Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

It looks like things have been getting worst on the GDPR front, for what I can tell.

I am getting messages from users telling me that that can't use my service because things like Google Fonts and Google Analytics have been essentially made illegal in certain European countries like France, Austria and Germany, due to recent court rulings.

A user told me they know of people who got fined because of this.

Is this true? I can only find a few references here and there, but there seems to be truth to it.

My main question is, what did you do in your case to make your product GDPR compliant?

Any links to services that you used would be very helpful.

Here is what I did so far for compliance.

I generated the legal documents like terms and conditions, privacy policy etc. using a third-party document generation service, and I added a PDF with a GDPR Data Process Agreement (DPA) listing the platforms that I use (Firebase, etc).

I've set the region of my production databases to Europe.

To give more context if needed, I own a bootstrapped company and I'm now setting up the legal paperwork for being compliant with GDPR, the company is Belgium-based.

The company is an online course platform, that allows customers to create their own website, in their own custom domain.

So the customers could have in their websites privacy policies that are different than mine.

What did you do in terms of documentation and third-party services to help you make your company GDPR compliant?

Any services that you recommend?

Thank you for any insight on this matter.

Although you're right, there are alternatives to Google Analytics, you really should work on your messaging. Snark isn't necessary when someone is (seemingly) genuinely asking for help.

In any case, for the OP I would also recommend to use an alternative. I don't know about Plausible Analytics but I have heard good things about Simple Analytics [1]. I'm not sure about Google Fonts.

In terms of GDPR compliance, just keep in mind that you can't hide this stuff behind T&C, you need the user's explicit consent, and it needs to be timely and you can't forbid them from accessing the service if they decline consent. I would also consider using a service that handles GDPR/cookie consent collection for you so you don't need to keep it up to date as time goes on and you can focus on your business instead.

1: https://www.simpleanalytics.com

The idea behind/the backbone of the GDPR is: Whenever you want to process personal information, you'll need the consent of your users and protect the data accordingly.

It's easy as that. You can absolutely use ANY tool or service you want (really), but if it processes personal information (and even IPs count as that) you'll need to ask for consent and inform the user what data is processed and where and how it is processed and how you plan on protecting that data.

That has to happen BEFORE anything is processed if it's not technically ultimately necessary. Hint: Passing user and browser information to Google because your site looks nicer with an external font is technically not necessary. ;-)

With these requirements in mind, you'll find that it's easier to self-host your fonts, run a local Matomo instance with high privacy settings for analytics etc.

It sure is a different approach on "how to do internet", but you'll get the hang of it and it's not that hard after all.

Also: If you don't use any external services that process private information, you don't need a cookie notice after all. ;-)

> A user told me they know of people who got fined because of this.

Yes, some people in Germany are currently running around and try to fine websites that use Google Fonts. It works and is legal, but the morality... That won't stop such people...

Self-hosting fonts can easily help you with that, even Google has a page on that: https://fonts.google.com/knowledge/using_type/self_hosting_w...

Setting up solid required legal docs as you did is a good first step. In general, don't save data about your users. If you need to, minimize the amount. Don't use non-essential cookie, this allows comes with the benefit of not needing to show an annoying a cookie banner.

As an alternative to Google Analytics, I recommend Plausible. If you need more event-based tracking (like Mixpanel), have a look at my app Fugu (https://github.com/shafy/fugu). It doesn't track unique users and is therefore compliant with GDPR. It's hosted in Germany, and you can self host it for free if you want (it's open-source).

This is not very clear yet, but it might well be possible that using US companies as hosting providers might also become illegal under GDPR, even you use their EU data center. This is because the US government can access all US companies customer data, even if it's not hosted in the US. There are already precendences where this was ruled by a court. So, to be safe, I would also pick a EU provider, such as Hetzner, Clever Cloud or Scalingo.

If you track Personally Identifable Information, such as IP addresses or emails, yes. If you track completely anonymously, then no. Of course, this limits what kind of anylses you can do (e.g. cohort-based analyses will be impossible). But I would also wager that you don't really need that, especially if you're a small startup. You can have a look at my open-source, self-hostable Mixpanel alternative if you are interested: https://github.com/shafy/fugu