Hacker News Reader

Comment by ddalex | Hacker News Reader

The consent MUST be received before storing cookies. As Apple stores the cookie without consent, they break the law, even if the cookie is never read by anybody without consent.

View on HN

Is consent required before setting a MAC address on a NIC? I don’t think it’s the NIC manufacturer’s duty to get consent because others fingerprint devices using the MAC address.

Someone please correct me if I'm wrong but I think things that are required for the functioning of the program/device/service are exempt

... and how is Apple supposed to know whether the cookie that is essential or not? This is precisely why the onus is on the website owner.

If the device can work without that ID (which Apple admits it can, since they say they never READ it), then obviously it's not essential

This is the correct view on the matter, in case the grayed out reputation makes you doubt it.

why is this the correct view?

I didn't elaborate because there really isn't any more to say about it. If you've read up on how the GDPR works and know what essential means, you will see this person is correct.

For what it's worth, I have been involved with implementing the GDPR properly in a number of reasonably large companies. Sadly a number of people can say this and a vanishingly small amount of companies actually adhere to it properly, so I'd take it with a grain of salt.

They are exempt from consent but not from the law. Also, GDPR is not about things but their processing purposes. If you use my MAC address to address my network traffic, that's a legitimate business need; no consent is needed. If you use the same MAC address to track me, you need consent.

Right, but Apple isn’t using the adid to track anyone (other than traffic to its own sites). So the gdpr aspects apply to sites, not the phone maker.

What you are saying is that if the websites fingerprints a Chrome browser instance without consent, Google is liable for that.

> The consent MUST be received before storing cookies

I don't think we have any disagreement about that. We are discussing who is liable for failing to follow GDPR here.

It’s not a cookie. Idfa isn’t even available in the browser.

A distinction without a difference as not every interaction involves a browser. It can be used in the same manner as an identifier cookie (it doesn’t carry a payload) for cases that do not involve a browser.

It’s not a distinction without a difference.

Some people here seem to think it is available in the browser. Using the word ‘cookie’ furthers that false belief.

I otherwise agree with you.

The term “magic cookie” in the sense used by browsers predates the WWW. That’s why the term was used.

True, but the term ‘magic cookie’ is not the term we use today. If you said magic cookie I’d know you were using the historical term. I’m old enough to remember but most people here are not.

Reply on news.ycombinator.com