I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
The thing the site is doing that isn’t “strictly necessary” is always tracking.
It also limits the exception in relation to e.g. employment.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.