Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR and Google Analytics

adactio.com

Post reply on HN
Print view View original

111–120 of 130 posts

Re: GDPR and Google Analytics

#111

Post by starsinspace »

cromwellian wrote: post #102

Let’s all have a moment of silence for John Perry Barlow’s Declaration of Cyberspace Independence back when it was envisioned the internet would be a place where any entities could communicate or associate free of government control or censorship. Loads of people in here who support the concept of net neutrality which helps enable permissionless innovation by not imposing huge costs on those who publish or allowing o…

Yes sure, an internet free of control and censorship is a nice fantasy. But look at today's internet. It's a giant surveillance machine. And that's not going away on its own, because collecting user data is such good business. So the market will not solve this, quite the opposite, it will only do more of the same if it gets the chance. Regulation is the only thing that can save the internet from itself now.

Re: GDPR and Google Analytics

#112

Post by RutZap »

Speaking of GDPR, I, like many others, am a little bit confused. I've read parts of the legislation but not all of it, so perhaps somebody here can help me out.

Moving towards slightly more delicate issues (compared to tracking someones browsing habits), in relation to the right to be forgotten, if I make a request to Equifax and Experian to remove all personal identifiable information they hold about me, will this actually be possible?

Will my bank then contact me for consent to pass my data back over to them? Will I be able to open a new bank account in the future if Experian and Equifax delete my data?

How would this whole legislation deal with something like this?

Re: GDPR and Google Analytics

#113

Post by sb8244 »

Shoothe wrote: post #23
sb8244 wrote: post #4

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. On top of that, developing business software becomes incredibly complex when navigating all of the potential ramifications of these policies. I thought it wa…

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you don't process PII about people from EU then GDRP does not apply. Merely accessing the page from EU does not trigger GDRP.

I'm pretty sure it does trigger in this case, if you have any tools like GA on your site.

Re: GDPR and Google Analytics

#114

Post by sb8244 »

hvidgaard wrote: post #28
sb8244 wrote: post #4

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. On top of that, developing business software becomes incredibly complex when navigating all of the potential ramifications of these policies. I thought it wa…

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.

This is where the technical complexity comes in. All of a sudden my static hosted page on github which gets a few hundred visitors per month and uses analytics should have Geo blocking? How much overhead will that add to the small site?

Re: GDPR and Google Analytics

#115

Post by bonesss »

neya wrote: post #56
bonesss wrote: post #34

Earlier quoted context omitted.

> I'm going to block access to my services to anyone based in Europe... I'm tired of governments that I don't care about expect me to follow some nonsense I have no part of under the guise of compliance. Ever been on a plane? ... Used a cellphone outside your own borders? ... Eaten a beautifully ripened imported cheese along with a stunning imported wine? Put your money where your mouth is: boycott all benefits of tr…

Sorry, wrong example. When I take a plane to some country I will follow their rules, protocols, yes. But imagine, I had a museum that can be accessed world wide, instantly and some guy from a specific country/region had a problem with one of my showcases in the museum, do you expect me to alter my museum for this guy and his groupies so they'll be happy?

Sorry, incorrect rebuttal.

Whenever you or anything you ship touches an commercial airliner you enter a globally coordinated network of non-governmental compliance and multi-government regulation spanning every aspect of every device and every protocol. The only reason you CAN take planes to other countries is this international "compliance". Where "you" had to do exactly what "we" have said, because if "you" don't then "you" get to be excluded from global trade.

I have already addressed your hypothetical in my comment... There is no "expect", only business reality. The same solution as above, and the same irony, applies.

Re: GDPR and Google Analytics

#116

Post by SAI_Peregrinus »

ocdtrekkie wrote: post #59
nemothekid wrote: post #54

Earlier quoted context omitted.

If I'm a US company, with a non-GDPR compliant website, and a visitor from the EU visits my site, under what jurisdiction does the EU have to reprimand me? Or will my site just be blocked in the EU?

It's unlikely foreign sites catered to foreign viewers would be impacted. When I buy something from a site that only sells in another country's currency, I know I'm probably going outside my own nation's protections a bit. But if you're a company specifically soliciting EU customers, and especially if you have a presence in the EU physically, expect to have issues if you're collecting data on them without consent. Be…

Extradition typically only applies to things which are crimes in both jurisdictions. Since these things aren't crimes in the US extradition is very unlikely.

Re: GDPR and Google Analytics

#117

Post by iddqd »

smhg wrote: post #110
iddqd wrote: post #104

Earlier quoted context omitted.

You can still set up a site and not have to worry about much, as long as you're not processing other peoples personally identifiable information without their explicit consent.

But then you don't consider the IP address personally identifiable information? The GDPR does.

You can serve web content without storing the IP address of the user. If you need to use it for anonymous correlation of requests, you can hash it first.

Re: GDPR and Google Analytics

#118

Post by smu »

iddqd wrote: post #117
smhg wrote: post #110

Earlier quoted context omitted.

But then you don't consider the IP address personally identifiable information? The GDPR does.

You can serve web content without storing the IP address of the user. If you need to use it for anonymous correlation of requests, you can hash it first.

In addition, you can store the IP address if you want to use it for infosec (such as, finding out who to block in case of a ddos attack). See https://gdpr-info.eu/recitals/no-49/

The recital also mentions "accidental events that compromise availability, integrity, authenticity,..." That seems to cover debugging for me. No need to ask for consent.

To do certain analytics like page count, you don't need the IP, so that seems ok for me. To track individual customers however, that's something else.

PS: according to GDPR, a hashed IP will be "pseudonimisation", not anonymisation because you can have a key to go back to the original value. True anonymisation removes all info (the IP in this case)

Re: GDPR and Google Analytics

#119

Post by smu »

sb8244 wrote: post #114
hvidgaard wrote: post #28

Earlier quoted context omitted.

> It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. If you open shop in a different country, you follow their laws. Your website being accessible in a country is seen as the same thing. It's not hard to implement geo blocking if you want to show best effort and thereby opt out of it.

This is where the technical complexity comes in. All of a sudden my static hosted page on github which gets a few hundred visitors per month and uses analytics should have Geo blocking? How much overhead will that add to the small site?

It's very unlikely your static page contains personal data that would be ok in the US but not in EU.

If you're referring to logging, there are some good responses in this discussion on how that will still be ok.

Re: GDPR and Google Analytics

#120

Post by smu »

woolvalley wrote: post #94
Xylakant wrote: post #87

Earlier quoted context omitted.

And sure, by German law, your data will be deleted after you paid your fine. (Plus some time for processing and record keeping) This doesn’t make this a good analogy though. The GDPR does not prohibit storing private data, it just requires explicit and informed consent. It does not require deletion of data that is required to conduct a transaction, such a receipts, order data or adresses required to fulfil an order.…

The GDPR isn't as good as you think it is. It's going to turn into one of those laws where small software startups / or normal small businesses are just going to be in constant violation, because the amount of resources required to do it properly requires a team of 5 or 10 expensive software engineers. It's going to be a great way to nip small companies in the bud and consolidate this kind of stuff into bigger compan…

I'm pretty sure the hospital in the developing nation doesn't sell in the EU, so they don't need to comply.

Phew, crisis averted!

Post reply on HN