Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Google Analytics without GDPR consent

evrim.io

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Using Google Analytics without GDPR consent

#111

Post by d1sxeyes »

lucb1e wrote: post #110
d1sxeyes wrote: post #107

Earlier quoted context omitted.

Should is not the same as 'must'. If the cookie is purely functional, and is not used for any other purposes, you are neither required to request consent nor inform, provided it is for a service the user explicitly requests . For example, authentication, preference setting, form submission, etc. are all explicit requests. If your cookies do not require consent, you are not required to explain them to the user (althou…

> you are not required to explain them to the user (although personally I'd say it's a good practice). Nitpick: you are actually required to explain it, but not by shoving a banner in their face. You can explain it in the privacy policy, to be retrieved on demand by the user themselves. See also GordonS' comment elsewhere in this thread, who is correct about the need for a privacy policy (and I posted a more elaborat…

Thank you, that was an interesting read. I'll bear this in mind going forwards.

Re: Using Google Analytics without GDPR consent

#112

Post by slake »

brtkdotse wrote: post #37
krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

This is my understanding as well - no matter how obfuscated the final identifier is, if you derived it from PII then it’s considered PII as well. However, IANAL.

If the final identifier can't be reverse engineered to identify the specific individual is it PII?

So A user visited me on the 12th. That user visited me again on the 15th. Is that PII?

Re: Using Google Analytics without GDPR consent

#113

Post by 2Gkashmiri »

How does something like truecaller work with gdpr? I mean you are given some sort of one way access to names of contacts from their database and in return you pay them real money, you are shown ads based on your IP address, who you call, how long and other parameters and the most problematic is the fact that your phone contacts are taken as a payment.

I came across this app back in 2011 and noped the fuck away. Never installed trucaller once and my details may be there but I don't want it.

My question, can truecaller take your contacts not to serve you in particular but to build a wordwide database and they dont say that in clear terms from what I have asked its users. They DONT know the software is doing that

Re: Using Google Analytics without GDPR consent

#114

Post by nolito »

ukutaht wrote: post #65
krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

This is how I understand GDPR as well. Just hashing the IP address along with other static values is too easy to reverse and not considered anonymization under GDPR. For https://plausible.io we added a daily salt to the hash for this exact reason. By deleting the salt at the end of each day, the hash becomes impossible to reverse and visitor data can be considered anonymous. We lose unique visitor tracking beyond one…

That's only from your perspective.

Website owners are still sending visitors IP-addresses your way. They have to trust you to do the hashing and deleting the salt (and pepper?) and not delivering data to others (4th party).

Another problem you - and others like goatcounter have - is described here https://blog.paranoidpenguin.net/2020/07/plausible-analytics....

Re: Using Google Analytics without GDPR consent

#115

Post by arp242 »

nolito wrote: post #114
ukutaht wrote: post #65

Earlier quoted context omitted.

This is how I understand GDPR as well. Just hashing the IP address along with other static values is too easy to reverse and not considered anonymization under GDPR. For https://plausible.io we added a daily salt to the hash for this exact reason. By deleting the salt at the end of each day, the hash becomes impossible to reverse and visitor data can be considered anonymous. We lose unique visitor tracking beyond one…

That's only from your perspective. Website owners are still sending visitors IP-addresses your way. They have to trust you to do the hashing and deleting the salt (and pepper?) and not delivering data to others (4th party). Another problem you - and others like goatcounter have - is described here https://blog.paranoidpenguin.net/2020/07/plausible-analytics... .

I thought that "CNAME cloacking" was already addressed by uBlock and most similar tools last year already? I don't think it's a very effective method to bypass them.

At least, that's what I can gather from the linked issue and https://github.com/gorhill/uBlock/releases/tag/1.25.0 – so I'm not sure if I understand that article.

In goatcounter the whole CNAME thing was just intended as a cute "shortcut" so you can have "stats.example.com"; I assumed that all adblockers would deal with that correctly, and it was never intended as a way to bypass them (and certainly never advertised as such).

As for "selling IP address", how do you know "blog.example.com" isn't just collecting and selling that? Or HN for that matter?

Re: Using Google Analytics without GDPR consent

#116

Post by simpss »

zinekeller wrote: post #70
simpss wrote: post #26

Earlier quoted context omitted.

GDPR doesn't apply to personal websites where there is no company behind the website. edit: here's a source: https://gdpr-info.eu/art-2-gdpr/ This Regulation does not apply to the processing of personal data: (c) - by a natural person in the course of a purely personal or household activity;

You have misinterpreted that (which I understand if you're American, since the word personal have a different legal definition there). Purely personal activities is not really interpreted as "I have a personal blog" sense, but in "I need to call my friends" sense. If you are indiscriminately processing data of possibly hundreds of people (note that at least on cases in Austria, it can be as low as 50 individuals), it…

I completely agree, if you're acting outside of personal bounds this does not exclude you. ex, generating profit by selling ads, which gets taxed as income.

Probably shouldn't have tacked on the company bit.

Re: Using Google Analytics without GDPR consent

#117

Post by simpss »

PeterisP wrote: post #101
simpss wrote: post #26

Earlier quoted context omitted.

GDPR doesn't apply to personal websites where there is no company behind the website. edit: here's a source: https://gdpr-info.eu/art-2-gdpr/ This Regulation does not apply to the processing of personal data: (c) - by a natural person in the course of a purely personal or household activity;

A personal blog would likely qualify for that, however, many personal websites would not pass the test of "no connection to a professional or commercial activity" (from https://gdpr-info.eu/recitals/no-18/ ) - if you sell something on that site, or have ad revenue, or use it as advertisement for your professional consultations, then it's not purely household activity. If you have a bootstrapped web startup project th…

yes, that is a good clarification. Probably shouldn't have tacked on the "not a company" bit.

A person without a company can act outside of the personal bounds.

Re: Using Google Analytics without GDPR consent

#118

Post by nolito »

arp242 wrote: post #115
nolito wrote: post #114

Earlier quoted context omitted.

That's only from your perspective. Website owners are still sending visitors IP-addresses your way. They have to trust you to do the hashing and deleting the salt (and pepper?) and not delivering data to others (4th party). Another problem you - and others like goatcounter have - is described here https://blog.paranoidpenguin.net/2020/07/plausible-analytics... .

I thought that "CNAME cloacking" was already addressed by uBlock and most similar tools last year already? I don't think it's a very effective method to bypass them. At least, that's what I can gather from the linked issue and https://github.com/gorhill/uBlock/releases/tag/1.25.0 – so I'm not sure if I understand that article. In goatcounter the whole CNAME thing was just intended as a cute "shortcut" so you can have…

Then use a shortcut :)

What about the (naive) users that d'ont use uBlock and similar tools and d'ont even know they exist?

BTW Goatcounter collects potential personal data. The querystring is not removed, is stored and presented to the website owner.

Post reply on HN