We outsmarted CSGO cheaters with IdentityLogger

I hope they asked permissions for storing those cookies. Otherwise they're violating various EU laws.

Not every cookie requires consent.

https://commission.europa.eu/resources-partners/europa-web-g...

In this case, this one might fit:

> User centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration

GDPR didn't take effect until May 2018, this only worked until October 2017.

Great point!

This community is Australian & New Zealand based, we had 0 European players or visitors. And as @unsnap_biceps this predated GDPR compliance.

You are right though that you wouldn't be able to do this in Europe today because asking for fingerprinting consent defeats the purpose because the hacker would likely quickly figure out what is happing and circumvent it.

LOL

I'm not a lawyer, but I think this actually has some interesting things to think about. Not all cookies require consent under the ePrivacy directive, there is an exception for cookies that are "strictly necessary for the delivery of a service requested by the user". I think that'd fit in this case, since providing a cheater free experience is part of the "service" the players are looking for. At the same time, the ePrivacy directive also mentions that the user should be provided with "clear and comprehensive information" about what is stored. Providing that would render the cookies useless.

I don't know how these would balance each other out legally, but it's fun to think about

GDPR is about the processing of personal data. Cookies (and such) are subject to 2002's ePrivacy directive

It's clearly a tracking cookie.

> for a limited persistent duration

FTA:

> However, the VGUI browser had no issues saving cookies with expiry dates exceeding 10+ years!

So no, it doesn't even qualify.

No, that doesn't count. Companies have tried arguing that their ads' tracking cookies are strictly necessary otherwise they wouldn't be able to offer their services (ads pay the bills). And yet, they require consent.

Preventing cheaters is similar. And this is blatantly a tracking cookie.

You aren't considering that ad cookies/tracking are used to enable a service to someone else (ad buyers), while this anti-cheat tracking cookie is used to enable a service to the user themselves (a cheat-free gaming experience.) I think that may make the difference.

Also, all of this was in 2017. Anyone doing it in 2024 should indeed run it past a lawyer.

10 years is a limited duration

So is a million years. Not how it works.