78

When you open a Stack Exchange site the first time you are asked about your consent for storing cookies. You can disallow all cookies except those that are defined as "strictly necessary". The explanation of this category from the privacy policy is the following:

These cookies are necessary for our website to function properly and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms or where they’re essential to provide you with a service you have requested. You cannot opt-out of these cookies. You can set your browser to block or alert you about these cookies, but if you do, some parts of the site will not then work. These cookies do not store any personally identifiable information.

I was a bit surprised looking at the cookies when I saw that SE is saving a _ga cookie even before you consent to any cookies and even if you disallow any but the strictly necessary cookies. The _ga cookie is a Google Analytics cookie and contains a unique identifier that is used to track users. Looking at the privacy policy this specific cookie is also clearly identified as a "strictly necessary" cookie there.

Now, it is true that the cookie contains no personally identifiable information, but it does contain a unique ID designed for tracking users. So while it probably doesn't violate the letter of the privacy policy here, I find it very deceptive to put a tracking cookie into the "strictly necessary" category. My personal suspicion would be that this might not be GDPR-compliant, but I don't know enough here to be sure. But independent of that I find it deceptive to claim that a tracking cookie is strictly necessary for the site to function. And if you include tracking cookies as strictly necessary, the explanation in the privacy policy is deceptive and misleading as well, as it does not mention them at all and only describes cookies with actual functionality.

I also checked the network requests, and even with all optional cookies declined there are requests made to Google Analytics that also include the tracking ID from the cookie on every page load. So Google Analytics tracking is enabled automatically without asking for consent. And while the cookie is declared as 1st party in the privacy policy, when the id inside it is sent via Javascript to a third-party domain, that description is rather deceptive while being only technically true.

I don't see how Google Analytics is "strictly necessary" for the functionality on the site, and enabling it and the tracking cookie without consent does not seem right to me.

8
  • 24
    Re GDPR: the cookie consent requirement in European law does not stem from the GDPR, but from the ePrivacy directive. It applies regardless of whether the cookie contains personal data. It says that any access or storage of information on the end user's device needs consent, unless the access or storage is strictly necessary for a service explicitly requested by the user. That is a fairly narrow exception. Since at least 2014 there's official guidance that analytics cookies are not strictly necessary in this sense, though some countries have more flexible rules in national law.
    – amon
    Jan 6 at 11:34
  • 12
    @benisuǝqbackwards in a technical sense they are 1st party cookies, they belong to the SE domain. But the tracking ids in them are sent via Javascript to Google Analytics servers, so while the cookie itself isn't sent to a third party the content is. Jan 6 at 12:02
  • It might possibly have something to do with the fact that Google Analytics data access is a privilege granted to high-rep (25k+) users and moderators, and saving that cookie is necessary for those users to have proper data to exercise their privilege. If it weren't saved for a large proportion of users, it would make the data there useless and would essentially nullify the privilege. Jan 17 at 1:46
  • 1
    Why still no answer? - holidays? Jan 19 at 12:44
  • 2
    @VScode_fanboy tag status-review seems to suggest that they are working on it internally
    – gnat
    Jan 19 at 12:48
  • 2
    @gnat which can take years. :) 2 days ago
  • 3
    @ShadowWizardHatesOmicron I can keep this bountied for years ;-) yesterday
  • @MadScientist I know you can, think you did it before, right? ;) yesterday

You must log in to answer this question.

Browse other questions tagged .