Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we built a GDPR-compliant website analytics platform without using cookies

usefathom.com

Post reply on HN
Print view View original

81–90 of 129 posts

Re: How we built a GDPR-compliant website analytics platform without using cookies

#81

Post by number6 »

JackWritesCode wrote: post #64
kitchenkarma wrote: post #63

Earlier quoted context omitted.

I don't believe you have understanding what personal data and GDPR is. You are capturing user behaviour and that is very personal regardless if it is "anonymised" or not - and that is without clear need for doing that. That is pretty much against GDPR.

You come across as somewhat hostile but I'm going to assume good intent on your part, so thank you for the challenges on our stance. So if you take a look at Recital 26 ( https://gdpr-info.eu/recitals/no-26/ ): > To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify t…

Article 4 (1) states:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

- a hash number falls into this. You cannot just quote recital 26 and stop reading since you found it fitting. Recital 30 covers the case for "other identifiers" that might replace cookies. No hard feelings we all do.

The data might be anonymous for a third party but if you can single out just one person or in other word one unique visitor it is not anonymously. NB. One IP poisons the whole data.

So your fallback is Article 6(f) which is reasonable but you can not assume the interest of a site owner is always higher than the interest of the visitors. You have to put your arguments into writing and have the means for people to appeal it. 6f is not meant as a blanco cheque or batch job...

Re: How we built a GDPR-compliant website analytics platform without using cookies

#82

Post by JackWritesCode »

lmkg wrote: post #9
pauljarvis wrote: post #2

We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room for improvement. Happy to hear thoughts in the comments.

Hi Paul, thanks for being open about this. I have a big, important question. ICO, the agency in charge of enforcing GDPR and related legislation in England, released guidance earlier this month on the topics of cookies. One of the most notable parts of this guidance is that "device fingerprinting" is treated the same as a cookie[1]. And also that website analytics requires consent to use cookies or similar technologi…

Totally, so we feel we follow the spirit of the PECR law, but until there's a case against it, we don't have precedent. But we feel like if analytics was under fire we'd be at the bottom of the list because we've gone out of our way to follow the spirit of it.

We don't consider ourselves to be building any sort of 'server side cookie', especially since an anonymous hash is only ever tied to one piece of data and is actually set to null as soon as another request comes in. Unlike cookies, data doesn't follow the user around as they browse the site. A cookie would stick with you as you browse a website.

We've spoken with a few lawyers about this and there's too much grey area at the moment. Time will tell and we're hoping that the UK (my home country) sort PECR out.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#83

Post by kitchenkarma »

vonmoltke wrote: post #78
kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

> because you cannot identify an individual by IP either Yes you can, particularly if you correlate across different websites.

You are conflating identification of a person by behaviour analysis with matching an ID. What is the ID is irrelevant here - may as well be a hash. That just proves my point that this project is not compliant.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#84

Post by kitchenkarma »

Matticus_Rex wrote: post #79
kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

They don't have any PII and are therefore not subject to GDPR. They have data that, if it were not anonymized, would be PII, but it's anonymized and therefore isn't.

It doesn't matter if it is an IP or another identifier e.g. a hash. Person can be identified by behaviour and this is not anonymised.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#85

Post by _-___________-_ »

abtestdev wrote: post #8
JackWritesCode wrote: post #5

Earlier quoted context omitted.

https://crypto.stackexchange.com/a/47810

Based on the blog - anyone who shares a IP address (such as inside a company network) would effectively look the same.

Not just inside a company network. CGNAT is pretty commonplace nowadays.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#86

Post by JackWritesCode »

number6 wrote: post #81
JackWritesCode wrote: post #64

Earlier quoted context omitted.

You come across as somewhat hostile but I'm going to assume good intent on your part, so thank you for the challenges on our stance. So if you take a look at Recital 26 ( https://gdpr-info.eu/recitals/no-26/ ): > To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify t…

Article 4 (1) states: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, me…

> Online identifiers for profiling and identification > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. > This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

The thing is, you can't create profiles. So right now I could give you a single entry for our website

> NULL "" "https://www.usefathom.com" "bb9377f4cf33093765835a48e962a5dbd3168499abd12b120c8c118c86c41479"

How could we possibly use that to profile / identify? The hash (bb9377f4cf33093765835a48e962a5dbd3168499abd12b120c8c118c86c41479) is unique in the database table and never repeats.

I hear you. We don't rely on Recital 26 to comply with GDPR. I've not had the Recital 26 piece confirmed by a lawyer but it's a personal hunch / exploration. Hearing your comments on Article 30 are helpful, thank you, would like to hear your thoughts on my reply if possible :)

Re: How we built a GDPR-compliant website analytics platform without using cookies

#87

Post by JackWritesCode »

kitchenkarma wrote: post #84
Matticus_Rex wrote: post #79

Earlier quoted context omitted.

They don't have any PII and are therefore not subject to GDPR. They have data that, if it were not anonymized, would be PII, but it's anonymized and therefore isn't.

It doesn't matter if it is an IP or another identifier e.g. a hash. Person can be identified by behaviour and this is not anonymised.

How can a person be identified from a hash by behaviour? We built the software but you seem to know something we don't...

Re: How we built a GDPR-compliant website analytics platform without using cookies

#88

Post by vmlpvf »

The data is not anonymous. Anonymity is actually very hard to claim (read k-anonymity, differential privacy, etc).

Nevertheless, the chances of identifying someone are probably pretty low, and it´s a good effort to make analytics more privacy friendly.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#89

Post by JackWritesCode »

vmlpvf wrote: post #88

The data is not anonymous. Anonymity is actually very hard to claim (read k-anonymity, differential privacy, etc). Nevertheless, the chances of identifying someone are probably pretty low, and it´s a good effort to make analytics more privacy friendly.

So it's practically anonymous. Nobody has enough computing power to brute it & the data is deleted, typically, in 30 minutes.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#90

Post by gigatexal »

JackWritesCode wrote: post #49
bluesmoon wrote: post #43

Earlier quoted context omitted.

Speaking as someone who built an analytics business while still maintaining an open source version of the code, I can confirm that it's hard. Sometimes it starts off as one small patch that only makes sense for the hosted service, but you can't push to the OS branch until the code is refactored to protect secrets. I cannot give you any tips on managing your time between the two, but you may want to consider raising y…

Thanks for sharing your story. It is hard and we have to fight to not resent OSS because of 0.001% of the OS community. Open-source software has contributed significantly to our lives, and we love it, so we're going to be pursuing OS Version 2 regardless of a few angry people.

Armchair CEO here but charge a fair rate and if that means double do it. People will respect it and pay it if the product or service is helping them make money and I’d rather pay a higher amount and know I’m helping fund a tool that I use to help me be productive than get something cheap.
Post reply on HN