Or, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.

This is probably correct.

On my personal web sites I'm using GoAccess, which is basically a new spin on a very old idea -- just analyzing the server's web logs.

https://goaccess.io

That's not as accurate as throwing around cookies and JavaScript, but I rarely check the log pages anyway, and when I do I'm less interested in raw numbers than I am in the relative performance of various pages. (And that's mostly just idle curiosity, e.g., are there some old articles that keep getting steady traffic from somewhere?)

Much like logging though, it's the 1 percent that isn't discarded that's important.

I agree with you by the way, but ...

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.

part of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary

I can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.

For very recent comments, click on the timestamp to get the single comment view and be able to reply.

(I had to do it here too.)

You folks might just be time limited on the reply - HN puts some brakes on "too fast" commenting

See my profile if you want, that was my first comment in hours. I think it is that sort of brake, (prevents heated discussions veing quite so quick-fire) but it's not on the user, it's on everyone for <'5 [or something] minutes ago' comments; drcongo's happened to be '0 minutes ago' when I loaded the page, so I clicked on it to reply.

Oh! Useful tip, thanks!

It would still be a violation because of how you're using it. The law isn't purely about what data you track, it's primarily about what you do with the data.

IANAL!!!! But I think, yes, there are still implications. GDPR makes no distinction about back end and front end AFAIK, it's just about what data you collect and why/purpose.

But note there are other reasons you can have for collecting data other than consent (something often overlooked) - for example I would guess GitHub would log IP addresses in the back end for a limited time for spam fighting reasons, and I think that would be fine.

To my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.

There are six legal bases for processing personal data, consent is only one of those.

Would that mean that you need consent for storing IP addresses in logs?

It depends on what you use them for, but I think you would need it documented that you do it and why.