Hacker News Reader

Comment by Neikius | Hacker News Reader

you CAN use analytics! Just need to use first party analytics... it is not so hard to set up, there are many opensource self-hosted options.

I hate how everyone and their mother ships all my data to google and others just because they can.

View on HN

Let's not deceive ourselves -- first-party analytics are much, much harder to set up, and a lot less people are trained on other analytics platforms.

They're also inherently less trustworthy when it comes to valuations and due diligence, since you could falsify historical data yourself, which you can't do with Google.

The regulation is only concerned with cookies that are not required to provide the service. It makes no differentiation between first party and third party - if you use cookies for anything optional (like analytics) you need consent. So you can have third party non-cookie analytics for example without a banner.

Do you know an analytics service that actually does this? I've seen a bunch of "consentless" analytics solutions that seem to be violating GDPR one way or another because they use the IP address as an identifier (or as part of one).

Can you actually do meaningful analytics without the banner at all? You need to identify the endpoint to deduplicate web page interactions and this isn't covered under essential use afaik. I think this means you need consent though I don't know if this covered under GDPR or ePrivacy or one of the other myriad of regulations on this.

> You need to identify the endpoint to deduplicate web page

You can deduplicate but you cannot store or transmit this identity information. The derived stats are fine as long as it’s aggregated in such a way that preserves anonymity

How would you deduplicate without a unique identifier or fingerprint of some sort (which would not preserve anonymity)?

No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not. The goal of analytics is to see how people in general use your website, not how an individual person use your website.

So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie. Hash it together. Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes). And yes, if the user changes browser preferences, then they will get a new hash, but who cares?

Not rocket science.

> No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not.

Sure you do if for example you want to know how many unique users browse your site per day or month. Which is one of the most commonly requested and used metrics.

> So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie.

That looks a lot like a unique identifier which does require a user's consent and a cookie banner.

> Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes)

The EU Court of Justice has ruled in the past that hashed personal data is still personal data.

> And yes, if the user changes browser preferences, then they will get a new hash, but who cares?

It will also happen after 30 minutes have passed which will happen all the time.

> Not rocket science.

And yet your solution is illegal according to the GDPR and does still not fulfil the basic requirement of returning the number of unique users per day or month.

Is your data retention

1. Necessary

2. Legitimate

3. Proportionate

4. Limited

If so, fire away you have nothing to fear but the limitations of your own compliance people.

So take the IP, browser agent, your domain name and some other browser identifiers, stick them together and run them through SHA3-256, now you have a hash you can use for deduplication. You can even send this hash to a 3rd party service.

Or assign the user an anonymous session cookie that lasts an hour but contains nothing but a random GUID.

Or simply pipe your log output through a service that computes stats of accessed endpoints.

None of this requires a cookie banner.

I think this scheme still requires consent since you are processing pseudo anonymous identifiers that fall under personal information without the essential function basis. Hashing is considered insufficient under the GDPR iirc. Have you asked a lawyer about this?

Reply on news.ycombinator.com