Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plausible Analytics Isn't GDPR Compliant

blog.paranoidpenguin.net

Post reply on HN
Print view View original

11–20 of 80 posts

Re: Plausible Analytics Isn't GDPR Compliant

#11

Post by sarnowski »

ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

The cookie banners come from the ePrivacy Regulation and are supposed to inform you that the website is storing data on the your device and that you can opt out (not in) of it.

Consent is required by GDPR but not for the technical circumstance that you store a cookie but that you use it for profiling. Some lawyers argue that basic web performance is legitimate interest especially in e-commerce, others don’t risk it and ask for consent (which is strictly opt in).

Re: Plausible Analytics Isn't GDPR Compliant

#12

Post by mrweasel »

franky47 wrote: post #4
ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

> If you track a user, you have to get his consent before doing it This would mean any server-side analytics (looking at access logs, which include IP address and user-agent) cannot be used for analytics or tracking, since there is no way for a user to give/deny consent to a page that already has logged information on them.

I would like to see more software having the option of just logging the users country and not the IP, and perhaps just as generic a user agent as possible (Just, is this Chrome, FireFox, Edge, whatever, but nothing else.)

for example for Nginx something like:

log_format logfmt '$remote_country - [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_generic_user_agent" "$gzip_ratio"';

That would assume access to a GeoIP database, but it would be helpful.

Re: Plausible Analytics Isn't GDPR Compliant

#13

Post by luckylion »

mrweasel wrote: post #9
ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

I don't have the answer, but the consent banners are interesting. I have two browser plugins: "I don't care about cookies" and "Never Consent", I'm not sure what Never Consent doesn't technically, but the other one just hides the DOM element with the cookie thingy. That means that I never see the "consent" banners so I can't click the "Okay" buttons. I should test to see how many sites just assumes OK to cookies beca…

Not sure whether you mixed up I Don't Care About Cookies and the other one, But IDCAC does not just hide the DOM elements - it always gives full consent.

From their website [1]: By using it, you explicitly allow websites to do whatever they want with cookies they set on your computer (which they mostly do anyway, whether you allow them or not).

Which is fine for me, I use it with Cookie Autodelete, but if you don't, you should be aware of that.

[1] https://www.i-dont-care-about-cookies.eu/

Re: Plausible Analytics Isn't GDPR Compliant

#15

Post by Nextgrid »

_the_special_ wrote: post #14

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

Re: Plausible Analytics Isn't GDPR Compliant

#16

Post by mrweasel »

luckylion wrote: post #13
mrweasel wrote: post #9

Earlier quoted context omitted.

I don't have the answer, but the consent banners are interesting. I have two browser plugins: "I don't care about cookies" and "Never Consent", I'm not sure what Never Consent doesn't technically, but the other one just hides the DOM element with the cookie thingy. That means that I never see the "consent" banners so I can't click the "Okay" buttons. I should test to see how many sites just assumes OK to cookies beca…

Not sure whether you mixed up I Don't Care About Cookies and the other one, But IDCAC does not just hide the DOM elements - it always gives full consent. From their website [1]: By using it, you explicitly allow websites to do whatever they want with cookies they set on your computer (which they mostly do anyway, whether you allow them or not). Which is fine for me, I use it with Cookie Autodelete, but if you don't,…

Thanks, I used one at some point that just hides the element... Now I just use I Don't Care About Cookies and flush cookies when I close the browser.

But yes, something I need to be aware of.

Re: Plausible Analytics Isn't GDPR Compliant

#17

Post by donohoe »

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough.

The blog post conflates general data points with PII. The IP address is considered PII.

While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t.

For background, I’ve done GDPR implantation a in the past, an a privacy advocate in that sense, and spent more time with lawyers in this subject then I’d care to admit.

(Pardon brevity/typos, on phone with unreliable connection)

Re: Plausible Analytics Isn't GDPR Compliant

#18

Post by gspr »

Nextgrid wrote: post #15
_the_special_ wrote: post #14

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

Nitpick: if it's reversible, determinism doesn't matter.

Re: Plausible Analytics Isn't GDPR Compliant

#19

Post by _the_special_ »

Nextgrid wrote: post #15
_the_special_ wrote: post #14

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis.

So, no, I do not think it is deterministic.

Re: Plausible Analytics Isn't GDPR Compliant

#20

Post by ramboram »

franky47 wrote: post #4
ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

> If you track a user, you have to get his consent before doing it This would mean any server-side analytics (looking at access logs, which include IP address and user-agent) cannot be used for analytics or tracking, since there is no way for a user to give/deny consent to a page that already has logged information on them.

[dead]
Post reply on HN