Hacker News Reader

Comment by __alexs | Hacker News Reader

Slightly off topic: Plausible claim that their cookieless tracking is GDPR compliant but this seems a bit shaky to me. Unless they are doing something that isn't specified in their docs their fingerprinting seems reversible which would make their user identifiers PII like any session ID you'd store in a cookie.

AIUI the GDPR doesn't particularly care about cookies, it cares about you tracking people without their consent. If you have a cookieless way of tracking individual people that is as accurate as cookies then clearly you still need consent?

View on HN

Even if this hash would include a salt and the salt is rotated daily, you'd still be able to reverse information for the last day (there's an interesting doc by the European Union itself on that topic: https://edps.europa.eu/data-protection/our-work/publications...).

I feel most of these "privacy" focused analytics tools are mostly about working around the need for a cookie banner. I also don't get how they can continue to show off their public dashboards full of data that has been collected without user consent, boasting about how many hits they have.

Gives me the feeling "Privacy" is more of a marketing tactic here than a mission.

The thing is the "cookie banner" is not required simply because you use cookies. Consent is required for any processing of PII regardless of the technical means through which you get it.

I don't know if "privacy" is just a marketing tactic but I have definitely seen a lot of misplaced good deeds based on not understanding the regulation correctly.

Correct, the rulings to date have generally involved cookies, but it's the act, not the tool.

It seems on-topic, since the post is essentially advertising the Plausible.io service.

> In summary, here’s how we assign a hash that we use for unique user counting:

  hash(website_domain + ip_address + user_agent)

Would adding a daily salt to this make it compliant? You'd no longer be able to track if someone returns to the website the next day.

https://plausible.io/data-policy

You also have to adhere to the ePrivacy directive, which specifies, among other things, how you are allowed to identify users on their devices (e.g. using cookies).

I don't have a link on hand, but I posted about this recently in an HN article about Fathom.

There is an ePrivacy Directive ammendment that specifically prohibits the use of hashing identifiers (e.g. IP address, browser, OS) to work around cookies, even it a timestamp is introduced to limit the life of a hashed ID.

I'm a privacy advocate myself, yet find this a bit OTT - but that's the ePrivacy regulations, and I think Plausible could get burned here at some point. Presumably they know about this amendment and are betting that there will be no enforcement, or their lawyers have found a weasel-wordy loophole (I doubt the later, as the directive is very specific).

I think this is the document you are referring to: https://ec.europa.eu/newsroom/article29/document.cfm?action=..., Revision of Article 5(3)

Yes. GDPR is about collection and processing of personal information. How you collect them is not important. HTTP cookies or fingerprinting and successive deanonimization is the same as getting the name and address with a form on paper. You need consent.

GDPR doesn't care about tracking, it's about data processing. How cookies are handled in a compliant manner is handled under something like PECR (in the UK at least).

https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

If data is being processed without containing PII, then GDPR becomes a non-issue.

/edit

My bad, because this tool uses cookies it does in fact require consent if it's to be used in a properly GDPR compliant manner.

It contains IP addresses, which are personally identifiable under the GDPR.

The answer is: it depends.

The GDPR allows for collection and processing without consent for several reasons including (but not limited to) legal requirement (e.g. anti-fraud) and legitimate interests (e.g. app install conversions).

The GDPR is also quite clear that consent is not required to collect _anonymous_ data, i.e. data which in no way can be traced back to the individual, but this requires balancing with the other principles of the regulation. Recital 26 of the GDPR states:

“…The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”

It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information.

Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.

I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff.

Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.

I think OPs question was if you can really collect "anonymous" analytics data from a client device without asking for consent, which you cannot really answer based on the GDPR alone. Yes, anonymous data is exempt from the GDPR, but the question is just if a HTTP request to a tracking service that contains the IP address and user agent of a persons' browser can be considered anonymous already (in most cases not). Some companies like Matomo (and Fathom, Simple Analytics, Plausible, ...) argue that you can collect tracking data without consent if you offer an opt-out to the user, I haven't been able to find a legal basis for this though. Even Microsoft asks you for consent before enabling their anonymous telemtry collection in Windows now.

Yes, I think opt-out is specifically forbidden when consent is used as a legal basis, at least under the GDPR...

It's not impossible to fingerprint people by using the GDPR consent cookie itself.

Reply on news.ycombinator.com