“GDPR compliant” analytics is probably violating GDPR • Hacker News Board

Re: “GDPR compliant” analytics is probably violating GDPR

#31

Post by legitster » Wed, May 10, 2023, 4:11 PM UTC

mcny wrote: post #27

What I don't understand is how come nobody talks about Microsoft Clarity? I don't know anything about GDPR but I would think if anything violates GDPR, it would be a literal screen recording app that tracks your mouse movements and can show literally where you put your mouse and your moves on the screen. And yet: > Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Stateme…

Re: “GDPR compliant” analytics is probably violating GDPR

#32

Post by pilcrowonpaper » Wed, May 10, 2023, 4:11 PM UTC

dalben wrote: post #12

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always…

Author of the article here! (I tried to submit it but HN rejected it)

I started researching this last weekend, reading through the GDPR, the ePrivacy Directive, and tons of related court rulings (with the help of Google Translate). 2002/58/EC and EC 2016/679 is engrained into my brain now. I was so nervous releasing to the public, but I breathed a sign of relieve after reading your comment.

Re: “GDPR compliant” analytics is probably violating GDPR

#33

Post by shkkmo » Wed, May 10, 2023, 4:14 PM UTC

fasteddie wrote: post #29

dalben wrote: post #12

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always…

This is one of my pet peeves of GDPR! Your nephew and IP Octet cases are very extreme edge cases that we shouldn't build policy around if there are major drawbacks to including them. It's bad there is ostensibly no compliant way to count anonymized unique users in Europe under the current framework.

I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy.

This simply isn't data companies should be allowed to collect without meaningful consent.

Re: “GDPR compliant” analytics is probably violating GDPR

#34

Post by brianoconnor » Wed, May 10, 2023, 4:15 PM UTC

mcny wrote: post #27

What I don't understand is how come nobody talks about Microsoft Clarity? I don't know anything about GDPR but I would think if anything violates GDPR, it would be a literal screen recording app that tracks your mouse movements and can show literally where you put your mouse and your moves on the screen. And yet: > Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Stateme…

If you use clarity (you are the controller, ms the processor) you are responsible for obtaining the necessary consent from your users. That consent should make it clear to the user what behavioral data is collected. (Commonly referred to as cookie banner).

Re: “GDPR compliant” analytics is probably violating GDPR

#35

Post by CaptainNegative » Wed, May 10, 2023, 4:17 PM UTC

This article is incomplete without any mention of strong privacy techniques such as differential privacy.

There is a write-up by Cohen and Nissim [1] where they analyze the privacy statutes in the GDPR and derive a formal definition of privacy, which they call Privacy Singling Out, intended to match the text of the document.

They then show how PSO compares to other privacy definitions, and in particular that Differential Privacy implies PSO (and thus satisfies GDPR). Differential Privacy, in turn, is basically an entire field on its own, with entire textbooks [2] and workshops [3]. It also dominates many privacy-focused conferences, and has been used by US Census Bureau.

There are plenty of truly GDPR-compliant analytics one can do. It just takes some effort to understand how.

[1] https://www.pnas.org/doi/10.1073/pnas.1914598117

[2] https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf

[3] https://tpdp.journalprivacyconfidentiality.org/2022/

Re: “GDPR compliant” analytics is probably violating GDPR

#36

Post by donohoe » Wed, May 10, 2023, 4:17 PM UTC

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer.

It certainly means well but makes a number of jumps that are wrong or untested.

For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely widespread practice and considered necessary.

Likewise, storing data on a personal device (like a cookie) is ok if it is necessary for the service to function (as opposed to unnecessary tracking data or non-critical information). Storing data that manages a session, log-in state, shopping cart, dark-mode preference, is ok)

Thats just a sample.

This person should really consult a lawyer.

Reminder: I am not a lawyer.

Re: “GDPR compliant” analytics is probably violating GDPR

#37

Post by pilcrowonpaper » Wed, May 10, 2023, 4:19 PM UTC

legitster wrote: post #28

I think there are a few incorrect logical leaps in here. An identification number is only regulated insofar as it can be used to "identify a natural person". The law is referring to something like driver's license # or customer ID number or username or etc (or, increasingly, an IP address). Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specificall…

Author here - I've gotten this question a few times now so I'll update the article to better explain it, but "online identifiers" are considered personal data according to Article 4. Recital 30 states:

"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers (...)"

From this, I think we can assume any id connected to a device (and thus user) that can be used re-identify it can be considered personal data, regardless of the time-frame, especially since it mentions "cookie identifiers."

Re: “GDPR compliant” analytics is probably violating GDPR

#38

Post by wouldbecouldbe » Wed, May 10, 2023, 4:20 PM UTC

According to local Dutch governments pretty much everything that touches a US server is a violation.

Especially Google is extremely GDPR unsafe. But also DigitalOcean is often not allowed.

But then Azure is an exception because of some legal mumbo jumbo microsoft convinced them off.

Re: “GDPR compliant” analytics is probably violating GDPR

#39

Post by andrewaylett » Wed, May 10, 2023, 4:22 PM UTC

fogzen wrote: post #6

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

Because that involves storing a cookie, which you're not allowed to do except as necessary to operate the site without first gaining consent.

I use Plausible, which works by hashing IP addresses. Honestly, I disagree with the analysis as given: the claim is that we're assigning a unique ID to each user, but it's really not doing that -- the ID changes, and more than one user may have the same ID.

GDPR is a balancing act, between the rights of the people involved and the desires of data controllers to have useful data. In practice, Plausible presents (at least to my mind) a solution to my legitimate interests with a privacy impact that's suitably minimal for the level of interest I have in the statistics I collect. A cookie is arguably less privacy-preserving, as it has better specificity.

Re: “GDPR compliant” analytics is probably violating GDPR

#40

Post by marvinblum » Wed, May 10, 2023, 4:24 PM UTC

donohoe wrote: post #36

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…

I couldn't agree more.

If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address.

I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.