Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“GDPR compliant” analytics is probably violating GDPR

pilcrow.vercel.app

Post reply on HN
Print view View original

21–30 of 86 posts

Re: “GDPR compliant” analytics is probably violating GDPR

#21

Post by madeofpalk »

superkuh wrote: post #11
shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more imperso…

WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'.

I don't consider it a loss that there's one less place my phone number and address is posted online.

Re: “GDPR compliant” analytics is probably violating GDPR

#22

Post by fogzen »

frereubu wrote: post #19
fogzen wrote: post #14

Earlier quoted context omitted.

I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.

In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.

The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone.

What should matter is what’s logged. Every request contains an IP that’s how the web works.

Re: “GDPR compliant” analytics is probably violating GDPR

#23

Post by djbusby »

spacebanana7 wrote: post #10
Nextgrid wrote: post #5

Earlier quoted context omitted.

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.

Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.

Re: “GDPR compliant” analytics is probably violating GDPR

#24

Post by [deleted] »

dalben wrote: post #12

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always…

[deleted]

Re: “GDPR compliant” analytics is probably violating GDPR

#25

Post by chrismorgan »

gizmo wrote: post #15
shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights…

Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff.

(Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)

Re: “GDPR compliant” analytics is probably violating GDPR

#26

Post by Hitton »

superkuh wrote: post #11
shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more imperso…

This is wrong. Look how whois works on .eu domain.

Re: “GDPR compliant” analytics is probably violating GDPR

#27

Post by mcny »

What I don't understand is how come nobody talks about Microsoft Clarity? I don't know anything about GDPR but I would think if anything violates GDPR, it would be a literal screen recording app that tracks your mouse movements and can show literally where you put your mouse and your moves on the screen.

And yet:

> Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Statement.

https://learn.microsoft.com/en-us/clarity/faq

Is this true?

Re: “GDPR compliant” analytics is probably violating GDPR

#28

Post by legitster »

I think there are a few incorrect logical leaps in here. An identification number is only regulated insofar as it can be used to "identify a natural person". The law is referring to something like driver's license # or customer ID number or username or etc (or, increasingly, an IP address).

Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specifically called out several times as fine.

In that context, the author is really stretching to claim that any amount of "fingerprinting" is deanonymizing. But there's not a lot of evidence that a fingerprint, no matter how good of one, is in violation of GDPR until it can be tied to a natural* person*.

Re: “GDPR compliant” analytics is probably violating GDPR

#29

Post by fasteddie »

dalben wrote: post #12

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always…

This is one of my pet peeves of GDPR! Your nephew and IP Octet cases are very extreme edge cases that we shouldn't build policy around if there are major drawbacks to including them. It's bad there is ostensibly no compliant way to count anonymized unique users in Europe under the current framework.

Re: “GDPR compliant” analytics is probably violating GDPR

#30

Post by fogzen »

gizmo wrote: post #15
shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights…

They always were liable. But of course, people would have to show they were actually harmed in some way by being “tracked”. GDPR makes it illegal to collect data that doesn’t cause any demonstrable harm to anyone.
Post reply on HN