6 ms·

There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent eit

by tappio 2mo ago

There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.

tempestn 2mo ago
My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
- jason_oster 2mo ago
  It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
  - ApolloFortyNine 2mo ago
    How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
    - literallywho 2mo ago
      >How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
    - tappio 2mo ago
      That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, recognizing users across days requires consent. But is that really necessary?
      - anonreplier 2mo ago
        In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
      - inigyou 2mo ago
        Or use some JS to put the time-on-page in the next request, right? Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
- micromacrofoot 2mo ago
  that's not true at all, plausible can be configured to require 0 consent

by tappio 2mo ago

There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.

tempestn 2mo ago

My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.

jason_oster 2mo ago
It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
- ApolloFortyNine 2mo ago
  How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
  - literallywho 2mo ago
    >How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
  - tappio 2mo ago
    That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, recognizing users across days requires consent. But is that really necessary?
    - anonreplier 2mo ago
      In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
    - inigyou 2mo ago
      Or use some JS to put the time-on-page in the next request, right? Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
micromacrofoot 2mo ago
that's not true at all, plausible can be configured to require 0 consent