使用 localstorage 绕过 3rd 方 cookie 规则

Question

In light of 3rd party cookies being disallowed for tracking / marketing purposes, what would prevent a 3rd party from simply creating a local storage entry under child.com within an iframe (main page in URL being parent1.com), where the same child.com local storage value is available when the user browses to parent2.com that also has child.com under an iframe?

Wouldn't child.com (being an ad company or store) be able to track the user across various parent domains, where the javascript in the child.com iframe reads whatever local storage value and sends it up to child.com?

Answer 1

Using local storage does not bypass 3rd party cookie rules; It is subject to exactly the same rules as cookies are. The applicable law (the EU Electronic Privacy Directive 2002) does not specify technical measures, only the resulting impact on privacy. Cookies are simply the most common approach to user tracking, so they are what gets all the attention – especially since they are widely abused.

So it makes no difference how you achieve your tracking; you're going to need consent or some other legitimate basis for collecting the data. If you think you've found a clever technical loophole, you haven't.