Mozilla is working on a new usability feature in its open source Firefox web browser that can automate interactions with so-called Cookie banners on websites.
This is honestly a nightmare for developers who rely on telemetry and metrics to identify issues and bugs that are otherwise “silent”.
Just because your app doesn’t throw errors doesn’t mean the code isn’t flawed and trapping users within a part of the experience that they cannot fix or leave.
I cant speak for every team in every company, but there’s very little to no interest in “harvesting” your “data” for profit.
We just want to figure out what broke and how we correct it ASAP.
Of course. The well has been poisoned, and there’s no way to know what any company’s actually doing behind the scenes. I’m just lamenting that it had to come to this.
The trick here is clearly defining PII. Anything that could uniquely identify you and be linked to other sources tends to be problematic.
So IP address? Not guaranteed to be unique so not super useful as a session identifier anyway, but IP could be used to cross reference data from other sources that could identify a individual.
Dropping a totally random session cookie? Not allowed because cookies from your domain are now blocked.
It’s really frustrating to hear from your users in the UK about some problems they’re having but you have zero logging, analytics, or anything from sessions in the UK because Sentry, GA, Datadog, whatever are all being blocked because they can’t drop cookies that they need to group messages and so on by session. Even if that session is considered totally anonymous to you, that doesn’t matter because the whole thing is a scoarched earth policy.
Dropping a totally random session cookie? Not allowed because cookies from your domain are now blocked.
The prompts are disabled/dismissed, not the cookies. You can still use e.g. session cookies as long as you don’t make it possible to connect it to other PII.
That said, I hear you regarding the tooling. If Sentry/GA/Datadog can’t be used due to collecting too much PII, that makes your life as a developer much more difficult. It might even be impossible to create a generic analytics tool that avoids PII, though it’s certainly possible to create custom analytics.
Fwiw, I’m based in the EU. My strategy so far has been to talk to and interview real people and rely on aggregate counters. I can see how that makes it difficult to diagnose issues that only appear for a small percentage of users.
This is honestly a nightmare for developers who rely on telemetry and metrics to identify issues and bugs that are otherwise “silent”.
Just because your app doesn’t throw errors doesn’t mean the code isn’t flawed and trapping users within a part of the experience that they cannot fix or leave.
I cant speak for every team in every company, but there’s very little to no interest in “harvesting” your “data” for profit.
We just want to figure out what broke and how we correct it ASAP.
Yes, but the same thing could be said for outlawing encryption - that it’s to make investigators jobs easier. However, that is easily abused.
Turns out to be the same thing for cookies. Why should I be ok with every Tom, Dick, and Harry gathering PII?
Of course. The well has been poisoned, and there’s no way to know what any company’s actually doing behind the scenes. I’m just lamenting that it had to come to this.
I don’t see why you couldn’t still log non-personally identifiable information (non-PII), which should still be able to identify many issues.
That said, many analytics services do log PII, thus requiring consent.
The trick here is clearly defining PII. Anything that could uniquely identify you and be linked to other sources tends to be problematic.
So IP address? Not guaranteed to be unique so not super useful as a session identifier anyway, but IP could be used to cross reference data from other sources that could identify a individual.
Dropping a totally random session cookie? Not allowed because cookies from your domain are now blocked.
It’s really frustrating to hear from your users in the UK about some problems they’re having but you have zero logging, analytics, or anything from sessions in the UK because Sentry, GA, Datadog, whatever are all being blocked because they can’t drop cookies that they need to group messages and so on by session. Even if that session is considered totally anonymous to you, that doesn’t matter because the whole thing is a scoarched earth policy.
The prompts are disabled/dismissed, not the cookies. You can still use e.g. session cookies as long as you don’t make it possible to connect it to other PII.
That said, I hear you regarding the tooling. If Sentry/GA/Datadog can’t be used due to collecting too much PII, that makes your life as a developer much more difficult. It might even be impossible to create a generic analytics tool that avoids PII, though it’s certainly possible to create custom analytics.
Fwiw, I’m based in the EU. My strategy so far has been to talk to and interview real people and rely on aggregate counters. I can see how that makes it difficult to diagnose issues that only appear for a small percentage of users.