Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Tracking Cookies and GDPR

DZone's Guide to

Tracking Cookies and GDPR

The GDPR legislation is still a hot topic among a lot of companies, and while it's been discussed in general terms rather often, how does it pertain to tracking cookies?

· Security Zone ·
Free Resource

Mobile is increasingly becoming a part of every consumers’ identity, but the increasing use of this digital channel is escalating the security risks faced by consumers and institutions.

The GDPR is the new data protection regulation, as you probably already know. I've given detailed practical advice for what it means for developers (and product owners). However, there's one thing missing there - cookies. The elephant in the room.

Previously I've stated that cookies are subject to another piece of legislation - the ePrivacy directive, which is getting updated and its new version will be in force a few years from now. And while that's technically correct, cookies seem to be affected by the GDPR as well. In a way, I've underestimated that effect.

When you do a Google search on "GDPR cookies," you'll pretty quickly realize that a) there's not too much information and b) there's not much technical understanding of the issue.

What appears to be the consensus is that the GDPR does change the way cookies are handled. More specifically - tracking cookies. Here's recital 30:

(30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

How tracking cookies work - a 3rd party (usually an ad network) gives you a code snippet that you place on your website, for example, to display ads. That code snippet, however, calls "home" (makes a request to the 3rd party domain). If the 3rd party has previously been used on your computer, it has created a cookie. In the example of Facebook, they have the cookie with your Facebook identifier because you've logged in to Facebook. So this cookie (with your identifier) is sent with the request. The request also contains all the details from the page. In effect, you are uniquely identified by an identifier (in the case of Facebook and Google - fully identified, rather than some random anonymous identifier as with other ad networks).

Your behavior on the website is personal data. It gets associated with your identifier, which in turn is associated with your profile. And all of that is personal data. Who is responsible for collecting the website behavior data, i.e. who is the "controller"? Is it Facebook (or any other 3rd party) that technically does the collection? No, it's the website owner, as the behavior data is obtained on their website, and they have put the tracking piece of code there. So they bear responsibility.

What's the responsibility? So far it boiled down to displaying the useless "we use cookies" warning that nobody cares about. And the current (old) ePrivacy directive and its interpretations say that this is enough - if the users' actions can unambiguously mean that they are fine with cookies - i.e. if they continue to use the website after seeing the warning - then you're fine. This is no longer true from a GDPR perspective - you are collecting user data and you have to have a lawful ground for processing.

For the data collected by tracking cookies you have two options - "consent" and "legitimate interest." Legitimate interest will be hard to prove - it is not something that a user reasonably expects, it is not necessary for you to provide the service. If your lawyers can get that option to fly, good for them, but I'm not convinced regulators will be happy with that.

The other option is "consent." You have to ask your users explicitly - that means "with a checkbox" - to let you use tracking cookies. That has two serious implications - from a technical and usability point of view.

  • The technical issue is that the data is sent via 3rd party code as soon as the page loads and before the user can give their consent. And that's already a violation. You can, of course, have the 3rd party code be dynamically inserted only after the user gives consent, but that will require some fiddling with JavaScript and might not always work depending on the provider. And you'd have to support opt-out at any time (which would, in turn, disable the 3rd party snippet). It would require actual coding, rather than just copy-pasting a snippet.
  • The usability aspect is the bigger issue - while you could neatly tuck a cookie warning in the bottom, you'd now have to have a serious, "stop the world" popup that asks for consent if you want anyone to click it. You can, of course, just add a checkbox to the existing cookie warning, but don't expect anyone to click it.

These aspects pose a significant question: is it worth it to have tracking cookies? Is developing new functionality worth it, is interrupting the user worth it and is implementing new functionality just so that users never click a hidden checkbox worth it? Especially given that Firefox now blocks all tracking cookies and possibly other browsers will follow?

That by itself is an interesting topic - Firefox has basically implemented the most strict form of requirements of the upcoming ePrivacy directive update (that would turn it into an ePrivacy regulation). Other browsers will have to follow, even though Google may not be happy to block their own tracking cookies. I hope other browsers follow Firefox in tracking protection and the issue will be gone automatically.

To me, it seems that it will be increasingly not worth it to have tracking cookies on your website. They add regulatory obligations for you and give you very little benefit (yes, you could track engagement from ads, but you can do that in other ways, arguably by less additional code than supporting the cookie consents). And yes, the cookie consent will be "outsourced" to browsers after the ePrivacy regulation is passed, but we can't be sure at the moment whether there won't be technical whack-a-mole between browsers and advertisers and whether you wouldn't still need additional effort to have dynamic consent for tracking cookies. (For example, there are reported issues that Firefox used to make Facebook login fail if tracking protection is enabled. Which could be a simple bug, or could become a strategy by big vendors in the future to force browsers into a less strict tracking protection).

Okay, we've decided it's not worth it managing tracking cookies. But do you have a choice as a website owner? Can you stop your ad network from using them? (Remember - you are liable if users' data is collected by visiting your website). And currently, the answer is no - you can't disable that. You can't have "just the ads." This is part of the "deal" - you get money for the ads you place, but you participate in a big "surveillance" network. Users have a way to opt out (e.g. Google AdWords gives them that option). You, as a website owner, don't.

Facebook has a recommendations page that says "you take care of getting the consent." But, for example, the "like button" plugin doesn't have an option to not send any data to Facebook.

And sometimes you don't want to serve ads, just track user behavior and measure conversion. But even if you ask for consent for that and conditionally insert the plugin/snippet, do you actually know what data it sends? And what it's used for? Because you have to know in order to inform your users. "Do you agree to use tracking cookies that Facebook has inserted in order to collect data about your behavior on our website" doesn't sound compelling.

So, what to do? The easiest thing is just not to use any 3rd party ad-related plugins. But that's obviously not an option, as ad revenue is important, especially in the publishing industry. I don't have a good answer, apart from "Regulators should pressure ad networks to provide opt-outs and clearly document their data usage." They have to do that under the GDPR, and while website owners are responsible for their users' data, the ad networks that are in the role of processors in this case (as you delegate the data collection for your visitors to them) also have the obligation to assist you in fulfilling your obligations. So ask Facebook - what should I do with your tracking cookies? And when the regulator comes after a privacy-aware customer files a complaint, you could prove that you've tried.

The ethical debate of whether it's wrong to collect data about peoples' behavior without their informed consent is an easy one. And that's why I don't put blame on the regulators - they are putting the ethical consensus into law. It gets more complicated if not allowing tracking means some internet services are no longer profitable and therefore can't exist. Can we have our cake and eat it too?

Explore the authentication advancements that are designed to secure accounts and payments—without overburdening consumers with a friction-laden experience.

Topics:
security ,gdpr ,cookies ,user data ,tracking coookies

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}