Comment by unilynx
9 hours ago
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
> does not affect fingerprinting
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.
That would be pretty narrow analytics to not need GDPR consent. No IP addresses or any way to uniquely identify a person.