Re:Ask HN: What is the least obnoxious way to ask for cookie...
by culturedsystems on Friday September 29, 2023 @05:57PM
(#37710602)
The language in the UK version of the law is "strictly necessary for the provision of an information society service requested by the subscriber or user", which the ICO interprets as meaning "it must be essential to fulfil their request". I don't think tracking page views counts, because it's technically possible to serve a page without using a cookie to track that it was viewed.
Re:Ask HN: What is the least obnoxious way to ask for cookie...
by starbugs on Sunday October 01, 2023 @03:50PM
(#37729874)
You might be referring to some other law than GDPR?
I was referring to the GDPR as pointed out in my comment.
There even is a GDPR recital that explicitly states:
"[...] The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
Re:Ask HN: What is the least obnoxious way to ask for cookie...
by t0mas88 on Tuesday October 03, 2023 @01:09AM
(#37748192)
You're forgetting about the ePrivacy directive (or "cookielaw"). That has nothing to do with whether the information is identifying or not, you need permission for everything that isn't strictly necessary to deliver the service the user requested.
Analytics is not strictly necessary to deliver the service.
The easiest thing to do here, is to simply not associate those sessions with a particular user. Even if your user accounts are tied to specific PII for essential purposes of your app. As long as the tracking data is not connected to that identifier, does not log any PII data on it own, and is not shared with third parties you do not need consent.
One quick edit: Be careful with collecting errors, its easy for backtraces to include application specific data including any PII you might have which will tie that session back to a specific user and becomes a violation.