Hacker News Reader

Comment by vouwfietsman | Hacker News Reader

> Why would EU governments use cookie banners

They generally don't, because you don't need banners to store cookies that you need to store to have a working site.

In other words, if you see cookie banner, somebody is asking to store/track stuff about you that's not really needed.

Cookie banners were invented by the market as a loophole to continue dark patterns and bad practices. EU is catching flak because its extremely hard to legislate against explicit bad actors abusing loopholes in new technology.

But yeah, blame EU.

And before you go all "but my analytics is needed to get 1% more conversion on my webshop": if you have to convince me to buy your product by making the BUY button 10% larger and pulsate rainbow colors because your A/B test told you so, I will happily include that in the category "dark patterns".

View on HN

you CAN use analytics! Just need to use first party analytics... it is not so hard to set up, there are many opensource self-hosted options.

I hate how everyone and their mother ships all my data to google and others just because they can.

Let's not deceive ourselves -- first-party analytics are much, much harder to set up, and a lot less people are trained on other analytics platforms.

They're also inherently less trustworthy when it comes to valuations and due diligence, since you could falsify historical data yourself, which you can't do with Google.

Can you actually do meaningful analytics without the banner at all? You need to identify the endpoint to deduplicate web page interactions and this isn't covered under essential use afaik. I think this means you need consent though I don't know if this covered under GDPR or ePrivacy or one of the other myriad of regulations on this.

> You need to identify the endpoint to deduplicate web page

You can deduplicate but you cannot store or transmit this identity information. The derived stats are fine as long as it’s aggregated in such a way that preserves anonymity

How would you deduplicate without a unique identifier or fingerprint of some sort (which would not preserve anonymity)?

No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not. The goal of analytics is to see how people in general use your website, not how an individual person use your website.

So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie. Hash it together. Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes). And yes, if the user changes browser preferences, then they will get a new hash, but who cares?

Not rocket science.

> No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not.

Sure you do if for example you want to know how many unique users browse your site per day or month. Which is one of the most commonly requested and used metrics.

> So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie.

That looks a lot like a unique identifier which does require a user's consent and a cookie banner.

> Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes)

The EU Court of Justice has ruled in the past that hashed personal data is still personal data.

> And yes, if the user changes browser preferences, then they will get a new hash, but who cares?

It will also happen after 30 minutes have passed which will happen all the time.

> Not rocket science.

And yet your solution is illegal according to the GDPR and does still not fulfil the basic requirement of returning the number of unique users per day or month.

Is your data retention

1. Necessary

2. Legitimate

3. Proportionate

4. Limited

If so, fire away you have nothing to fear but the limitations of your own compliance people.

So take the IP, browser agent, your domain name and some other browser identifiers, stick them together and run them through SHA3-256, now you have a hash you can use for deduplication. You can even send this hash to a 3rd party service.

Or assign the user an anonymous session cookie that lasts an hour but contains nothing but a random GUID.

Or simply pipe your log output through a service that computes stats of accessed endpoints.

None of this requires a cookie banner.

I think this scheme still requires consent since you are processing pseudo anonymous identifiers that fall under personal information without the essential function basis. Hashing is considered insufficient under the GDPR iirc. Have you asked a lawyer about this?

The regulation is only concerned with cookies that are not required to provide the service. It makes no differentiation between first party and third party - if you use cookies for anything optional (like analytics) you need consent. So you can have third party non-cookie analytics for example without a banner.

Do you know an analytics service that actually does this? I've seen a bunch of "consentless" analytics solutions that seem to be violating GDPR one way or another because they use the IP address as an identifier (or as part of one).

In terms of whether or not the ubiquity of cookie banners is malicious compliance or if it was an inevitable consequence of GDPR, it doesnt matter if trackers are good or necessary. GDPR doesn't ban them. So having them and getting consent is just a normal consequence.

We can say, "Wouldn't it have been nice if the bad UX of all these cookies organically led to the death of trackers," but it didn't. And now proponents of GDPR are blaming companies for following GDPR. This comes from confusing the actual law with a desired side effect that didn't materialize.

No, those companies do not follow GDPR. They are testing how far they can go without triggering mass complaints etc.

See https://noyb.eu/en/where-did-all-reject-buttons-come

> And now proponents of GDPR are blaming companies for following GDPR.

Not really, proponents of GDPR are aware that GDPR explicitly blocking trackers would be extremely hard as there is a significant gray area where cookies can be useful but non-essential, so you'd have to define very specifically what constitutes a tracker or do a blanket ban and hurt legitimate use-cases. Both are bad.

For some reason though people think that the body that institutes laws that try to make the world a better place, when loopholes are found and abused for profit, this is somehow the standard body making a mistake, rather than each individual profit-seeking loophole-abusing entity being the problematic and blame-worthy actor.

I never understand why, I guess you work somewhere that makes money off of this.

Reply on news.ycombinator.com