Do cookie-free analytics need cookie banners?

I use JS to record the amount of visitors (technically pageviews) that reached the end of an article on my blog to get a sense for completion rate. Surely that is not too much?

It was always about tracking but the hid it behind the euphemism cookie

Most of these "cookie free" analytics vendors keep talking about how cleverly they have anonymised the data, but this article finally gets it right: That does not matter for cookie popups. Anonymisation is only relevant to GDPR, but you still need cookie banners under the ePrivacy directive.

Sounds like the early days of the web, when cookies weren’t widely used.

User sessions were created with a URL query parameter, like `?sessionid=`, and every page would pick up the sessionid and include it in every link on the page.

There's a distinction between first-party data and third-party data. You can view your own server logs - but sending over user data to a service like Google Analytics is what is regulated.

You can turn on the referrer header for same site, however I suspect the author would argue that this would be contrary to GDPR. There is also the ping attribute on links, but again, if we accept the author's premise...

Curious to know why browser fingerprinting has a “half life” of 24h? I always assumed it would be more static compared to an IP address and therefore a more powerful tracking mechanism (albeit more shady / less legally understood compared to using IPs).

> IP address is pretty definitively regulated as PII under GDPR rules. Our lawyers consider that any sort of hash or other derivative would still be PII, and thus require consent.

Probably more helpful to phrase this as Personal Data instead of “PII” as the latter does not appear in the GDPR once and the former is much broader in scope than pii data.

> At the end of the day, TCP/IP is inherently a non-anonymous protocol, as fundamentally as your home address is known to the mail system

Yes. And the irony is that the German "privacy purists" use the non-private system of having your actual name in post boxes instead of apartment numbers

It would be so funny if they shot themselves in the foot with it, but it's not going to happen unfortunately

> https://adnauseam.io/

I'm not sure this is a good thing. Wouldn't this make advertisers think their ads are doing better than they are? Which would then encourage them to advertise even more?

I regret to inform you that solutions like Ad Naseum are snake oil.

Bot-clicks and LLM networks are already pretty pervasive clickers of ads. Most ad networks already have ways of filtering out noisy clicks. And anyone dumping real money into ads will be smart enough to tie their ROI to conversion events, not clicks.

The "definitely not heavily lobbied" loophole that lets EU claim good press for most of the law while leaving the backdoor wide open

This is not a loop hole. Claiming that something is legitimate interest while it isn't is just good old breaking the law.

Just because computer is able to do something, doesn't make it legal.

Also: just because me or a lawyer says it's legal or illegal, doesn't automatically make it. This sort of thing needs to go to court.

Yes, yes, yes.

By the way: this also aligns with the implementations of the ePrivacy directive done by individual countries.

Just go and read individual laws of each country, but the myth that "even login and shopping cart cookies need consent" is just a myth. It would be impossible to comply to both ePrivacy and GDPR if this was the case.

As much as the cookie banner industry is trying to tell you, you don't need TrustArc, OneTrust or other shady products on every website. Just don't do shady shit. First because you don't need it, second because, as you said, these products are almost always doing some illegal shit.

For my mom‘s small business, I actually tried to craft something compliant by hand (because I can). It’s surprisingly hard to get it right! Like, don’t load external scripts unless consent has been given, reflect that in the interface, and allow to withdraw consent. For example, there’s a maps embed showing the store address. But that’s can only be displayed if you actually consent to the prompt! So that means you’ll need to hold a list of script sources to add to the document head if the respective category has been accepted, but not earlier. Most implementations get this wrong, loading third-party scripts and snippets in normal script tags, assuming the users will consent anyway.

As with all legal questions (IANAL): it depends. Can you demonstrate legitimate interest for "using" those parts of the IPv4 address? If yes, then no.

The IPv4 address combined with a timestamp identifies the typical person almost uniquely. Tracking this data over time allows narrowing it down further. This makes it PII for all intents and purposes.

Anonymizing an IP adress by truncating it is a form of processing. So technically you are "processing PII" which makes this subject to the GDPR. If the result is sufficiently anonymous, any data that is attached to further is probably not considered PII unless that additional data helps de-anonymizing the truncated IP. I guess you could have situations where the first two parts of the IPv4 are sufficiently unique in your data set for it still to be sufficient to uniquely identify a person (e.g. when you know that only one IP had these first two parts in the given context) but that's a freaky edge case.

PII or not, the more important question is what legal basis you have for storing and processing it. Consent is one mechanism and it's what requires "banners" - or really: consent forms, as the legally required default action is "reject all non-essential" even if most implementations blatantly ignore this and pretend otherwise - and note that "essential" here means "not requiring consent".

So if you have a different mechanism, you're golden, although truncating still makes sense given that it complies with the requirement for "data minimization" (i.e. being frugal in what you collect). "Legitimate interest" could for example be security-based. You should also make sure to only store this data as long as actually necessary and err on the side of that duration being shorter than longer.

> Moreso it could be argued that this is needed for making the site work (legitimate interest).

If you process the UA to "make the site work" then yes. One example for that would be a site that has the purpose of showing the visitor their user agent string (like "what is my IP?" sites do for your IP). Another might be to provide a different view for mobile devices though that has largely been solved with responsive design.

If you process the UA to fingerprint visitors to "improve the experience" by showing them ads or performing usage analytics over time to see what works and what doesn't, that's different. Arguably analytics can have a legal basis other than consent but that doesn't give you a carte blanche for what data you can use and how.

> it is not being stored

That doesn't really matter as long as it is PII as processing PII still requires a legal basis even if you don't store it. Collecting, processing, storing and sharing all require a legal basis even if that basis might be trivial.

He links to an overview of national implementations: https://matomo.org/faq/general/eprivacy-directive-national-i...

The author clearly states they are aware of this and links to an analysis of the implemented laws:

“Note that this is a directive, not a regulation, meaning it is up to the individual EU countries to implement the directive into law. We’ll arbitrarily ignore this distinction, and I will only be considering the wording of the directive itself in this article.

If you’re interested, the guys over at Matomo have done the hard work of looking at the implemented laws. Worth a read!”

The ePD is intended to be replaced by the ePR but the ePD has already been implemented in several countries so it's a good abstraction of those implementations if you don't want to look at the specifics of each one individually.

> Some states like Germany didn't change any laws at all regarding the EPD.

This is false. Germany implemented the ePD[0] by replacing the TKG with the TDDDG in 2021. You may have missed this as it wasn't a big news story and German law still awkwardly refers to "telecommunications" when also talking about the Internet.

> EU Regulations like the GDPR are different.

Yes, that's why the ePR will largely replace the implementations of the ePD by acting as directly binding law for all EU member countries rather than requiring individual implementations.

[0]: https://www.bfdi.bund.de/DE/Fachthemen/Inhalte/Telemedien/eP...

> Nachdem der deutsche Gesetzgeber zuletzt mit einer Novelle des Telekommunikationsgesetzes (TKG) und dem Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) zum 1. Dezember 2021 noch die europäischen Vorgaben aus der E-Privacy-Richtlinie in deutsches Recht umsetzte, wird die künftige E-Privacy-Verordnung unmittelbar in den Mitgliedstaaten gelten.

Emphasis added. Highlighted part approximately translates to "the ePrivacy guideline was implemented in German law".

The user agent string by itself is not PII. The user agent string in context can be PII.

Here's an example you might be familiar with from a business setting: sometimes you can't disclose the identity of certain customers but you really want to talk about them as a reference when selling your product. So instead of "Microsoft" you might say "a big company from Redmond". You're not identifying which company you are talking about but you're providing enough context clues to narrow it down to the point where the most likely company you might be referring to is Microsoft. If you then go on to say something about "the big company from Redmond", that information will clearly be tied to Microsoft (or a very small group of companies where Microsoft is the most likely one) and you might be violating the non-disclosure agreement without ever having explicitly named the customer.

Back in the day, a user agent string would only tell you the OS and browser, with version numbers often only narrowing it down to maybe a year or so. But with browser and OS releases becoming so frequent, the exact version numbers alone will already often vary even between users using "the same" browser and OS and additionally it may sometimes contain information about plugins and other installed software. Alone this is unlikely to narrow it down enough to qualify as "personally identifiable" but that depends entirely on what else you store alongside it (and things like timestamps are definitely additional important context clues).

Some sites need them, or they would not exist. A page with ads, where the advertisers what to know, at mleast, how many times their ad was displayed. They have an aproximation of this number for printed press, for TV, for the radio.

I have a lot of sites that are also banner free, but they are paid with other means (usually grants). But when the money ends, the sites go down.

The sad thing with analytics is that the dreadful banner makes it look like my site that only sets a cookie to know what is an unique visitor looks the same than other site that collects hundreds of data variables and then sell the data to hundreds of third parts, making the data sharing a business in itself.

Is it popular?

Totally unrelated to cookies, but: Looks like a nice product! Have you figured out a way to integrate with ECS / Fargate? That's where our high volume ALBs are pointed at.