Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flattr now deletes your web browsing history within 3 months

ctrl.blog

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Flattr now deletes your web browsing history within 3 months

#21

Post by maxxxxx »

CydeWeys wrote: post #19
maxxxxx wrote: post #15

Earlier quoted context omitted.

That could be done in a totally anonymous way. Add up total number of donations and total number of visits and distribute money accordingly. There is no need for them to ever store personal information for this.

(a) How do you get the total number of visits. (b) This doesn't correctly distribute funds because there is a correlation between how much someone is willing to give per month and what kind of sites they frequent.

You can calculate the numbers as soon as the data about visits come in and then immediately discard all data. You certainly don't need to store the browsing history. You need the payment amount though and even that you can discard after a month. I am going through this at work right now where we are working data collection about a medical device. First we wanted to suck up all data and figure out what to do with it later. Now we have to think about the data use upfront and get that data in the least intrusive way. I requires more thinking but we get the same benefit with only a fraction of the data. GDPR is a good thing because it causes companies to rethink their data collection strategies.

Re: Flattr now deletes your web browsing history within 3 months

#22

Post by zerostar07 »

jdietrich wrote: post #18
zerostar07 wrote: post #2

Except its not ‘in practice’ because gdpr does not require such thing. In spirit, maybe [i.e. practically they wouldn't be fined for this]

Art. 5: Personal data shall be: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed Recital 39: The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is…

Yes it's quoted in the article too, however "necessary for the purposes" is subject to interpretation, and there is a huge leeway here. In practice it is always possible to claim that some procedure would require retention for longer, and it would be impossible to have them prosecuted for that.

Re: Flattr now deletes your web browsing history within 3 months

#23

Post by giancarlostoro »

diafygi wrote: post #13

I love how some of the tech industry is beginning to see data as a liability rather than an asset. It dramatically reduces the ability for government mass surveillance for two reasons: 1. If companies only collect what they need (to reduce their liability), governments can't demand more than that (or even hack in to get the data illegally). 2. If the industry culture is to limit data collection, governments can't jus…

Wonder what will happen if the US passes laws enforcing companies to retain data for up to a year minimum for digital forensic integrity reasons of cyber criminal cases. Also maybe on the other hand GDPR is good for VPN services to be much more transparent.

Re: Flattr now deletes your web browsing history within 3 months

#24

Post by ocdtrekkie »

d2wa wrote: post #16
bcoates wrote: post #12

"Ads on this site don’t track or stalk you. Please disable your blocker." According to my blocker those are Google ads so...

Google AdSense on Ctrl blog is configured to only show non-personalized ads to any users with the Do-Not-Track (DNT) setting enabled or European Economic Area (EEA) citizens. AdSense still uses cookies for rate-limiting and fraud prevention, but not ad personalization or tracking. requestNonPersonalizedAds=1 is part of AdSense’s GDPR APIs. https://www.ctrl.blog/entry/adsense-gdpr-consent You also only see that partic…

In my case, I don't use an ad blocker, but I do use Privacy Badger, which is only supposed to block tracking, and should only block ads if they can't have their tracking disabled. It looks like Privacy Badger decided "pagead2.googlesyndication.com" should now be blocked as a tracking domain.

Perhaps Google should split off their nonpersonalized ads service into a different domain so such services can easily distinguish between the two?

Re: Flattr now deletes your web browsing history within 3 months

#25

Post by nebulous1 »

maxxxxx wrote: post #21
CydeWeys wrote: post #19

Earlier quoted context omitted.

(a) How do you get the total number of visits. (b) This doesn't correctly distribute funds because there is a correlation between how much someone is willing to give per month and what kind of sites they frequent.

You can calculate the numbers as soon as the data about visits come in and then immediately discard all data. You certainly don't need to store the browsing history. You need the payment amount though and even that you can discard after a month. I am going through this at work right now where we are working data collection about a medical device. First we wanted to suck up all data and figure out what to do with it l…

You will need their relevant browsing history for the entire payment period

Re: Flattr now deletes your web browsing history within 3 months

#26

Post by ocdtrekkie »

zerostar07 wrote: post #22
jdietrich wrote: post #18

Earlier quoted context omitted.

Art. 5: Personal data shall be: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed Recital 39: The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is…

Yes it's quoted in the article too, however "necessary for the purposes" is subject to interpretation, and there is a huge leeway here. In practice it is always possible to claim that some procedure would require retention for longer, and it would be impossible to have them prosecuted for that.

If they divvy up a monthly fee to the sites you visit, they're going to have a hard time explaining the need to keep your browsing data more than a single month: Enough time to pay out to the websites. Then you can maybe add a couple months to account for backups and the like.

It sounds like trimming the data retention here was well-warranted, particularly given the high sensitivity of browsing data.

Re: Flattr now deletes your web browsing history within 3 months

#27

Post by daveFNbuck »

maxxxxx wrote: post #21
CydeWeys wrote: post #19

Earlier quoted context omitted.

(a) How do you get the total number of visits. (b) This doesn't correctly distribute funds because there is a correlation between how much someone is willing to give per month and what kind of sites they frequent.

You can calculate the numbers as soon as the data about visits come in and then immediately discard all data. You certainly don't need to store the browsing history. You need the payment amount though and even that you can discard after a month. I am going through this at work right now where we are working data collection about a medical device. First we wanted to suck up all data and figure out what to do with it l…

There isn't enough data to calculate numbers as soon as the visits come in. If I pay $3/month and visit your site, the amount you get depends on how many other site visits I accumulate during the month. If I visit 2 sites, you get $1.50. If I visit 20 sites, you get $0.15.

You also need to store browsing history to avoid scammers redirecting other users donations. This happens on similar platforms like Spotify. You register for Flattr and just run a script to constantly visit your site. With aggregated statistics, this shifts a bit of everyone's donations to you and can be extremely lucrative. With session history, you just get your own donation back, minus fees.

Re: Flattr now deletes your web browsing history within 3 months

#28

Post by d2wa »

ocdtrekkie wrote: post #24
d2wa wrote: post #16

Earlier quoted context omitted.

Google AdSense on Ctrl blog is configured to only show non-personalized ads to any users with the Do-Not-Track (DNT) setting enabled or European Economic Area (EEA) citizens. AdSense still uses cookies for rate-limiting and fraud prevention, but not ad personalization or tracking. requestNonPersonalizedAds=1 is part of AdSense’s GDPR APIs. https://www.ctrl.blog/entry/adsense-gdpr-consent You also only see that partic…

In my case, I don't use an ad blocker, but I do use Privacy Badger, which is only supposed to block tracking, and should only block ads if they can't have their tracking disabled. It looks like Privacy Badger decided "pagead2.googlesyndication.com" should now be blocked as a tracking domain. Perhaps Google should split off their nonpersonalized ads service into a different domain so such services can easily distingui…

Actually, this is something that should be fixed in Privacy Badger. They can detect the URL parameter that flips ads from personalized to non-personalized (npa=1) and block accordingly. https://github.com/EFForg/privacybadger/issues/2046

Re: Flattr now deletes your web browsing history within 3 months

#29

Post by amelius »

giancarlostoro wrote: post #23
diafygi wrote: post #13

I love how some of the tech industry is beginning to see data as a liability rather than an asset. It dramatically reduces the ability for government mass surveillance for two reasons: 1. If companies only collect what they need (to reduce their liability), governments can't demand more than that (or even hack in to get the data illegally). 2. If the industry culture is to limit data collection, governments can't jus…

Wonder what will happen if the US passes laws enforcing companies to retain data for up to a year minimum for digital forensic integrity reasons of cyber criminal cases. Also maybe on the other hand GDPR is good for VPN services to be much more transparent.

I suspect there will simply be a direct pipe for logging to the government, where companies don't need to retain anything.

Re: Flattr now deletes your web browsing history within 3 months

#30

Post by 13years »

d2wa wrote: post #7
zerostar07 wrote: post #2

Except its not ‘in practice’ because gdpr does not require such thing. In spirit, maybe [i.e. practically they wouldn't be fined for this]

What they’ve done is much cheaper to develop and maintain than implement more granular data deletion tools. Especially when they really don’t need to store the data any longer than one billing period.

Don't they still need to do implement granular deletion to support user requests?
Post reply on HN