“GDPR compliant” analytics is probably violating GDPR
pilcrow.vercel.app
“GDPR compliant” analytics is probably violating GDPR
1–10 of 86 posts
Re: “GDPR compliant” analytics is probably violating GDPR
#2Are you held liable by using them if they "lied" to you about being compliant?
Re: “GDPR compliant” analytics is probably violating GDPR
#3Are you held liable by using them if they "lied" to you about being compliant?
The beauty of GDPR is that it clearly distinguishes between a "data processor" and a "data controller". Services such as cloud computing providers, including databases used to store data, are merely data processors. You, the contracting party, would be the data controller, held liable for anything that happens with the data.
On the other hand, you have a business relationship with your services provider, and you're free to hold them accountable to any claims in the contract. In my experience, however, any liability is capped to some meager amount in the default ToS.
To answer your question, you need to clarify what you'd be liable for. When you're the data controller, the answer to your question is almost always yes.
Re: “GDPR compliant” analytics is probably violating GDPR
#4I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space.
When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box.
(The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)
Re: “GDPR compliant” analytics is probably violating GDPR
#5I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…
The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
Re: “GDPR compliant” analytics is probably violating GDPR
#6I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”.
That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
Re: “GDPR compliant” analytics is probably violating GDPR
#7I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…
The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless.
And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
Re: “GDPR compliant” analytics is probably violating GDPR
#8I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential).
More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
Re: “GDPR compliant” analytics is probably violating GDPR
#9I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
That would require you to now have all users opt-in to cookies on your site where they didn't have to do that before.
... because users absolutely love clicking through those annoying opt-in compliance boxes. So the admin now has the choice of no longer having that data or damaging UX.
The law seems pretty clearly bent on just not letting web admins collect that bedrock baby's-first-metric anymore for European users.
Re: “GDPR compliant” analytics is probably violating GDPR
#10I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…
The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.