If you are tracking people without a lawful basis (e.g. consent), you are violating the GDPR. It doesn't matter if you use cookies. (The article does mention this towards the end.)
I think the blog author is misinformed about the session id? If you use that for marketing purposes, you need cookie prompt. The GDRP says only necassary cookies, if you also reuse the login cookies for purposes. It's not longer necassary right?
Otherwise it'd be so blatant loophole, you can only use cookies for their intended purposes and not reuse for them other purposes. I remember some details when i needed a way to prioritize user traffic via cookies, since lots malicous traffic dont have cookie storage, as long i didnt retain the cookie ID used for load balancing, as all information would be lost on reboot of haproxy process. I didnt need cookie prompt, but if i also used that for other purposes like visitor tracking, then I'd need cookie prompt even before setting the cookie.
For tracking uniques, why can’t we just set a “first_visit=false” cookie if not present on first request? The number of new unique users is then the number of requests that came in without that cookie in whatever time window. Expiration timeline left as an exercise for the reader (month, week, whatever).
This zero-entropy cookie cannot be linked to a specific person and would not require consent under any privacy law I think.
6 comments
[ 2.9 ms ] story [ 14.3 ms ] threadIf you are tracking people without a lawful basis (e.g. consent), you are violating the GDPR. It doesn't matter if you use cookies. (The article does mention this towards the end.)
Otherwise it'd be so blatant loophole, you can only use cookies for their intended purposes and not reuse for them other purposes. I remember some details when i needed a way to prioritize user traffic via cookies, since lots malicous traffic dont have cookie storage, as long i didnt retain the cookie ID used for load balancing, as all information would be lost on reboot of haproxy process. I didnt need cookie prompt, but if i also used that for other purposes like visitor tracking, then I'd need cookie prompt even before setting the cookie.
Im not lawyer, but thats how I understood.
This zero-entropy cookie cannot be linked to a specific person and would not require consent under any privacy law I think.