5 ms·

Cookies are not an issue for GDPR, it's all about respecting users' privacy. In fact you can freely store anonymous data to cookies, localStorage, and sessionSt

Cookies are not an issue for GDPR, it's all about respecting users' privacy. In fact you can freely store anonymous data to cookies, localStorage, and sessionStorage without issues. The problem comes when you are dealing with personally identifiable information such as permanent identifiers. You definitely need a "cookie banner" when using Simple Analytics, Fathom, or Plausible. Any service that accesses the device information such as the URL needs a permission from the user according the ePrivacy directive. We have consulted EU law specialists when building our upcoming analytics service that is as privacy-friendly as Simple Analytics, while still measuring important things like retention and conversions. More information: https://volument.com/learn/data-privacy https://volument.com/learn/data-privacy

AdriaanvRossum 6y ago
Founder of Simple Analytics [1] here. There is a lot of information around cookie banners that is just not true. For example cookies are not limited to the technology of cookies, it contains any piece of information that you can use the track a user. An IP address, localStorage, sessionStorage, ... You are allowed to add a functional cookie with a dark mode setting for example without a cookie banner. You can't use an analytics cookie without a cookie banner. What you are sharing is simply not true and I will clarify. A cookie banner is required when you store PII data. This is personal identifiable information. This includes, but is not limited to an IP address, a cookie with an user identifier, ... You are free to collect data that is not part of this without a cookie banner. You are also referring to a URL as being device information, this is not device information but basically a page view. You are allowed to collect page views and URLs that a linked to this page views with a cookie banner. You are describing retention for your business. That's only possible with a cookie banner. It makes perfect sense because you need to calculate retention somehow. If you can calculate retention and conversions you are tracking a user. So you need a cookie banner. Cookie banners are also a thing that are implemented on the web in many wrong ways. You should always have a way to disable cookies. Just a "accept all cookies" is legally invalid under the GDPR. The e-Privacy was already in place before the GDPR and the GDPR is somewhat a clarification of it. Simple Analytics does not use cookies and does not require a cookie banner. We don't track your visitors and don't calculate retention or conversions. If your service does this, they a tracking your user and you might need a cookie banner. [1] https://simpleanalytics.com https://simpleanalytics.com
- tipiirai 6y ago
  Hey. Founder of Volument[1] here. We consulted EU law specialists on this particular matter. You are right: you definitely need a cookie banner when you store or process PII data. But GDPR is just an extension to ePrivacy, which says that you also need the cookie banner when any of the device information is accessed (such as the browser URL) for non-essential purposes. The ePrivacy is just a _directive_ and doesn't oblige to anything. It's the local laws of Europe that do. We have compiled a detailed list of all the European countries and the respective laws that require an analytics service for opt-in or opt-out style banner. [2] Retention is not possible without cookies or localStorage, but you can measure retention without storing or processing any PII information. [1] https://volument.com https://volument.com [2] https://volument.com/learn/data-privacy https://volument.com/learn/data-privacy
  - klohto 6y ago
    I would argue that atleast for Czech Republic, the notice is not required if the processed data is crucial to providing the service the user requested. You cite Article 89(3) of the Electronic Communications Act, where it's stated that "... nor does it apply to the cases where such technical storage or access activities are needed for the provision of an information society service explicitly requested by the subscriber or user.". This part was also modified several times, most recently at 2018 in 20/2018 s. 687
    - volument 6y ago
      The list is only for non-essential services such as website analytics. Is there a better cite for Czech Republic? Happy to edit.
      - klohto 6y ago
        Nope, you're spot on with the citation! I got confused and thought the discussion here is around essential cookies/data :)
  - fanf2 6y ago

AdriaanvRossum 6y ago

Founder of Simple Analytics [1] here. There is a lot of information around cookie banners that is just not true. For example cookies are not limited to the technology of cookies, it contains any piece of information that you can use the track a user. An IP address, localStorage, sessionStorage, ... You are allowed to add a functional cookie with a dark mode setting for example without a cookie banner. You can't use an analytics cookie without a cookie banner. What you are sharing is simply not true and I will clarify. A cookie banner is required when you store PII data. This is personal identifiable information. This includes, but is not limited to an IP address, a cookie with an user identifier, ... You are free to collect data that is not part of this without a cookie banner. You are also referring to a URL as being device information, this is not device information but basically a page view. You are allowed to collect page views and URLs that a linked to this page views with a cookie banner. You are describing retention for your business. That's only possible with a cookie banner. It makes perfect sense because you need to calculate retention somehow. If you can calculate retention and conversions you are tracking a user. So you need a cookie banner. Cookie banners are also a thing that are implemented on the web in many wrong ways. You should always have a way to disable cookies. Just a "accept all cookies" is legally invalid under the GDPR. The e-Privacy was already in place before the GDPR and the GDPR is somewhat a clarification of it. Simple Analytics does not use cookies and does not require a cookie banner. We don't track your visitors and don't calculate retention or conversions. If your service does this, they a tracking your user and you might need a cookie banner. [1] https://simpleanalytics.com https://simpleanalytics.com

tipiirai 6y ago
Hey. Founder of Volument[1] here. We consulted EU law specialists on this particular matter. You are right: you definitely need a cookie banner when you store or process PII data. But GDPR is just an extension to ePrivacy, which says that you also need the cookie banner when any of the device information is accessed (such as the browser URL) for non-essential purposes. The ePrivacy is just a _directive_ and doesn't oblige to anything. It's the local laws of Europe that do. We have compiled a detailed list of all the European countries and the respective laws that require an analytics service for opt-in or opt-out style banner. [2] Retention is not possible without cookies or localStorage, but you can measure retention without storing or processing any PII information. [1] https://volument.com https://volument.com [2] https://volument.com/learn/data-privacy https://volument.com/learn/data-privacy
- klohto 6y ago
  I would argue that atleast for Czech Republic, the notice is not required if the processed data is crucial to providing the service the user requested. You cite Article 89(3) of the Electronic Communications Act, where it's stated that "... nor does it apply to the cases where such technical storage or access activities are needed for the provision of an information society service explicitly requested by the subscriber or user.". This part was also modified several times, most recently at 2018 in 20/2018 s. 687
  - volument 6y ago
    The list is only for non-essential services such as website analytics. Is there a better cite for Czech Republic? Happy to edit.
    - klohto 6y ago
      Nope, you're spot on with the citation! I got confused and thought the discussion here is around essential cookies/data :)
- fanf2 6y ago