Earlier quoted context omitted.
Hopefully this castrates Google Analytics so much it's useless and goes away.
Why? Having insight into website traffic is hugely valuable to webmasters.
The website should still work without analytics.
Publishers Haven't Realized How Big a Deal GDPR Is
251–260 of 468 posts
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#252GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt th…
I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause/usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (…
This sounds no different to current UK data protection laws (which appear to be flaunted widely). I thought the main change was putting teeth behind the legislation?
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#253Earlier quoted context omitted.
You should note that lots of what that letter suggest it has rights to, are not rights granted under GDPR. Or at least would be subject to legal clarification. If you send that letter, expect to receive a standard response/report of data with a form response that politely & legally amounts to “piss off”. Large organizations have considerable resources set aside to make sure their “piss off” letter is legally defensib…
> That letter is likely only a problem when selectively used by a malicious actor against a small organization. Which is what is so annoying and economically destructive about regulations like these that are broadly applied to all companies, especially on the internet where single person companies are very popular. They are designed in a vindictive way against large companies like Facebook or major online retailers w…
> The western economic environment countinually gets more and more structured favouring large firms, encouraging large scale merging, which usually generates the type of large oligopoly companies who most often does the things that cause regulations to get created, then imposed on smaller firms.
This is where socialism differs from communism - in socialism you have big privately owned companies, whereas in communism these are state owned. Everything else is more or less the same. Europe is currently under transition from group of mostly free mostly capitalist countries into full retard socialist authoritarian regime. Regardless of that, GDPR is a very good thing, shame it has only been introduced now and not 10 years ago.
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#254Earlier quoted context omitted.
GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that data but GDPR requires that you document it. Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control. There is a lot to like with GDPR but it absolutely is expansive & easy…
Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch t…
What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#255Earlier quoted context omitted.
Be careful with hiding everything behind "consent", because consent cannot be a precondition for providing a service. Put differently: if a user does not consent, you cannot refuse them the service if the data you wanted to collect is not strictly necessary to provide the service. The alternative is to only collect data that is strictly necessary to provide the service. In that case GDPR allows you to collect the dat…
How is "strictly" defined? I'm going to guess it's define as "the magistrate knows it when it sees it", so take to be both "don't use the most egregious interpretation", and "don't be a populist punching bad that governments can make hay out of attacking".
Strictly has a pretty clear definition.
If you can provide a service strictly devoid of the PII it means there is no logical necessity for PII.
You can't provide a call-waiting service without a phone number, but you can provide a mail-redirection service without one even though it makes it easier to administer when you have a customer phone number, you can strictly provide (and bill/administer) the service when that information is absent.
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#256[deleted]
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#257Earlier quoted context omitted.
How is "strictly" defined? I'm going to guess it's define as "the magistrate knows it when it sees it", so take to be both "don't use the most egregious interpretation", and "don't be a populist punching bad that governments can make hay out of attacking".
Any data you collect that you do not unambiguously need to provide the service would be an appeal for "legitimate interest" as a legal basis for collecting it. There are a number of things GDPR writes about it and of course you cannot be sure how this will play out in practice, but the main points are: * it must be reasonable from the user's perspective * there must be alternative; you cannot achieve the goal (your "…
I think you meant "no alternative" under the second bullet point.
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#258Earlier quoted context omitted.
Is a single request like this from a single individual excessive or repetitive though??
I think GDPR intends to protect businesses from "denial of service attacks" through sending many repetitive or bogus requests. A single, legitimate request is definitely not excessive.
So if you get 100000 individual requests is that going to be excessive? There are people organising already to send such requests to various sites.
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#259Earlier quoted context omitted.
If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond? Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I k…
An IP address is only personal data in combination with a timestamp or similar time-related information. I don't see an attack scenario where an attacker would gain anything useful. Note that he's propably still risking jail time over this.
Do you have a source of that?
Re: Publishers Haven't Realized How Big a Deal GDPR Is
#260The author claims that for one-time visitors you're not supposed to have any 3rd-party tracking code but uses Google Analytics which Ghostery counts as a tracking code. How's that going to work out for practically every site in the world?
Its going to work out that if they are under the coverage area for GDPR (have EU customers / EU nexus) -- they have to have visitors opt in to be tracked by GA, unless they can guarantee it cant be used to tie the user to any other PII.
How do you know a user consented to that when one computer could be used by many people?