Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plausible Analytics Isn't GDPR Compliant

blog.paranoidpenguin.net

Post reply on HN
Print view View original

31–40 of 80 posts

Re: Plausible Analytics Isn't GDPR Compliant

#31

Post by [deleted] »

bmcn2020 wrote: post #3
ramboram wrote: post #2

I've been looking into GDPR and when a cookie consent is needed. In fact, there's no thing called "cookie consent". If you track a user, you have to get his consent before doing it, whether you use cookie consent or now. Ever since I joined HN, there's a lot of marketing going on here from privacy-first Google analytics alternative guys. I found this review showing Plausible and similar products using browser fingerp…

If you're tracking a user in the EU, you need consent. The GDPR doesn't cover the 'how' -- just that it needs to be done. So, if there's tracking of any kind, you'll need consent. Applies off site as well -- pretty much every cold email tracking software, like Yesware, is in violation of GDPR, since you didn't get the recipient's consent to track their opens and clicks.

[deleted]

Re: Plausible Analytics Isn't GDPR Compliant

#32

Post by ramboram »

donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

True. There's one thing that concerns me. Google Analytics is just not the solution because we don't get data ownership. Then, these privacy analytics are coming. First, Fathom then some copies. But, all claims "No consent needed. Track your users without letting them know".

It's not how it should be. Analytics solutions should have built-in options to allow users to opt-out (precisely, an embeddable in-built opt-out banner).

Personally, I don't like tracking my activities. I use tracker blockers to prevent that. Yet, these solutions are promotion custom domains (CNAME cloaking), which even Google Analytics does.

When will have the option to fully opt-out from tracking?

If a Chrome or Firefox dev reading this comment, what about introducing a tracking allowance API and allow users to opt-in and opt-out for tracking in the browser level. A really privacy-first analytics solution would be one that respects user's browser tracking settings.

It's my opinion.

Re: Plausible Analytics Isn't GDPR Compliant

#33

Post by Semaphor »

mrweasel wrote: post #16
luckylion wrote: post #13

Earlier quoted context omitted.

Not sure whether you mixed up I Don't Care About Cookies and the other one, But IDCAC does not just hide the DOM elements - it always gives full consent. From their website [1]: By using it, you explicitly allow websites to do whatever they want with cookies they set on your computer (which they mostly do anyway, whether you allow them or not). Which is fine for me, I use it with Cookie Autodelete, but if you don't,…

Thanks, I used one at some point that just hides the element... Now I just use I Don't Care About Cookies and flush cookies when I close the browser. But yes, something I need to be aware of.

Just FYI, tracking is so much more advanced than just cookies. Using IDCAC means you consent to them using any method of tracking you.

Re: Plausible Analytics Isn't GDPR Compliant

#34

Post by wizzwizz4 »

jefftk wrote: post #22
_the_special_ wrote: post #19

Earlier quoted context omitted.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.

That is deterministic, but the key thing is that it is not reversible

Technically, you could enumerate all four billion IP addresses (multiplied by all common user agents) to reverse it. This is, however, prohibitively expensive for tracking, so I think it does the job.

Re: Plausible Analytics Isn't GDPR Compliant

#35

Post by jonahbenton »

_the_special_ wrote: post #19
Nextgrid wrote: post #15

Earlier quoted context omitted.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.

It depends on whether they retain or can reproduce the salt for a given date.

The rule in effect is- a person knows the IP their ISP granted them on the dates they were granted. They ask- do you have any records of me from these IPs on these dates.

Assuming Plausible keeps the record of salt by date, the answer is yes, we have records of you, because they can retrieve the salt, recreate the ID, and locate the records.

If they do not retain the salt, in contrast, they cannot respond to individual requests for their records and that would also imply they are not able to do day over day returning visitor calculations.

Re: Plausible Analytics Isn't GDPR Compliant

#36

Post by markosaric »

mikehall314 wrote: post #28
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

I was under the impression that they did not store IP addresses, though I could be incorrect. Their docs suggest as much https://docs.plausible.io/excluding/ "Most web analytics tools do this by excluding certain IP addresses from being counted. However, we do not store the visitors’ IP addresses in our database for privacy reasons"

We never store IP addresses in our database or logs. See the full details of our data policy: https://plausible.io/data-policy

Re: Plausible Analytics Isn't GDPR Compliant

#37

Post by markosaric »

Nextgrid wrote: post #21
_the_special_ wrote: post #19

Earlier quoted context omitted.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.

Is the salt key stored, or is it discarded?

Old salts are deleted to avoid the possibility of linking visitor information from one day to the next. See https://plausible.io/data-policy

Re: Plausible Analytics Isn't GDPR Compliant

#38

Post by nscmnto »

donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

The IP address, on its own, should not considered PII.

There was a ruling in Breyer vs. Germany that IP addresses can be considered PII – in certain circumstances.

The case was brought against an ISP, and the court ruled that the company had enough correlating data at its disposal to make an IP address de facto PII for any of its customers. The court limited its ruling, saying that with just an IP address alone, the protections associated with the directive wouldn’t apply.

Re: Plausible Analytics Isn't GDPR Compliant

#39

Post by gspr »

Nextgrid wrote: post #24
gspr wrote: post #18

Earlier quoted context omitted.

Nitpick: if it's reversible, determinism doesn't matter.

Yep indeed, deterministic isn't really the right word here. Reversibility is all that matters, although am I correct in saying that it would imply determinism?

> am I correct in saying that it would imply determinism?

I don't know, because neither "reversibility" nor "determinism" are precisely defined (this is not criticism of your comment in any way).

Here's one semi-reasonable interpretation of the two words for which reversibility would not imply determinism: Imagine a "process" (I, too, am being imprecise and calling this a "process" instead of a function) that takes as input an integer between 1 and 6 inclusive. Its output for the input n is a dice roll with a dice that is biased in favor of n, but is otherwise fair. Now, this is not a deterministic process, but if you are allowed to feed it the same input multiple times, you can probablistically reverse it.

Anyway, sorry for the tangent – your original point was the important one.

Re: Plausible Analytics Isn't GDPR Compliant

#40

Post by scoot_718 »

donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

Actually with CGNAT IP (and arguably before then) IP addresses aren't personally identifiable information.

That said, the GDPR is deranged and might define things differently. Blocking the EU is safer.

Of course there are research exceptions that you could drive a truck through, and logging is still valid, so none of this matters.

Post reply on HN