I would like to add <a href="https:&#x2F;&#x2F;pirsch.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pirsch.io&#x2F;</a> :)

Another solution is to do all the tracking in the backend. I&#x27;m not saying it&#x27;s a good solution.

Looked for a few minutes and couldn&#x27;t find the full answer. How does Plausible calculate unique users if it can&#x27;t store some type of identifier on the page?I see this... &quot;We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day.&quot;But where is that ID stored?

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year.I have a basic Github Pages site, and I currently don&#x27;t know whether anyone is looking at it, beyond the very few who take the time to email me. I don&#x27;t need (or want) to know anything about my visitors, but it would be nice to know that I&#x27;m not simply tossing stuff into the ether.

IANAL, but my understanding is that you might still need a consent box even if you use Plausible.I&#x27;ve only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I&#x27;d be interested to hear what others think.If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn&#x27;t need consent.In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible <a href="https:&#x2F;&#x2F;plausible.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;plausible.io&#x2F;</a> so you won&#x27;t need the banners either.Just don&#x27;t include facebook like buttons or any of these widgets

I am also of this position – however not everyone in my team is. We are currently investigating this in my project.Do you have an authoritative source which i can show our team regarding this?

No, it applies to every resident in EU and EU citizens all over the world.Edit: <a href="https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-3-gdpr&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-3-gdpr&#x2F;</a> (&quot;where Member State law applies&quot; and &quot;subjects who are in the Union&quot; [...] &quot;regardless of whether the processing takes place in the Union or not&quot; respectively)Edit 2: <a href="https:&#x2F;&#x2F;gdpr.eu&#x2F;companies-outside-of-europe&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gdpr.eu&#x2F;companies-outside-of-europe&#x2F;</a> for more info: &quot;The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”&quot;

Except that if the sites don&#x27;t do annoying things there is no need for annoying popups.The EU law:- doesn&#x27;t require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it&#x27;s tracking people in any way are such opt-ins needed- if you login you are known to have accepted the terms of service and as such after login no opt-in pop-up is needed either- is not limited to cookies btw.All in all this means that for any site not based on ad-revenue they fully can get away without needing any annoying popups, if they don&#x27;t do some sneaky questionable things.Even for ad&#x27;s there are ways to do them without annoying popups, you just need to not track people, tracking the number of times a website was loaded doesn&#x27;t require annoying popups, just tracking who opened it does.Similar if you track people only after they clicked on the ad you don&#x27;t need annoying popups on the site the add is one but only on the site the app navigates to (through only start tracking after opt-in). Which given that many adds try to sell you stuff and buying thinks only requires a account isn&#x27;t that big of a problem as it might seem.In the end you can say the only reason there are so many annoying popups is because most companies have not intention to respect the privacy of their users. Actually if you look into it and realize that many popups are not legally conform or borderline illegal it becomes clear that they do not only not respect the users privacy but the users themself.Through I have to note, that while many (most?) companies can switch to respectable advertisement, some companies can&#x27;t as easily do so.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

Also, it only applies in the EU. You don&#x27;t need to display any banners outside the EU.Not that I am pro-privacy invasion, I&#x27;m not, but I&#x27;m definitely anti-annoying-popups.

That&#x27;s correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.

&gt; then you still can’t use those cookies for other purposes, like analytics, right?Yes. It’s not the cookies, it’s what you make the use of them.The wording even predates GDPR. You could even dispense of the banner if you had DNT set to 1 or 0, since that would count as consent&#x2F;not consent resp.

Are we claiming that if GitHub has a dashboard like “number of concurrent sessions” and “average length of session” and “unique users who touched this feature” it would be a GDPR violation?Because I can’t imagine that they don’t.

Pure analytics is exempt of consent from the gdpr point of view from my understanding and from explanations of our local french regulator.

I just checked my cookies on the Github website and had several tracking cookies (including Google Analytics).Then I realized I should probably clear all the cookies for Github, and start over with a fresh session. So I deleted all cookies that Github had given me (which was 12) and refreshed the page. As expected, I was now logged out and Github immediately issued you me 4 new cookies.<pre><code> • _gh_sess (a fresh session cookie)

 • _octo (not sure what this is, might have something to do with cache-busting? Looks like it contains something resembling a version id&#x2F;string)

 • logged_in (my logged in status, now false)

 • tz (my timezone)
</code></pre>
All of these are valid cookies (assuming that _octo is for cache busting) that would not require a cookie banner.So then I logged in. I now have 10 cookies. None of them appear to be tracking cookies.<pre><code> • __Host-user_session_same_site (14 day session token)

 • device_id (this contains a random string to differentiate this device. Initially I was concerned with this, thinking it might be a fingerprint. But it is far too short for that, and it appears to be a flash cookie. It expires as soon as it is issued, so it only lasts one request. This is likely used to improve your experience in the case that you are logged in across multiple devices to differentiate which device is making a request within the current session)

 • gh_sess (same as before, session)

 • _octo (same as before, presumably cache-busting)

 • dotcom_user (contains a string with my github username)

 • has_recent_activity (boolean value, likely used to display &quot;unseen notifications&quot; on the front-end)

 • logged_in (same as before, except now true)

 • tz (same as before, timezone for frontend time displays)

 • tz (now have 2 timezone cookies. Both are currently the same timezone, although I assume the first one is a timezone gathered from my system clock and the new one is a timezone gathered from my github settings which they now have since I logged in. This is probably a bug where they expect to overwrite the first one, but since one is set to the github.com domain and the other is set to all github subdomains then it didn&#x27;t overwrite)

 • user_session (yet another session token with 14 day expiration. However the session token in this cookie and the __Host-user_session_same_site cookie are the same. Not sure reason for the duplication)
</code></pre>
So those are all the cookies that Github now gives you. 2 of these seem to have duplicates. Meaning the same could be done with 8 cookies instead of 10. But regardless, all cookies seem to check out. None of these are tracking your usage and are there to improve your logged in experience. Tracking things like your username and recent activity boolean are most likely being used to save making the same database queries for every request. The others are just tracking sessions, which is something that users definitely do want. The 14 day expiration is a good middle ground between convenience and security.At the beginning I mentioned that I had two tracking cookies before I cleared my cookies. These are gone after the refresh. So it looks like github has in fact stopped issuing tracking cookies altogether. They also seem to have removed Google Analytics entirely as I don&#x27;t see the script on their website at all.So all-in-all this definitely checks out. I don&#x27;t see any GDPR violations here or reason to display a cookie banner anymore.I assume they still have analytics, but the analytics are all happening server-side which provides them basics like pageviews and visitors. And since you have to be logged in to do almost anything in github they don&#x27;t need cookies to track what you do while logged in, thats all going through their servers and databases anyway.I know plenty of people here have problems with Github, but I think it is exciting to see a large company like Github (Microsoft) take this step.

Right but it still seems like this could violate the GDPR, right? They say:&gt;&gt;So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services.But you’re still only allowed to use the cookies for the purpose the user gave you them for, right?So, if:a) the cookies are essential for the user session, andb) you collect the cookies, without explicit permission, to maintain that sessionthen you still can’t use those cookies for other purposes, like analytics, right?Edit: sorry for all the “rights?”, just want to make clear I don’t convey high confidence in this claim.

I think a lot of people are willingly misunderstanding this too

How long can you keep people logged in before it becomes the bad kind of tracking?

Yes! If you use cookies for essential functionality (like keeping track of logged in status), you don&#x27;t have to do anything. No banners, no annoyance for your users.I dropped all third-party crap from my site way back and haven&#x27;t ever needed a cookie banner.

The banners are an opportunity to have the user consent to more than they would otherwise consent to (“allow all”).

You are right, and that unfortunately happened because nobody even tried to read the law (which is quite clear regarding this). It&#x27;s easier to just follow other sheep.

Part of the problem is that when it first passed, the advice was to just add a cookie banner no matter what to be safe, since no one really understood the law and exactly when it did or did not apply.

generally they are used to protect against DDOS and to have forensic data in the case there is malicious behavior and are allowed as essential to operating the service.

IP addresses are only considered PI if combined with other datapoints.

what about identifiable information like ip addresses?

I can see a need for cookies to mitigate against things like DDoS attacks, session management for paywalled content or just to leave comments on articles, favoriting certain sections. There are several reasons why as a reader you would want the site to be stateful.

Without cookies they can&#x27;t check if you closed the cookie nag.

I really hate the lies you see on a lot of new sites that they will send cookies &quot;necessary for basic functionality.&quot;You&#x27;re serving articles, there&#x27;s no reason for session tracking!

More information is in Opinion 04&#x2F;2012 on Cookie Consent Exemption of the Article 29 Working Party of the European Commission about Cookie Consent, which elaborates about the topic:<a href="https:&#x2F;&#x2F;ec.europa.eu&#x2F;justice&#x2F;article-29&#x2F;documentation&#x2F;opinion-recommendation&#x2F;files&#x2F;2012&#x2F;wp194_en.pdf" rel="nofollow">https:&#x2F;&#x2F;ec.europa.eu&#x2F;justice&#x2F;article-29&#x2F;documentation&#x2F;opinio...</a>(The §29 WP is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Maybe they are waiting for a forthcoming ePrivacy Regulation. Also: IANAL.)

Wait, is that true? You need to have a physical presence in the EU?If so, why did everyone scramble to meet the requirements. Was it a scam?

The GDPR applies to anyone anywhere processing personal information (such as IP addresses) of people inside the EU (both EU and non-EU residents).That doesn&#x27;t mean that you&#x27;re necessarily at risk of any lawsuits or effective action, but what you&#x27;re stating is wrong. Physical presence has nothing to do with it.

&gt; A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn&#x27;t the case.A lot of people also have the misconception that the EU cookie law applies to them, even if they are not in the EU and have no EU physical presence.

Well, it&#x27;s a reasonable misconception to have, banners don&#x27;t usually explain everything, they mostly say &quot;hey, we use cookies&quot;, and not &quot;hey, we use non-essential cookies&quot;.

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn&#x27;t the case.

No, they just don&#x27;t use any non-essential cookies.

Finally someone who knows this! Even (some) &quot;SEO advice&quot; blogs have suggested to just use local storage instead of cookies.Just no.Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique&#x27;s, technologies or anything like that. A good example is gdpr article 32.Fun fact: the e privacy directive (which defines the cookie rules) isn&#x27;t actually passed yet and technically you don&#x27;t need cookie banners how they are now. Purely informational banners would be enough, but the directive already _should_ have passed but was delayed, and since gdpr spooked everyone, everything and everyone is using cookie banners now anyway

Cookie is a technical solution. The law isn&#x27;t about cookies but about privacy.The alternative to asking permission to do intrusive things is to avoid doing intrusive things.

Have they found some alternative to cookies?

Right, what I meant is that only using essential cookies should be the default web development practice. Instead the default these days seems to be websites that are positively larded with third-party scripts, analytics tools, and other crap.

And, in a way, this is the standard by the fact that they are not required to show the banner if no non-essential cookies are being used :)

Remember that they have LinkedIn as well, and quite possibly could put together a fascinating view of software job profiles, candidates, and repo language&#x2F;activity to gain value entirely within their own organization. Something like LinkedIn recruitment recommendations improved with GitHub contribution activity might be a fascinating recruitment product: ads are not the only way to gain value.

I get ads on GH homepage for open positions. They seem targeted to me or maybe I just notice the relevant ones.

Wait, Google isn&#x27;t sharing your analytics data with any third parties.

Sure, but considering GitHub doesn&#x27;t have advertising[1], and they&#x27;re not sending it to a third party (like Google, who does), it&#x27;s very hard to imagine any use for first party &quot;tracking&quot; that might harm you.Presumably the most they&#x27;re using this for is recommending potentially interesting repos to you.[1] Potential concern would be if &quot;Microsoft&quot; was considered &quot;their own&quot;, since Bing does have an ad network. But my guess is between still having separate accounts and being treated as separate companies, that is not the case here... yet.

What matters is the purposes that the cookies are used for, not how many there are or which service set it.A session cookie that is also used for tracking would qualify as both a functional and a tracking cookie, and thus generally be illegal (since you can&#x27;t consent to the tracking if it&#x27;s under the threat of being unable to use the service).

They appear to be using a self-hosted analytics solution. Every page makes a request to collector.githubapp.com.

Tracking individual behaviour on their own site without notification is still illegal under the GDPR, so no, they should not absolutely be able to do that.

I presume this is indeed what they&#x27;re doing given the wording of the post:&quot;(And of course GitHub still does not use any cookies to display ads, or track you across other sites.)&quot;That exactly leaves out &quot;track you on our own site&quot;. But honestly, I have absolutely zero issue with them tracking my behavior on their own site. I know how valuable it is to be able to learn&#x2F;see what users are doing, and they should absolutely be able to do that.

The GDPR isn&#x27;t about &quot;3rd party analytics&quot;. It&#x27;s about collection of personal data as qualified by the purpose of that collection, regardless of who collects it.

If they&#x27;ve gotten rid of 3rd party analytics, does this mean they&#x27;re just using their own? Presumably session cookies count as &quot;required&quot;, and could be used to track your actions at least on github.com.

Incredible. Take note, everyone - it is possible.

For other sites I recommend the extension &quot;I don&#x27;t care about cookies&quot;. It removes most cookie warnings, makes browsing the web way less bothersome.You can also add cookie warning filters to uBlock Origin, but those doesn&#x27;t autoclick when CSS filters aren&#x27;t sufficient.<a href="https:&#x2F;&#x2F;addons.mozilla.org&#x2F;addon&#x2F;i-dont-care-about-cookies&#x2F;" rel="nofollow">https:&#x2F;&#x2F;addons.mozilla.org&#x2F;addon&#x2F;i-dont-care-about-cookies&#x2F;</a>

You can still do analytics client side without the use of cookies. You just lack the view of a user and a session sice the cookie holds the primary key used to tie events into a session. You are basically just dispatching page views and events. Your reports will not look great but it&#x27;s possible and probably will be a nice complement to a server side analytics solution.

So, they do analytics looking only at the database data?I wonder if they built the analytics system themselves or are using a COTS.

Right, I meant to imply that the user session is used by “backend goings on”, and I understand that that is stored in a cookie still

Your user session. It can even be a cookie still, because that session cookie will be required for it to work.

That was an unexpected nice gesture.I wonder what they’re using to track user activity instead, probably just a mix of server logs and the other goings on of the backend.

Github doesn&#x27;t have any ads to begin with as far as I know? So there is no ad revenue lost.

I assume that means a lower ad revenue and lower quality analytics. I wager they did a study and found the benefits of removing the dialogs outweigh the costs.Cookie dialogs are indeed horrible and out of control. Good on them for making the jump. But I doubt many others can justify the cost associated with the change. We need a better solution that gives users choice but reduce the friction caused by annoying prompts.

I spot-tested a three of them and for each one I tested, it matched the information from the user&#x27;s GitHub profile.The users might not know it&#x27;s being used for marketing on the home page, but it seems to be (again, just spot-tested) information that they provided for their &#x2F;public&#x2F; profile.Edit: NEVERMIND! Just checked a fourth and code from someone with &quot;United States&quot; in their profile showed as coming from Minneapolis.

I thought that used the bio. Interesting that it didn&#x27;t match.

The data is available unauthenticated here: <a href="https:&#x2F;&#x2F;github.com&#x2F;webgl-globe&#x2F;data&#x2F;data.json" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;webgl-globe&#x2F;data&#x2F;data.json</a>If anyone wants to do any further analytics on it, it&#x27;s easy enough to pull PRs and lat&#x2F;lon from that.It does look like lat&#x2F;lon might be a fixed value for each city (from spot checking a couple). If it&#x27;s not, that would be surprising and a pretty egregious leak of user info.

Those locations come entirely from public profile bios, as provided by the user.

This is great! GitHub continues to, somehow, surprise me.One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio&#x27;s location settings. If it is truly unmasking people&#x27;s location I think it should be opt-in only, since it is private information. An employer or state may have issues with someone opening a PR from a specific country at a specific time, for example.[0] It may be required to open this in an incognito browser.

was this mobile adblocker on android or can you also get it for iOS? am interested.

I&#x27;m an American that&#x27;s currently in Europe, and I recently downloaded a mobile ad-blocker for the purpose of blocking cookie popups. I was already blocking most tracking at the DNS level, so this was mostly for cosmetic purposes. Blocking consent banners has made browsing the mobile web so much more pleasant.

I work a lot with GDPR and making sites compliant, and some agency&#x27;s do in fact tell this to their customers. I suspect it&#x27;s to sell their Services for cheaper.Luckily where I work we are pretty serious about this stuff. Since one of our main revenue&#x27;s is Data protection consulting, anything else would be idiotic anyway

I believe it is generally untested in law whether third-party Analytics count as &quot;legitimate interest&quot; (direct consent not required) in EU GDPR, which is why cookie banners talk a lot about &quot;legitimate interest&quot; now.

I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.

There is no bright line, mostly as far as I can tell it’s session cookies and those you need to set to fulfill your contracts with the user.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I&#x27;m not sure.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they&#x27;re essential.If you block ad networks and analytics the site functions just fine -- they&#x27;re not essential.Beyond that there&#x27;s probably some sort of &quot;need to know&quot; test to prevent convoluted fake dependencies.

Yeah here’s what it says about “necessary processing,” which does not require user consent.Note GDPR never mentions cookies, or cookie banners. It regulates the control and processing of personal information (which can be stored in cookies).<a href="https:&#x2F;&#x2F;gdpr.algolia.com&#x2F;gdpr-article-6" rel="nofollow">https:&#x2F;&#x2F;gdpr.algolia.com&#x2F;gdpr-article-6</a>1. Processing shall be lawful only if and to the extent that at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;(c) processing is necessary for compliance with a legal obligation to which the controller is subject;(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

There isn&#x27;t an obvious bright line, and that&#x27;s probably intentional.This is not legal language or legal advice, but the gist of it is &quot;if you don&#x27;t have it, can your website still do what it claims to do?&quot;For a site like Github, if you can&#x27;t use cookies to maintain session state, you&#x27;d have trouble implementing login sessions, so that&#x27;s pretty squarely on the essential side of the fence.But moving into murkier territory, how about logging the IP addresses you signed in from? If you&#x27;re using it to detect new login locations or new devices as a security alerting thing, then I think you can make a strong enough claim that this is essential. (Again, not a lawyer, this is not legal advice.)What if a PM wants to look in these logs for how many unique users show up in each country? That&#x27;s pretty squarely on the side of analytics, and is probably not essential.But... muddying the waters more, what about if an engineer wants to query unique users to figure out how many more racks of servers to buy? I have no idea. I&#x27;d be asking a lawyer.

- Security stuff (auth tokens and similar) are generally essential (if only used for that purpose).- Any form of tracking people is generally non-essential.What you can and can&#x27;t do is not based on technical implementation details but practical usage of the information!!The tricky part if when both overlap, i.e. if you track people but only for assuring a secure operation, i.e. you don&#x27;t use the tracking information for anything besides their main purpose of assuring secure operation.A lot (all?) of systems which provide such security specific tracking do not strictly limit their usage, access and collection of information and as such are also used for non-essential purposes and in turn need opt-in.But then sometimes companies try to abuse it and will do do until taken to court.For example Facebook argued that people use Facebook with the (main) intend to get customized ads and as such tracking them is essential for Facebooks service. As you can guess this argument is completely ridiculous especially given that they also track users which don&#x27;t use Facebook, but if you are the size of Facebook you can try to bring that to court and maybe gain a bit more time before you need to comply.

There is no direct language about cookies in article 5(3) of the ePrivacy Directive. What we have is Opinion 04&#x2F;2012 on Cookie Consent Exemption of the Article 29 Working Group of the European Commission about Cookie Consent, which elaborates about the topic:<a href="https:&#x2F;&#x2F;ec.europa.eu&#x2F;justice&#x2F;article-29&#x2F;documentation&#x2F;opinion-recommendation&#x2F;files&#x2F;2012&#x2F;wp194_en.pdf" rel="nofollow">https:&#x2F;&#x2F;ec.europa.eu&#x2F;justice&#x2F;article-29&#x2F;documentation&#x2F;opinio...</a>(The §29 WG is now replaced by the European Data Protection Board, but that seems not to have issued any more current Guidelines or Opinions on that matter. Also: IANAL.)

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies?GitHub gives the example of &quot;those used by third-party analytics, tracking, and advertising services&quot;, but curious if the law defines some sort of bright line here.

github.blog loads third-party content from Google and Wordpress. GitHub proper also has first-party analytics scripts, which disregards Do-Not-Track and shouldn&#x27;t be there at all.

Why, and which third-party resources are you referring to? Looking at uBlock Origin in a GitHub PR page now, I see the following domains:- github.com- githubusercontent.com, DNS pointing at github.map.fastly.net- githubapp.com- githubassets.comAll these are GitHub-owned, so from a privacy &#x2F; customer relationship standpoint it looks fine (except github.map.fastly.net , which is probably for CDN purposes), isn&#x27;t it? I mean: there is zero googleanalytics &#x2F; zendesk &#x2F; tracking saas nonsense here. Or are you making this point from a performance standpoint?By the way, I haven&#x27;t used SourceHut yet, but thanks a lot for your opensource work.

Nat&#x27;s right: this IS a no brainer. SourceHut hasn&#x27;t had any non-essential cookies since day one. If you&#x27;re reading this, Nat - how about removing third-party resources entirely from your pages next?

Great move! Now that some big sites like Github curb their use of invasive third-party analytics I hope more will follow suit. For Github it&#x27;s probably easy to do this as they can extract a lot of insights from the actions their users perform on the site that are visible in their backend, so they probably don&#x27;t need event-based analytics so much.

I just block cookie banners with a combination of custom JS&#x2F;CSS and uBlock Origin. I hate those abominations.Ironically, these sites need to use additional cookies to remember that you clicked away the banner, and part of the problem is I also blanket block all cookies on sites that I don&#x27;t need to log into, so they don&#x27;t get to &quot;remember&quot; anything.

Logging into Github lands me 10 cookies (5 of which have a 365 day expiry), and a row in local storage - are these all &#x27;essential&#x27;?

”Businesses are the real victims.”—Another fake quote

I&#x27;m confused.... AFAIK the biggest ad company, Google, doesn&#x27;t share your private info. It&#x27;s not in their interest to do so. Instead they keep it to themselves and then offer ads by categories so as a 3rd party I can say &quot;Please target this ad at &#x27;video game players&#x27;&quot; but I can&#x27;t ask &quot;give me the names of video game players&quot;

“And we would rather not have this crap but nobody pays for content are there only two types of ad networks: privacy preserving and paying so we’re stuck. Please call your congressperson to complain [here].”

Yes, like on cigarette boxes with mandatory, non-dark pattern, visible without scrolling 3 meters button to choose &quot;Don&#x27;t agree, Continue&quot;.

This wording should be required by GDPR. :)If that would be the case, maybe more sites would follow GitHub here.

&gt;&quot;allow cookies if the browser accepts them&quot;isn&#x27;t that the &#x27;allow 3rd party cookies&#x27; setting ?

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service.At least that&#x27;s the idea. In practice, almost everyone just throws up a banner that says &quot;fuck you, we&#x27;re selling your data as hard and as fast as we can,&quot; with no opt-out available, but they pretend that this is compliant with the law.

Practically there is only one browser, Chrome. And we know that it&#x27;s not in Googles interest to do any of that. They are actively fighting and diluting tools and techniques that would prevent tracking.

This is where we were before the GDPR. You can order your browser not to accept any cookies. But since you need atleast one cookie (or other way of persisting data on the client) for stateful http connections the burden to sort out the bad ones is on the consumer. This is exactly what the legislation wanted to prevent.

I feel that browsers should implement a permissions grant pop-up for when a site attempts to set a cookie with SameSite=none, and the cookie api can be extended to enable explanations to be given by the developer.

Not all cookies are born equal.I would like to store a cookie or a client-side cert to remain logged in, but not the other cr. Granted, they could use that cookie to track me, but this is what GDPR is about.IIRC, Internet explorer used to ask you for each cookie, circa 2000. These pop-ups became more and more common with time. The web would be unusable with those nowadays.

&gt; Then browser vendors can ship a delete all non same origin cookies on tab close or something.That doesn&#x27;t prevent Facebook or Twitter or advertisers in general from tracking you across dozens of pages or more, it just means that they&#x27;ll have to issue you a new cookie each session.

Two objections.1. A law that aims to prevent stealing should be deterring thieves, not just regulating padlocks.2. Technical measures are insufficient because cookies are regulated by purpose. A third-party cookie for fraud detection is allowed; a first-party cookie for analytics requires consent. It also prevents using necessary cookies for secondary purposes, something that literally cannot be accomplished through technical means alone.As a minor point, the so-called &quot;cookie law&quot; also regulates browser fingerprinting. I have a hard time imagining that you could legislatively mandate effective anti-fingerprinting approaches.

&gt; Why not just let browsers control who sets what cookies?Browsers wouldn’t fall for dark patterns.

&gt; Why not just let browsers controls who sets what cookies?Because it doesn&#x27;t have anything to do with cookies. You don&#x27;t need a banner if you use CSRF cookies, you don&#x27;t need a banner if you use them for stuff like CloudFlare&#x27;s anti-DDoS script, and you certainly don&#x27;t need a banner if your site requires cookies for basic functionality like logging in.The browser can&#x27;t possibly tell what the server is doing with its cookies. It might even be using a single cookie as CSRF protection and ad tracking at the same time.

At least it raises awareness on how tracked we are.

&gt; Why not just let browsers controls who sets what cookies?This is actually the case, what do you mean? All browsers that I know of (firefox, chrome, elinks) allow the user to control what to do with cookies.

Good lord, everyone needs banners and popups?Why not just let browsers controls who sets what cookies?I&#x27;m tired the endless cookie popups, can we come up with an &quot;allow cookies if the browser accepts them&quot; standard as long as that guarantees no cookie popups?Then browser vendors can ship a delete all non same origin cookies on tab close or something.

TZ&#x2F;lang preferences do not require consent, a CSRF token for a logged in user seems to me to be legitimate interest too, but I suppose you could see it as an identifier that can be linked back to the user. I still think if you&#x27;re using it just for security purposes it counts, but the fact that the same identifier could be used for tracking based on differences on the backend is one of the reasons why this isn&#x27;t just based on browser cookie settings.

well most sites still generate at least some kind of csrf cookie. multi language site sometimes even have tz&#x2F;lang

Consent often involves more than just cookies. Consenting essentially allows them to use other tracking technologies beyond cookies such as IP addresses or browser fingerprinting.This is also why the GDPR requires consent forms instead of relying on browser cookie settings, as it covers the intent of tracking itself as opposed to any technical means by which it is achieved (and this is why functional cookies such as for logging in or shopping carts don’t actually need consent at all).

So what happens if one consent to it, but also have third party cookies disabled in one&#x27;s browser settings?Is disabling it there globally æquivalent to not accepting on such banners?

disagree button is the &quot;Close&quot; button unfortunately.

The worst is when the banner says: &quot;This site uses cookies. Agree &#x2F; Disagree&quot; -- it&#x27;s not even asking for consent.Some sites don&#x27;t even give you a &quot;Disagree.&quot; Liberty of London has no way to opt-out: &quot;By closing this box or by clicking accept and close, you agree to our use of cookies.&quot;<a href="https:&#x2F;&#x2F;www.libertylondon.com" rel="nofollow">https:&#x2F;&#x2F;www.libertylondon.com</a>

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they&#x27;re breaking the law.

I hate the implication that those banners are some sort of consent. They&#x27;re so commonplace now that people blindly click &#x27;okay&#x27; or close them just to be able to read the site. If the wording was something else (&quot;you agree that we can take your first born child&quot;) would it even hold up?The worst is when the banner says: &quot;This site uses cookies. Agree &#x2F; Disagree&quot; -- it&#x27;s not even asking for consent.

I find these pop ups weird. Shouldn&#x27;t we get an option to say, &quot;Disable tracking&quot;? These pop ups don&#x27;t really have any utility because a banner won&#x27;t stop them from reading the article.

The last sentence is the key part.  I could respond in kind: No one cares if you care or not.  We only care about the people who are willing to buy that stuff from you.

The thing is, that&#x27;s bullshit.Here&#x27;s the other perspective: Data brokers don&#x27;t really want your data if you don&#x27;t want them to have it. It&#x27;s a legal liability for them, and most of them are struggling to work at the scale their customers demand already. But publishers want high advertising rates and that means advertisers want to make good bids and that means both actually want a data broker involved to deal with the technical (collection, filtering, aggregation, ETL) and legal (GDPR) bullshit.But then publishers and advertisers don&#x27;t do their due diligence or decent engineering and just shovel illegal shit to data brokers on the backend. The ones that shut up and launder it do well; the ones that actually try to do a good (technical, legal) job drown in account management and data processing overhead.So fuck that site. They are the ones that care about your data, they&#x27;re just making a show of keeping their hands clean while they pay someone else for the dirty work and hiding behind their (half willful half stupid) ignorance of how their own industry works.

You sound like the guy who wrote this:&quot;We&#x27;re not going to lie to you. Your privacy isn&#x27;t our priority. It&#x27;s not even close. Not because we want to track your every move. But because we simply don&#x27;t care. We&#x27;d rather spend what limited time we have actually improving the web site. We&#x27;re into taking pictures and adding content, not obsessing over what your dog had for lunch so we can sell it to MegaEnormousBigCo. We&#x27;re not tracking you. We&#x27;re not tabulating you. We&#x27;re not folding, spindling, or mutilating you. Seriously, your personal life is not important to us. However, you may or may not be of interest to the people who advertise on this web site.&quot;<a href="https:&#x2F;&#x2F;www.chicagoarchitecture.info&#x2F;privacy.php" rel="nofollow">https:&#x2F;&#x2F;www.chicagoarchitecture.info&#x2F;privacy.php</a>

Why does that matter? If the advertisers delivered cookied via the main site server, would that change your experience?

I hate the standard wording on Cookie banners. Most of them should read:&quot;The site uses cookies. Actually it doesn&#x27;t - you are not logged on and we don&#x27;t need to maintain state. But our advertising partners, their partners, and their partner&#x27;s partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe.&quot;

Cookies aren&#x27;t necessary because you&#x27;ll have to login to get much of the functionality out of Github anyway.

Your webservers provide all the information you need via a logging mechanism.

The same without tracking users with personally identifiable information. You know how many people clicked on which button, but you don&#x27;t know that the user 05475524789 who clicked on the button lives in South Europe, has HIV, and is interested in video games and vacuum cleaners.

Nice. I wonder if one could build an analysis program to determine if you actually need the banner or not, with some reasonable accuracy. I would love to see those cut down.

It&#x27;s definitely not mandated by GDPR. Look how annoying Facebook, Google and countless news sites&#x27; cookie banners are. I don&#x27;t know GDPR, but I&#x27;m sure their lawyers do.

Which is actually mandated by GDPR, but that doesn’t seem to end the endless click required to block cookies on certain websites.

Great! Even before, rejecting tracking on GitHub was just one click away, same number of clicks as accepting it.I also like the fact that all users get equal privacy rights!

You could still self-host an analytics solution. Just don&#x27;t share that data with 3rd parties.

However they cannot use data that allows to identify an user (such as an IP address) in their analytics, unless the user has granted them explicit consent to use that data for the purpose of analytics.So my understanding is that there is a big difference between this and &quot;they just don&#x27;t use third-party analytics&quot;.It would be super nice if they clarified this in the blog post. Maybe by adding something like &quot;We do not use personal data in our analytics&quot;.

Or they just send the data to the 3rd parties on the back-end.

I’m sure that GitHub certainly has analytics; they just don’t use third-party analytics. This means that either they’ve built their own tool or are self hosting someone else’s. I imagine that GitHub has some amount of internal tooling here out of necessity, e.g for metrics about how people use GitHub over SSH.

It doesn’t mean no analytics, it’s about including third-party analytics scripts. You can still do analytics.

By looking at http access logs, like since the beginning of times? Note if by modern sites you mean SPAs, you could still make HTTP pings for those features; might not make much sense to use SPAs for content-driven sites though.

Good question! We just shipped GitHub Discussions to millions of developers and we can learn whether people use and like the product by looking at whether people are creating discussions, customizing categories, and answering questions.The argument that you need to follow users around every step of the way to build great products is simply untrue.

You can use analytics programs without needing cookies. I use Fathom (usefathom.com) and they are compliant.

I&#x27;m sure people will praise this, but how do you run a modern website with no analytics? How do you know if people use the features you build?

I find it annoying that 3rd party analytics gets lumped in with ad tracking. Analytics is incredibly useful for improving products, it lets you see where users are having a hard time and it lets you do experiments and measure the results. It&#x27;s beneficial to both the user and the company, it&#x27;s a win-win.

I love it! As a web developer, cookie warnings infuriate me probably more than they should as at least half of the time they aren&#x27;t actually either required (only essential) or effective (doesn&#x27;t actually compy, just annoys).I&#x27;ve had clients straight up demand I should add an ugly cookie warning to the beautiful site I spent a month designing &quot;because it&#x27;s the law&quot;. Then, when I asked them to provide a full privacy policy to go with it, I&#x27;ve often gotten the response to &quot;just leave it empty, nobody actually reads that&quot;. Thankfully, I&#x27;m stubborn enough to have always been successful in convincing them that maaaybe they should listen to the person who does this stff for a living and not a sensationalist Medium article...

We think cookie banners are horrible and couldn&#x27;t design one that isn&#x27;t disrespectful to you all – developers. Also, privacy is good?Sometimes there is no conspiracy theory. :)

They don&#x27;t need a real reason, because being known to respect privacy coincides with their incentives

No pricing page, and jesus, not even a menu. They want us to sign in before they&#x27;ll show us pricing? fuck right off with that bullshit.

And when people want analytics they often just really want headline numbers that do not require user tracking.E.g. I&#x27;ve started using Fathom [1]. It&#x27;s very basic, but for the sites I use it on all I really want to know is if traffic is going up or down or if any specific pages are suddenly getting lots of traffic.[1] <a href="https:&#x2F;&#x2F;usefathom.com" rel="nofollow">https:&#x2F;&#x2F;usefathom.com</a>

You don&#x27;t even need cookie consent warnings for login cookies. Just for &quot;drive by&quot; ones.

I&#x27;d go a step further, and say that most sites don&#x27;t need cookies either. I wrote about it elsewhere a few days ago:&gt; Avoid having to put annoying EU cookie consent dialogs on your website with one weird trick:
&gt; Don&#x27;t use cookies on your website.&gt; If you want users to be able to sign in to access your premium paywalled&#x2F;onlyfans content, put that on a subdomain that has cookies and requires login.&gt; (yes this isn&#x27;t applicable to all websites with cookies; it&#x27;s just a nice idea worth considering)=&gt; <a href="https:&#x2F;&#x2F;pleroma.envs.net&#x2F;notice&#x2F;A1sZxGnSQ2Oi0oWMy0" rel="nofollow">https:&#x2F;&#x2F;pleroma.envs.net&#x2F;notice&#x2F;A1sZxGnSQ2Oi0oWMy0</a> originally written here

Sadly this is often unfeasible if your site relies on reCAPTCHA. Are there any cookie-free GDPR compliant captcha options?

This is great. My experience is that many people claim to want analytics for their website but end up looking at it a couple of times and then never using it again. Meanwhile they&#x27;re sponsoring and bolstering the position of internet tracking giants who - despite their claims - have no regard for user privacy.Just sell your product instead of wasting time and money on bike shedding your website with whatever you believe is going to &quot;skyrocket your sales&quot;.

the beautiful irony of having &quot;share on Facebook link&quot; on this page

They removed cookies, but they don&#x27;t claim to remove ad ids, they only don&#x27;t use cookies to store them. Also worth remembering that github is a social network and has no privacy by design, it also builds its own user profile a part of which is public.

Well a large business such as GH also has the resources to build their own in-house tracking solution, which can piggyback off of the first-party auth cookie without requiring any cookie pop-ups.

I literally proposed this solution in a previous HN thread, discussing the cookie situation. I&#x27;m glad a large business such as GH is able to take the _extremely_ painless route of just outright removing them entirely.

Great work!Thanks, github, for setting the example.

I started using Cookie Auto Delete extension with Firefox. Now I just accept all and the extension takes care of removing the cookies as soon as I close the tab. Logging in again and again on the regular sites is not even an annoyance a with a password manager.

I&#x27;m not blaming the popups. I&#x27;m lamenting the fact that every damn site opens with a pop-up now. They are the negative consequence of an otherwise well-meaning bill.As good as GDPR was for privacy, it&#x27;s equally bad for UX.

That&#x27;s like blaming the flashlight for revealing rats under the kitchen sink

Cookie banners are not a result of the GDPR.They&#x27;re a consequence of the ePrivacy directive from 2002.The reason why they&#x27;re more prevalent now is because GDPR 1) made people aware of data protection issues; and 2) made people more scared of fines.

I understand the need for GDPR, but its consequence of obtrusive cookie consent banners is easily one of the worst things to happen to the web in recent memory.

There is the &quot;Do not track&quot; option, but as I understand it&#x27;s ignored by most websites. That&#x27;s why I wouldn&#x27;t mind a &quot;Do what ever you want&quot; option, and in exchange popups are removed.That&#x27;s how it was before and I&#x27;m not certain that it caused that much harm. Users can always block ads and third-party cookies anyway if they wish to do so.

Or blanket non-consent of course.I too find it quite annoying. The other issue is that sometimes the banners do not properly work with various aids for disability and keyboard-operated browsers.

Don&#x27;t you think, that the implementation of the opt out process is what is actually flawed? The law doesn&#x27;t require you to throw this popup at your users. You can just set the cookies that are techincally required and explain their function in you statement about data usage.
If you want to track people, you can then ask for their consent in some nice, locally served banners, where normally you privacy intruding ad networks would put their third party javascript.

This may not be exactly what you asked for, but there is <a href="https:&#x2F;&#x2F;www.i-dont-care-about-cookies.eu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.i-dont-care-about-cookies.eu&#x2F;</a>Also, it isn&#x27;t the law that has been terribly implemented, although that could be argued as well, but rather the fault lies with the companies that do not want to abide by the law.There are a few easy ways to check if a website is breaking the law:- Is it as easy to say &quot;no&quot; to the consent as it is to say &quot;yes&quot;? If not, it&#x27;s not legal, as the consent is not freely given.- Is the website setting tracking cookies, or tracking you in some other way, before you have made your choice about the consent? If it is, it&#x27;s not legal, as the consent must be opt-in not opt-out.- Is it confusing? Then it&#x27;s probably not legal, as the consent must be informed.- Is there a button to &quot;accept all&quot; with no clear list of what you&#x27;re accepting? Then it&#x27;s not legal, as the consent must be specific and unambiguous.It&#x27;s not rocket science, anyone can read it up for example here <a href="https:&#x2F;&#x2F;gdpr-info.eu&#x2F;issues&#x2F;consent&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gdpr-info.eu&#x2F;issues&#x2F;consent&#x2F;</a>

The EU law does not require these multiple pages of legalese. Not even a little bit.In fact it says &quot;it shall be as easy to withdraw as to give consent&quot;.So you shouldn&#x27;t attribute complexity to the EU law, when the law actually insists on simplicity.It&#x27;s a myth that the GDPR requires complex forms, or even just banners. One that website operators (mainly 3rd party advertisers and trackers who provide the banners&#x2F;popups to sites) would like you to believe.A genuine GDPR-compliant banner&#x2F;popup is much simpler.In fact you can make a GDPR-compliant site without any banner&#x2F;popup&#x2F;form at all, while still using cookies, logins, shopping carts and analytics etc. You just need to do it in a privacy-respecting way, which isn&#x27;t hard.The complexity is website operators attempt to half-comply and half-violate the law, frustrate and arm-twist users into something most people would not agree to if it was easy to decline. The obnoxious complexity is deliberate, to annoy and frustrate you so that you give in to the &quot;easy&quot; option they very much want you to &quot;choose&quot;.

I wish there was a browser option &quot;I don&#x27;t care about being tracked&quot; and that would get rid of all cookie banners (and, more often than not, full page popups).This EU law comes from a good idea, but it&#x27;s terribly implemented - it implies that everybody out there is a lawyer and can make sense and agree on multiple pages of confusing legalese, and this every time they open a new website. This is so absurd, and the result is that we&#x27;re trained to click &quot;ok&quot; on everything and we&#x27;re tracked all the same. Back where we&#x27;ve started but with more popups.

So how does Github track usage and site traffic? That seems non-essential to me and not something you could completely manage server-side.

But is it just about cookies though? If they log images downloads or anything else that is essentially what tracking cookie would do and often this type of tracking is used instead of cookies. Just because they don&#x27;t process this data for analytics (or do they?) it doesn&#x27;t mean this automatically respects privacy, as there is always a chance this data could leak. Do they store logs?

I use this bookmarklet to quickly get rid of cookie banners and other banners &#x2F; stickies :<a href="https:&#x2F;&#x2F;alisdair.mcdiarmid.org&#x2F;kill-sticky-headers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;alisdair.mcdiarmid.org&#x2F;kill-sticky-headers&#x2F;</a>

They are probably still leaving that option for themselves though

If they&#x27;re not using Google Analytics anymore, it&#x27;s probably time to remove the request to &#x27;gascrolldepth.js&#x27; from the blog as well.

Sounds like that terrible cookie law is actually doing some good. Maybe other sites could follow suit and just rid of the the banner and offending cookies.

Microsoft would like for you to adopt an image of GitHub as an upright corporate endeavor - but remember they blocks&#x2F;censor developers from world states that the US doesn&#x27;t like.

That&#x27;s a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they&#x27;d be willing to make the privacy policy readable?..

What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?

A GitHub spokesperson has issued this statement [1] about a request to api.github.com: &quot;That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers&quot;.GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint.GitHub&#x27;s claims about not tracking users are false, they do identify users in tracking requests. See this tracking URL, it&#x27;s full of unique identifiers and personal data, and it is currently sent after every page load, without user consent:<pre><code> https:&#x2F;&#x2F;collector.githubapp.com&#x2F;github&#x2F;page_view?dimensions[page]=https:&#x2F;&#x2F;github.com&#x2F;&amp;dimensions[title]
 =GitHub&amp;dimensions[referrer]=https:&#x2F;&#x2F;github.com&#x2F;sessions&#x2F;two-factor&amp;dimensions[user_agent]=Mozilla&#x2F;5.0 
 (X11; Linux x86_64; rv:78.0) Gecko&#x2F;20100101 Firefox&#x2F;78.0&amp;dimensions[screen_resolution]=1000x518&amp;dimensions[pixel_ratio]
 =1&amp;dimensions[browser_resolution]=1000x518&amp;dimensions[tz_seconds]=0&amp;dimensions[timestamp]
 =1608247177900&amp;dimensions[referrer]=https:&#x2F;&#x2F;github.com&#x2F;sessions&#x2F;two-factor&amp;dimensions[request_id]=
 9CF8:4938:4516EA:5FD134:5FDBE77E&amp;dimensions[visitor_id]=6475638196559144773&amp;
 dimensions[region_edge]=fra&amp;dimensions[region_render]=iad&amp;&amp;measures[performance_timing]=
 1---600-600-600-400-400-----600-0----1608247177200--1608247176900--1608247176900--400- 
 400&amp;&amp;dimensions[actor_id]=47727044&amp;dimensions[actor_login]=dessantbot&amp;dimensions[actor_hash]=
 a274a9ae03a3b361483e273a53aba70534c609670c058fe667d8bce4d6f33bad&amp;dimensions[cid]=1507727009.1608247109
</code></pre>
[1] <a href="https:&#x2F;&#x2F;www.theregister.com&#x2F;2020&#x2F;12&#x2F;17&#x2F;github_will_no_longer_present&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.theregister.com&#x2F;2020&#x2F;12&#x2F;17&#x2F;github_will_no_longer...</a>

&gt; Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticatedThis is true to every advertiser or data seller, Including obvious ones like Google, FB, Amazon... and less obvious ones like your ISP, Apple, etc.The industry call it persistent ID (as opposed to cookie, which are transient ID): <a href="https:&#x2F;&#x2F;digiday.com&#x2F;marketing&#x2F;wtf-persistent-id&#x2F;" rel="nofollow">https:&#x2F;&#x2F;digiday.com&#x2F;marketing&#x2F;wtf-persistent-id&#x2F;</a> (random result, i do not endorse it)The trick is: the publisher&#x2F;intermediary have even more information about you, but they call you User-A instead of your name, so they can sell your history, zip, DNA, etc... just pretend not labeling the data with your name or some other personal identifiable information already listed in a Law somewhere makes everything fine.

&gt; GitHub still sends the same personal data to their own analytics endpointI see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property.What&#x27;s the problem you have with that?

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated.See my comment below for details: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25458635" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25458635</a>Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request.Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side.We have no visibility into how they associate this data with analytics data collected on the server-side, and that&#x27;s where an updated privacy policy would also help.[1] <a href="https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;free-pro-team@latest&#x2F;github&#x2F;site-policy&#x2F;github-subprocessors-and-cookies" rel="nofollow">https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;free-pro-team@latest&#x2F;github&#x2F;site-...</a>

It is harder than that. I would for example like to use google maps api - but I cant.

If you don’t have to actually make money though, there isn’t really a point to the analytics third parties enable - eliminating bots and click fraud. Microsoft managers are incentivized to not identify bot or noise traffic, since their performance metrics do not separate those.

Good job, can more companies follow the lead now? Btw when I see that banner - I always reject the option and still have not experienced any bad experience from website.

&gt; I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture.I might 1‰ buy that if they restored the Widevine repos they snuck down for Google under cover of the controversy caused by complying with the MS-funded RIAA’s quasi-legal youtube-dl takedown request.

This is fantastic. Thank you, GitHub.I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture.I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it&#x27;s great that it&#x27;s divorced from 3rd parties.Presumably Microsoft has access to those metrics, though? I wonder how deeply that gets parsed in conjunction with everything else they collect.If only you could export some of that culture back to your corporate overlord. I&#x27;d love if MS Teams stopped exploding it&#x27;s RAM usage until it eventually has to be killed if it&#x27;s unable to get an OK response from its analytics endpoint.And I&#x27;d love to turn off analytics in Windows altogether. Even getting to the minimal analytic configuration is an exercise in futility spread out across a million different settings, some of which decide to reset themselves in obfuscated ways sometimes. eg, some think updates reset them, either directly or by doing things like changing default programs to ones which require analytics (eg Office). Or a change to one setting requires additional changes elsewhere to be effective.

It would be really cool to get an on-GitHub analytics for GitHub pages. I’d like to get view counts but don’t want to embed an external tracker in my blog.

See, it is not all that difficult. Hopefully, this will be the first of many big websites to ditch the excess tracking.

This is wrong. EU law absolutely does require cookie banners if a website uses non-essential cookies, even if those cookies are not used to harvest data.

&gt; EU law requires you to use cookie banners if your website contains cookies that are not required for it to work.No it doesn&#x27;t. EU Law requires you to not harvest data at will, and you either must have a basic functional requirement (i.e. &#x27;remember my login&#x27;), or you must ask the user if you can have their data to profile them so the advertisements can make a few percent more money (yes, the whole profiling thing doesn&#x27;t even add that much to the bottom-line!).

Title should be &quot;Github admits abusing users with non-essential cookies&quot;.

I&#x27;ve been planning to post about this issue a couple of months ago, when I&#x27;ve noticed that GitHub was sending personal data collected on the client-side to Google Analytics without user consent.Then recently they have introduced a consent popup, which was actually one of the most refreshing cookie consent popups I have ever seen: it contained two buttons, Accept and Reject. This popup has now been removed.I think a lot of developers may have clicked on Reject, though removing tracking cookies will not absolve GitHub of the requirement to continue asking for informed and free consent under GDPR, if they will continue to process personal data, and share it with third-party services from their servers.The current website code points to the same data still being sent to GitHub, only the implementation has changed.

Isn&#x27;t using the data for product improvement still tracking?  I don&#x27;t personally care, but I&#x27;m not sure if the GDPR does.

Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law.GDPR doesn&#x27;t differentiate between the client side or server side, you&#x27;re simply not allowed to keep information on users unless they&#x27;ve consented to for it to be kept or it is required for a legitimate functionality to which they have consented.

This is all detailed in our updated privacy policy: <a href="https:&#x2F;&#x2F;github.com&#x2F;github&#x2F;site-policy&#x2F;pull&#x2F;336" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;github&#x2F;site-policy&#x2F;pull&#x2F;336</a>

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn&#x27;t say anything about eliminating _tracking_. Personally, I can live with analysis that&#x27;s used solely for product improvement. If that&#x27;s all github is doing, then the score goes up to an A.But if they&#x27;re siphoning off data for any other purposes - whether passing to the mother ship or otherwise - then the score is down to D-. The intent of EU cookie regulation is to make tracking and data collection transparent and opt in. Changing the implementation to server side might comply with the letter of the law but it violates the spirit.It would be good if GitHub would clarify their position.

When you say GitHub is collecting personal data in a JS request, what data do you mean exactly? IP address, browser, screen resolution type stuff?

Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data.The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com.The privacy policy page which lists third party data subprocessors and cookies used on GitHub [1] seems to be outdated. Does the announced change also mean that Google Analytics and other subprocessors have been eliminated, or has some of the tracking merely moved server-side?[1] <a href="https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;free-pro-team@latest&#x2F;github&#x2F;site-policy&#x2F;github-subprocessors-and-cookies" rel="nofollow">https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;free-pro-team@latest&#x2F;github&#x2F;site-...</a>

localStorage and cookies are the same in terms of GDPR. It encompasses all local storage mechanisms such as IndexedDB, cookies, localStorage, sessionStorage, etc.(source: I read the directive way back when it came out, and also skimmed large sectoins of GDPR)Other sources: <a href="https:&#x2F;&#x2F;softwareengineering.stackexchange.com&#x2F;questions&#x2F;290566&#x2F;is-localstorage-under-the-cookie-law" rel="nofollow">https:&#x2F;&#x2F;softwareengineering.stackexchange.com&#x2F;questions&#x2F;2905...</a> and
<a href="https:&#x2F;&#x2F;law.stackexchange.com&#x2F;questions&#x2F;30739&#x2F;do-the-gdpr-and-cookie-law-regulations-apply-to-localstorage" rel="nofollow">https:&#x2F;&#x2F;law.stackexchange.com&#x2F;questions&#x2F;30739&#x2F;do-the-gdpr-an...</a>

I’m not a lawyer, but I’d be shocked if you could get around gdpr by using a different api. If gdpr was actually limited to `document.cookie` and `Set-Cookie` it’d be a laughable attempt to protect users.

Or they could use localStorage instead, which is a superior storage mechanism.

I find it staggering how misunderstood GDPR seems to be at large.First and foremost, it&#x27;s not about cookies. EU laws required you to inform visitors about &quot;cookies&quot; and have them acknowledge them long before GDPR passed into law.Second, it&#x27;s not about third parties or required cookies vs. marketing cookies.What the law actually states is that you may not, in any form, make individuals using your service identifiable or track them without prior informed and active consent by the visitor, and you also may not make such consent mandatory for accessing your publications content. plain and simple.all the &quot;cookie banners&quot; out there are ONE form of solving this problem but are in no way mandated by law. If you find another way of solving this issue, all the better.But the way these banners are designed and implemented at large are geared towards soliciting consent by means of obfuscating actual selection (think: bright &quot;accept all&quot; buttons with tiny &quot;save settings&quot; links) and by making it hard and tedious to actually select and submit your preferences (think: giant lists of all trackers with opt-out for legitimate interest and optin for consent side by side). These are in clear violation of what the law states imho and are largely in use because there is still no juridical precedent that clarifies what goes and what doesn&#x27;t.what we are experiencing is a clash of ethical mandate and economical interest. GDPR is aimed at protecting you, the user, from beeing identified and tracked along your wen history, be it by cookies or fingerprint or whatever.dropping functional cookies for logged in users is perfectly fine though, as registration itself is likely a process where users can be informed of such personal identification and is an active decision by the user.saying &quot;the site needs it to function&quot; and tracking users first party only is NOT a way around GDPR, as much as this narrative gets retold.in short: it&#x27;s not about cookies and third parties. The law is purposefully formulated in a way that isn&#x27;t scoped on technicalities and seeks to prevent such &quot;workarounds&quot;.I would love to see more details disclosed by GitHub about HOW exactly they implemented this, as i am certain they have enough professional legal councel to have digged deep into this question.

The EU cookie ban should&#x27;ve just been a ban on third-party cookies, then we wouldn&#x27;t be in this mess. Props on GitHub for following the rules right!

Really good news! For others websites, I&#x27;ve developped the browser addon Ninja Cookie that remove cookie banners by rejecting the use of non-essential cookies. (I&#x27;ve introduce Hacker News community few weeks ago to this project)
Free and good for your privacy :)
Have a look guys :)
<a href="https:&#x2F;&#x2F;ninja-cookie.com" rel="nofollow">https:&#x2F;&#x2F;ninja-cookie.com</a>

Damnit, they found my loop-hole! <a href="https:&#x2F;&#x2F;ma.ttias.be&#x2F;loophole-cookie-notices&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ma.ttias.be&#x2F;loophole-cookie-notices&#x2F;</a>

Why are there so many people on this website willing to bend over backwards for their employers shoving cookies down our throats? Is it because they pay so much money that you don&#x27;t care what happens to others as long as you get yours?

In fact, a trade-off has to happen. A cookie - or in terms of the GDPR, storing data on the end device - does not necessarily have to be technically required for it to be stored without consensus. A shopping cart, for example, can technically be coded as a GET parameter in the URL. However, since a cookie is the technically more sensible way to persist the shopping cart, a cookie can be used. This only needs to be explained - ideally in simple language - in the data processing statement.

Much of the statements about cookie requirements in this thread are wrong.The rule is simple: If a website uses non-essential cookies, it must inform users and, in most EU jursidctions, collect consent prior to placing a cookie on the user&#x27;s machine.The rationale behind the rule is that companies should not store company information on end-user devices without the user&#x27;s consent. The rule applies to all non-essential cookies regardless of whether the cookies collect personal data or are used for tracking. The rule does not cover cookieless server-side tracking of users. Sites do not violate the law when they track users without consent using server-side tools. Sites do violate the law even without tracking users if the site does not collect consent for non-essential cookies.GDPR enhanced the cookie rules by applying GDPR consent requirements to all cookies that involve personal information. Many sites ignored the old cookie rule because EU law did not give data protection authorities much enforcement power. GDPR increased the power of the DPAs to issue fines of up to 4% of annual turnover. Sites previously ignoring the rules put out cookie banners once GDPR came into effect.edit: To be clear, Github isn&#x27;t saying that it stopped tracking users. It&#x27;s saying that it doesn&#x27;t do cookie-based tracking and therefore it does not need a banner.

It was really that easy. Kudos. Others should follow

What I would wish is for the next iteration of the law to mandate a standard way of opting in. From looking at the real world, there are several categories for cookies. Technically, tracking, okay I can only think of two.
A standard opt-in procedure could client side set a cookie with a certain level of consent for each page at the browser level. A default setting for this can then be set globally in the browser. A site specific setting could then be overwritten by the server or the browser UI.You could then nicely ask your users to agree to tracking in the places where there were the privacy intrusion banners of the shady tracking networks.

I seriously don&#x27;t understand the cookie hooplah. You know that they can still send most of the same information off to 3rd party services on the back end?

No Cookie for You