adresses shared an UUID link with which other IP without consent is not.

I think some in the IT world need to finally stop making excuses and stop coming up with new illegal ways of tracking users on a personal level. Just use the same creative energy for finding ways of pseudonymizing and anonymizing users (where possible — depending on what you are collecting deanonymization might always be possible).

Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

And how do you track that amount of data without collecting the datum of which user shared what to whom? Sure you could anonymize it etc., but by that point you already processed data that has been ruled personal data without consent.

The truth is, that we had some rulings on what is considered personal data and what isn't and IP adresses, even parts of them can be regarded as such. Now you and I might think this is silly etc., but if we write software for corporations that have to pay fines as a feaction of their total revenue not knowing that can easily ruin our lives.

And I am merely reflecting the way how these laws have been interpreted and ruled on so far in the comment section for an article on, well another ruling by a court. Legal reality, like physical reality doesn't go away if you close your eyes.

For one, it'd be a potential way to maintain a sophisticated full-conversion lifetime A/B testing setup with no PII of any sort ever hashed/retained. No IP addresses required, or anything else.

Just counting the times someone requested that particular UUID could indeed work — provided you don't store which IP requested that UUID-endpoint anywhere on your webserver or elsewhere, because then we could infer that relationship again. So this sounds like a good idea.

Is this what you originally meant?

Nontheless I hope you can see in which way the whole thing is still deeply connected to the legal question of how one can still learn about their service without tracking single users when they don't give their consent, maybe now even via DNT header.

Yes, you get more persistent attribution data for ad campaigns/whatever without consuming any personal information.

> Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

That is personal information.

Elaborate?

For a thousandths time: GDPR prohibits the collection of personal information without informed consent.

It does not matter how you collect that personal information, so whether you use cookies, pen and paper, the digital equivalent of a rube goldberg machine or UUIDs in the URLs — totally meaningless. As soon as you process the IP and use that information for any purpose not considered legitimate interest you are on the hook (and no: if you are in doubt it is not legitimate interest).

Many wrongly believe GDPR is about cookies. It is not. It is about the information and the consent. So whether you change the collection mechanism doesn't make any difference if you still collect the info. It just means you now have to update your consent banner to include that new way of data collection as well ; )

Nobody here is talking about GDPR except you.

A interesting way to show that you got no clue why people put cookie consent banners on their websites.

Let me give you a hint: Because they are required to do so by law (at least in the biggest free market on the planet). Now maybe you can figure out how that law is called and why it is relevant in a discussion where the topic is DNT and a German court ruling it needs to be honored.

We are not discussing whether tracking is technically possible — that would be a pretty short discussion: Yes it is possible. So we are talking about something else. And if we are not talking about the law, why did you even feel a need to come up with a way of circumventing it?

You clearly haven’t been following along and instead jumped to beating the same dead horse you admit to having beat so many times before.

To summarize: we’re talking about technical solutions to linking sessions across independent devices. What’s your “short discussion” answer to that?

My answer to that is that this is trivial from a technical standpoint. Serving each endpoint with an UUID or URL parameters to figure out who shares what with whom is not a new thing and has been used for ages.

So when the headline says »German court prohibits Linkedin from ignoring DNT signals« the interesting point isn't what is technically ancient history, but what that new legal reality might mean in practise for those of us who build, maintain and run the things that are affected by said legal reality.

Or what more did you have to say than hint at one very obvious and noticable way to do tracking?

So you just jumped into a thread that had nothing to do with you to complain about how it doesn't solve your particular problems, despite never claiming to?

I don't know you and I am sorry if my multiple initial comments felt to aggressive, they were not about you per se. You believe my comments had nothing to do with your remark, I demonstrated and explained the opposite. I am open to reason, but you did not tell us once why your remarks have nothing to do with the laws mentioned inside this comment section.

So from my perspective: No. I jumped into a particular thread that seemed to imply one could "get around" that particular legal issue with a technical fix, which is just false. You sure can do that but it will not make the legal risk go away, just because you are not using cookies.

Now of course you could again go and attack the messenger instead of telling us why a technological workaround for a legal issue has nothing to do with the legal issue inside the comment section on said legal issue. Now because all of this could just be one great misunderstanding I am going to assume you don't know that much on the legal side of the issue and my comments on "your" thread came across as aggressive which raised the heat unnecessarily and was not my intention.

My remarks were in reply to the comment I replied to, which stated:

"No cookie or localdb or browser fingerprinting is going to tell you whether someone looked at a site once on their home computer, again on their phone while commuting, and again on a work computer to show colleagues."

My intention was to provide a mechanism for solving this problem. GDPR or even Europe in general has nothing to do with it.

Are "return visits" really a big concern? I don't care if a site tracks my return visits, as long as it's local and not via a hidden Facebook pixel, Google Analytics, etc. that will get added to their global profile about me.

Doesn't matter if you care. IPs have been ruled to be personal information and GDPR mandates that the collection of personal information requires informed consent — regardless of whether you use cookies or some other mechanism to do so.

If you don't care, switch on DNT and never see those banners again (assuming this ruling preveils).

"Awareness" nonprofits are scams.

By this logic, anybody who does any coordination with anybody is scamming. Some nonprofits are scams, and some businesses are scams. Most businesses are not scams, and most nonprofits are not scams either.

>anybody who does any coordination with anybody is scamming

Scam: "a dishonest scheme; a fraud; a swindle"

I would argue, outside of our closest relationships, the majority of people are attempting to, or engaging in some kind of scamming behavior in at least half of their interactions.

At this point, 2023 worldwide, fear and distrust are table stakes for social interaction

I've been around long enough to know that it's the same as it ever was. I don't think it's a majority, or ever has been a majority, that engage in scamming behavior. I could be wrong about that, but I don't think the ground truth has fundamentally shifted.

But that the majority must still behave rightly paranoid that it is the majority in order to protect themselves from a really pretty small minority.

>I've been around long enough to know that it's the same as it ever was

Yes well the whole point is to make things better - not just keep them the same

I'd say "cautious" rather than "paranoid".

This relates to a piece of advice I gave my children: most people are fundamentally good and decent. A small percentage are not. The problem is that you can't tell which is which just by looking at them.

I wouldn’t. The internet has been a game changer for scammers. Back I. The day, you could still run a boiler room, but it was an actual office in the US law enforcement could raid.

What a sad life it must be to be constantly fearful and anxious of every social interaction.

To be clear, I don't personally operate from this assumption nor does my community (generally)

However it is unquestionable that the default mode for humans in America to operate is out of fear - and the opposite is by exception

I'm a human in America and that's certainly not the "unquestionable" default mode that everyone operates on.

Is it really unquestionable?

Sounds like you're conflating scammy behavior with behavior that furthers one's goals. Just because something someone does furthers their agenda doesn't mean the person they interact with doesn't also get something out of the interaction, and it doesn't mean they were deceived in any way.

Even in human interaction amongst your closest friends and family, they only interact with you for their own benefit - that just happens to be in pursuit of the endorphins/dopamine gained when they spend time with the people they share memories with, and it happens to be reciprocal.

I refuse to make this assumption. Maybe I'm wrong, but I'm getting a lot of mileage from assuming kindness and honesty at the start of every interaction.

Well, with exception of those which need to be shot with Hanlon's handgun[0]. There's surprisingly many of those, and not where people would suspect (e.g. I see it more often interacting with small businesses than with larger ones) - but in most interactions with others, I find it best to not reach for the handgun until it's clear it's needed.

[0] - "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice." -- https://news.ycombinator.com/item?id=21691282

> in most interactions with others, I find it best to not reach for the handgun until it's clear it's needed

This is excellent advice for both metaphorical and literal handguns.

Our economic system is based on systemic incentives promoting malice. I'm surprised how people aren't more scammy given how greatly it's incentivized.

Large corporations where all human values are made illegal are quite shining examples how humans should operate in our system. This is sadly quite common in non-profits too.

> I'm getting a lot of mileage from assuming kindness and honesty at the start of every interaction.

I agree with this, but there are situations where because of obvious incentives you cannot make this assumption. Car salesman treating me like his best friend? I wonder why?

Damn, that's a dark worldview. My personal experience in life indicates it's not even close to true, fortunately.

"the majority of people are attempting to, or engaging in some kind of scamming behavior in at least half of their interactions."

I think the numbers are way lower, but it is an old, archaic idea, you do good for your tribe/family - by taking from anywhere outside of the tribe. Stealing from the tribe is very bad and might get you killed. Stealing from another tribe however is not stealing, but reputable work, as long as there are no established friendly relations to that tribe. Many people indeed operate with this mindset (consciously or not)

But all in all I would rather say, that the number of people who consider all of humanity their family, is increasing.

This just isn't true, certainly in the sense that I meant it. What about a breast cancer charity who wants to raise awareness of the early signs of breast cancer? A domestic violence charity who wants to raise awareness of the signs that a friend of yours is the victim of domestic violence? There are countless examples like that that I'm sure you could have come up with rather than a flippant dismissal.

“ In those circumstances if you want figures to present to the board in terms of ROI”

This sentence shouldn’t be associated with anything “non-profit”

Proving yet again that, unless you structure your organization differently than every other capitalist thing (which means you won’t get funding through traditional sources) then you’re just helping capital further entrench their positions of power

It makes perfect sense regardless of funding source.

You want to have some kind of impact, and you end up having to spending money to do that. You want the most impact and your funding is limited.

"Return on investment" has nothing to do with spending

It absolutely can do. You're trying to force a very narrow view of a simple but broadly applicable concept.

I'm suggesting that in the long run, any organization that is hierarchically "overseen" by humans with outsize power compared to the employees (aka a "Board" of special people that are better and smarter and more politically well placed than disposable employees), will inevitably exploit the structure for selfish gain with a probability of 1.

The STRUCTURE is wrong is the point.

The entire concept is built around would-be-aristocrats (Board) coercing the management and employees into allocating property (Money) based on their whim with no accountability or democratic function. It is built to exploit.

Instead they should organize as a non-stock cooperative so that is effectively impossible to exploit. That's the actual answer.

But you should want an ROI as a non-profit. If you spend $1000 on advertising to get people to write their Senator to help push for/against a bill, you want to make sure you're spending it on the most effective way. If it gets spent on mail ads and no one calls, then that is largely a waste of money (regardless of funding model and org structure). If you don't have a measure, you can't really know if money is being wasted. You can guess and have a gut feel, but not scientific, actionable data to change how the org is working to best further the non-profit's cause.

Maybe you can call it something else, but for a non-profit ROI is just answering the question "Are we spending our money wisely?

Or were you referring to the non-profit having a board?

Yes, you absolutely want a board and accountability on how the money is spent.

I trust a non-profit "board" about as much as a slave court judge

https://www.joangarry.com/dysfunctional-boards/

A board (no need for scare quotes) is a legal requirement for tax exempt (501c3) status. And not sure what point you're making with the linked article which is about (relatively mild) board dysfunction, not scamming or illegal behavior.

Presumably the board could be made of every single employee of the non-profit (perhaps with varying voting power depending on factors such as seniority or experience)?

"ROI" just means "return on investment". It doesn't automatically mean that return is monetary. A nonprofit getting results in terms of accomplishing their purpose is getting good ROI.

Most definitions of ROI refer to monetary return. That's why it's typically a percentage.

Using concepts like ROI for non-profit operations is one of the signs how everything is made to emulate business.

Reply on news.ycombinator.com