DAT214 Fake-Cookie-Banner (DSGVO-Beschwerde, Teil 2)

Tolle Episode! Ich habe den Scanner auf "https://www.cookiebox.pro/" ausprobiert und der meldet bei einer Website "non compliant" Marketing Cookies von Hubspot. In diesem Fall ist jedoch Hubspot so eingestellt, dass dort keine PII erfasst werden, sondern nur anonymisierte Daten. Der Cookie Scanner müsste also so "schlau" sein um zu verstehen, welche genauen Informationen ein Cookie sammelt - in welcher Konfiguration des Systems - um dann zu beurteilen, ob das persönliche Daten sind, oder eben nicht. Oder? Speziell werden dort 3 Hubspot Cookies bemängelt: *hs_ab_test* This cookie is used to consistently serve visitors the same version of an A/B test page they’ve seen before. It contains the id of the A/B test page and the id of the variation that was chosen for the visitor. It expires at the end of the session. *messagesUtk* This cookie is used to recognize visitors who chat with you via the chatflows tool. If the visitor leaves your site before they're added as a contact, they will have this cookie associated with their browser. With the Consent to collect chat cookies setting turned on: If you chat with a visitor who later returns to your site in the same cookied browser, the chatflows tool will load their conversation history. The messagesUtk cookie will be treated as a necessary cookie. When the Consent to collect chat cookies setting is turned off, the messagesUtk cookie is controlled by the Consent to process setting in your chatflow. HubSpot will not drop the messagesUtk cookie for visitors who have been identified through the Visitor Identification API. The analytics cookie banner will not be impacted. This cookie will be specific to a subdomain and will not carry over to other subdomains. For example, the cookie dropped for info.example.com will not apply to the visitor when they visit www.example.com, and vice versa. It contains an opaque GUID to represent the current chat user. It expires after 6 months. *__cf_bm* This cookie is set by HubSpot's CDN provider and is a necessary cookie for bot protection. It expires in 30 minutes. Learn more about Cloudflare cookies. Hier finden sich diese Infos bei Hubspot: https://knowledge.hubspot.com/privacy-and-consent/what-cookies-does-hubspot-set-in-a-visitor-s-browser Fazit: Ich kann nicht im Detail auseinander nehmen, wer jetzt "Recht hat" bzw. ob das GDPR compliant ist - oder nicht. Ich habe aber aufgrund des Beispiels Zweifel, ob der Alarm zurecht ausgelöst wird. Viele Grüsse