[cookiengineer]

> How so?

Because it shifts the contractual obligations and the "legitimate interest" of data to a seemingly first party, which all companies seem to think they can get away with.

Well, until the tracked subjects do a reverse DNS lookup anyways.

[Sander_Marechal]

Adding a CNAME does not make tracking first-party. You can simply report them to the relevant DPO.

[dathinab]

no it doesn't CNAME is just an alias nothing more and even if it would make it first party it still wouldn't make it legal, like at all

you are allowed to track some information first party for certain purposes without user agreement (e.g. fingerprinting for DDOS protection) but you are ONLY allowed to use it for that purpose and have to use _as little data as possible, store it as short as possible_ etc. You also still have to inform the user about it, give them a way to delete it (through because you also have to keep that data as little and as short as possible you often delete it faster then the time you have to process such deletion requests so that tends to be a non issue)

this section of GDPR pretty much never applies to anything ad related ever, because even if you collected some fingerprints for DDOS protection you MUST NOT use them for ads, not are you allowed to pass them to anyone else especially not if that entity does use them for something else.

pretty much nothing in the law text of GDPR ever implied you might get away with aliasing tracker domains, actually very clearly the opposite

generally GDPR is not technology specific, so pretty much any case of "this technical trick to work around GDPR limitations" is pretty much not legal as long as the trick is not to not collect data

[cookiengineer]

Don't need to mansplain DNS RFCs and GDPR to me, explain it to the companies that use CNAME trackers, and maybe their marketing departments.

I am just stating the trend of ad tracker technologies, and how useless the Datenschutzbehoerde is in practice, from the perspective of someone that builds a browser network that tries to uncover these types of constellations.

[dathinab]

then maybe formulate your comment better

because from what you posted above it clearly seemed you don't understand GDPR

people which don't know anything about the topic might come to believe that using CNAME is an actually legally working workaround instead of just a way to hinder ad-blockers