Posted by royfish 1 day ago
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
The thing the site is doing that isn’t “strictly necessary” is always tracking.
It also limits the exception in relation to e.g. employment.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
The whole cookies discussion is a successful diversion by the ads industry. It was never about cookies.
The article's points still stand, but the trick didn't work this one time.
Fingerprinting itself is also not new.
The whole cookie thing has always been bs
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact