1

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter?

My web app check a key presence in local storage. Key is the same for all. If it's not found - call /increment api (with no message or data at all) and create one. If it already exists - do nothing. Just like "warrant canary". I like to call it reverse personification.

|improve this question
1

The GDPR covers information that can be used to identify a person. But a mere counter does not offer this possibility.

Do not link database entries to this cookie. For the GDPR, it does not matter whether personal data is stored directly in the cookie, or is merely indexed by this cookie.

|improve this answer
  • But strictly speaking such a counter still reduces entropy of user identity by almost one bit. – SerG Feb 27 at 11:50
  • @SerG: Well, browser identity. And while you can make a point that browser identity can be correlated with user identity, you can't do that with literally one bit. – MSalters Feb 28 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.