Comment by crote
1 day ago
This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
1 reply →
I don't. I had a RSS software that was polling a local auctions website (Allegro) once an hour and that's it.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
Oh. PayPal is super interesting because they outfight ban me! But I can change a browser and it works just fine.
1 reply →
Have you got a TV? Or a car?
if your IP is fixed, surely no further fingerprinting is necessary?
They don't know that and don't rely on that. That's why fingerprinting exists. They ban only my one browser, that's it.
Static IPs completely destroy privacy when not being shared with many users. Our university has one outgoing static IP for hundreds of users :)
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Eh reads like a “civil war was about states rights not slavery” argument.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
Well now the thing that isn’t “strictly necessary” and they’re not allowed to do is remember my no cookie preference.
1 reply →
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
Yet you can’t set a cookie to remember the preference of opting out.
It's not a preference. It literally is the default requirement.
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.