This week the European General Court ordered the European Commission pay €400 damages to a European individual who had visited one of their websites, resulting in their personal data, i.e. their IP address, being sent to a US website server. This is important because it signals an acceptable value for ...

Introduction Explanation Conclusion tweets I see people are still confused about fingerprinting. It is not possible to uniquely identify someone's browser this way, only a purposefully stored identify can do that, in a cookie or other browser storage. Fingerprinting can be used to correlate these identifiers, but does not replace ...

The Information Commissioner’s Annual Report 2023/2024 reports that they "warned 53 of the UK’s top 100 websites that they faced enforcement action if they did not make changes to comply with data protection law". Following this, according to the ICO, "8 had changed their cookie banners to be compliant and ...

The European Data Protection Board (EDPB), an independent European body setup to ensure that the General Data Protection Regulation and the Law Enforcement Directive are applied consistently The EDPB is composed of the heads of the national data protection authorities ( Supervisory Authorities ) of the countries in the European ...

In 2002 the ePrivacy Directive was established to safeguard the privacy of European citizens using online services. It mandated giving individuals the ability to refuse the use of data stored in their online devices, complementing the 1995 Data Protection Direcive that regulated personal data processing. Despite this, the burgeoning surveillance industry largely disregarded this requirement. Instead, it ramped up lobbying efforts and initiatives aimed at influencing political processes against strict data protection and privacy legislation...

Recently US states such as California and Colorado have introduced laws demanding websites respect browser opt-out signals, or “universal opt-out mechanisms” indicating that consumers do not want their personal data used commercially or more generally do not want to tracked across websites and services. Existing examples of such browser based ...

The recent ruling of the Berlin Regional Court, reported by VZBV & tweeted by @peterhense, is important because websites will have to assume that people are exercising their right to object if their browsers have been set to send the "Do Not Track" header signal DNT:1.

Browser settings not enough to make the web safe from tracking Mike O'Neill, June 2023 ©2023, Baycloud Systems Ltd. All rights reserved. A decade after efforts to standardise #DoNotTrack were disbanded at the behest of Big Tech, attempts to drain the online tracking swamp via exclusively techniical mitigations continue to ...

Transparency via a Machine-readable Server Identity and Purpose Descriptor. Mike O'Neill, Febuary 2019 ©2019, Baycloud Systems Ltd. All rights reserved. Web pages often contain many, sometimes hundreds, of elements that initiate transactions with servers other than those managed by the top-level website. These "third-party" servers can collect personal data, link ...

Privacy protecting metrics for web audience measurement Mike O'Neill, February 2019 ©2019, Baycloud Systems Ltd. All rights reserved. The online advertisment ecosystem needs accurate information about how often advertisements are interacted with, and when they are viewed. Advertisers need to know where and how often their ads are showing to ...