No cookies?

Maybe you noticed when you came to my website that there’s no cookie preferences popup. That’s not coincidental – and no, it’s not because my website is not GDPR-compliant. It is.

Actually it’s very simple: I find those cookie preferences popups an enormous pain in the butt. They are so annoying. So when creating this website it was a priority to skip cookies and find other ways to get the, relatively basic, website statistics I need.

Apparently this is a very uncommon approach, judging from the reaction of my website designer who had never worked with anything but Google Analytics (sigh). But cookieless analytics absolutely exist, so this site runs two of them, and neither one drops a cookie or stores anything that identifies you:

  • Plausible: open-source, and I self-host it on my own server here in Europe. No third party, no cookies, nothing about you leaving my hands.
  • PostHog: run in its cookieless mode. No cookies, no cross-visit tracking, and it respects your browser’s Do Not Track setting.

Oh, and there’s exactly one cookie I can set, which is funny when you think about it. Everywhere else a cookie is how they follow you around. This one does the opposite: switch it on and it tells my stats to pretend you were never here. I use it myself so my own poking around doesn’t mess up the numbers. Want to be completely invisible too? Help yourself: Exclude me. Changed your mind? Count me again.

So that’s it: No annoying popups and still a way for me to see if anyone ever visits my website and what they do.

Everybody wins!

/klaus

Into the Cyberverse: Blog and Cybersecurity Buzz

Printed briefing sheets, dice and tokens on the table during a security tabletop game
GRC

CUI protection is about to stop being a defense-only problem.

An incident-response team concentrating as they work through a live tabletop scenario
GRC

CMMC does not just want an IR plan. It wants you to test it.

A participant writing incident notes by hand during a resilience-testing tabletop exercise
GRC

DORA says test your resilience. A document is not a test.

Security professionals in a focused board-level discussion during a tabletop exercise
GRC

NIS2 says train your board. A slide deck will not do it.

A security team gathered around the table during an incident-response tabletop exercise
HackBack

Stop Running Boring Incident Response Tabletop Exercises

Two professionals in a warm one-to-one conversation over coffee
Marketing

Want commercial success in infosec? Stop doing marketing! (like everyone else)

A diverse tech team collaborating around a sticker-covered laptop in a bright office
Employer Branding

Got problems attracting infosec talent? It’s time for your organization to learn geek!

Two colleagues in candid conversation, one taking notes, in natural window light
Employer Branding

Employer Branding: Why Anthropology matters in your efforts to hire cyber security talent

No cookies here

Notice there’s no cookie banner here.
That’s intentional and the site is still GDPR-compliant. I chose to avoid cookies and stick to basic, privacy-friendly stats.
My analytics are cookieless: self-hosted Plausible (EU) and PostHog in cookieless mode, with your IP anonymized. No cross-site tracking, nothing that identifies you.
The one cookie I can set does the opposite of every other cookie: it tells my stats to ignore you completely, and you only get it if you ask.

Everybody wins.

Mmm...Sweet!