> Integrating the tracking parameters into the path in a non-separable way is going to happen eventually, though.

Ugh, please don't give them any ideas

This is going on for a while on facebook afaik. On youtube and twitter they are still a url param that you can strip out.

TikTok has possibly the most nefarious version of this: When someone shares a video, a link is created that’s specific to them. It’s a short link that looks like a regular one, while the tracking params are shown only after someone goes to the link and the shortener resolves it. If it opens in the app through deep linking the tracking has happened transparently.

This (ostensibly) empowers the user-facing "feature" whereby you're presented the "User XXX is on TikTok, you should join them!" modal when you click their link. Which is perhaps better than no end-user impact at all.

This is still illegal. GDPR is NOT about cookies ("the collection mechanism"), but about the data being collected ("personal information").

So as long as you are collecting personal information, there is no legal difference whether you do it via cookies or another different mechanism.

GDPR is not about consent or data being collected. If it were, the EU would not penalize violators based on a (largely irrelevant) PERCENTAGE OF GLOBAL REVENUE for a breach.

I'm an external auditor. The GDPR is a cash grab.

Regulations that actually incentivize organizations toward stronger privacy and protection practices are designed more like HIPAA or PCI where the MAGNITUDE OF THE BREACH is the primary factor determining the monetary fines imposed (e.g.,number of records exposed, was it PII, PHI, etc.).

Taking 4% of the company's annual revenue from the previous year, irrespective of the size of the breach, results in a regulation about as effective as clicking those cookie consent boxes. "Oh thank goodness I gave my consent, I think now we can all rest easy that our data is being handled securely and appropriately!" No, the EU included the ticky tacky consent requirement to create major global visibility about itself so that when a company doing business with the EU has a breach, they won't be surprised when they then get an additional bill from the EU for not only having the breach, but now being in violation of the GDPR too.

The GDPR is a despicable joke. And my use of 'the' gives me the right to that opinion. If anyone else out there was involved in GDPR's creation or implementation, I think you would agree:

GDPR owns the Greatest Dung Pile Record, Grandma's Dildo Paste Replenisher, the Gagging Damaged Penis Rectum and one Gigabyte of Dick Punch Radiation in addition to €2.83 billion (as of 12/2022) collected from breached companies in 1,401 cases for "violating the GDPR".

[delayed]

Respectfully, you're talking nonsense.

The GDPR doesn't mandate fines of 4% regardless of the nature of the breach. That's the maximum size of the fine.

You should go ahead and actually read the text of the GDPR. Specifically, Article 83.

Paragraph 1 states that "the imposition of administrative fines [...] in respect of infringements of this Regulation [...] shall in each individual case be effective, proportionate and dissuasive".

Paragraph 2 lists eleven factors that the SAs have to have regard to when setting fines, and top of the list is "the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them".

Assuming it remains legal.

Many folks assumed DNT is useless. Yet here we are comenting in a thread about a court that is making it legally enforceable.

> Assuming it remains legal.

How exactly do you legally enforce "each link must not be a unique UUID generated per-user or per-page-view"? Do you mandate how "generic" a link has to be, such that a visit to that link exposes less than a certain amount of information about that visit? What about things like order-specific links on a shopping website, that will naturally identify an account if all orders share the same namespace?

[delayed]

Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

And how do you track that amount of data without collecting the datum of which user shared what to whom? Sure you could anonymize it etc., but by that point you already processed data that has been ruled personal data without consent.

The truth is, that we had some rulings on what is considered personal data and what isn't and IP adresses, even parts of them can be regarded as such. Now you and I might think this is silly etc., but if we write software for corporations that have to pay fines as a feaction of their total revenue not knowing that can easily ruin our lives.

And I am merely reflecting the way how these laws have been interpreted and ruled on so far in the comment section for an article on, well another ruling by a court. Legal reality, like physical reality doesn't go away if you close your eyes.

For one, it'd be a potential way to maintain a sophisticated full-conversion lifetime A/B testing setup with no PII of any sort ever hashed/retained. No IP addresses required, or anything else.

Just counting the times someone requested that particular UUID could indeed work — provided you don't store which IP requested that UUID-endpoint anywhere on your webserver or elsewhere, because then we could infer that relationship again. So this sounds like a good idea.

Is this what you originally meant?

Nontheless I hope you can see in which way the whole thing is still deeply connected to the legal question of how one can still learn about their service without tracking single users when they don't give their consent, maybe now even via DNT header.

Yes, you get more persistent attribution data for ad campaigns/whatever without consuming any personal information.

> Nobody here is talking about collecting personal information except you either. The goal is simply to track the amount of sharing various pages experience.

That is personal information.

Elaborate?