Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plausible Analytics Isn't GDPR Compliant

blog.paranoidpenguin.net

Post reply on HN
Print view View original

41–50 of 80 posts

Re: Plausible Analytics Isn't GDPR Compliant

#41

Post by markosaric »

raverbashing wrote: post #27

I think the article might be reading too much into it Is Plausible actually tracking users? I mean actually allowing you to get a user's history (or IPaddr history) on your website across multiple days? (or a subset of this?) If it does, then yes, it is not compliant without the user agreeing. If it doesn't, then no.

Everything is isolated. There's no way for us nor for our customers to get visitor history across days, across websites or across devices. See https://plausible.io/privacy-focused-web-analytics

Re: Plausible Analytics Isn't GDPR Compliant

#42

Post by cuu508 »

mrweasel wrote: post #12
franky47 wrote: post #4

Earlier quoted context omitted.

> If you track a user, you have to get his consent before doing it This would mean any server-side analytics (looking at access logs, which include IP address and user-agent) cannot be used for analytics or tracking, since there is no way for a user to give/deny consent to a page that already has logged information on them.

I would like to see more software having the option of just logging the users country and not the IP, and perhaps just as generic a user agent as possible (Just, is this Chrome, FireFox, Edge, whatever, but nothing else.) for example for Nginx something like: log_format logfmt '$remote_country - [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_generic_user_agent" "$gzip_ratio"'; That wou…

$remote_country is interesting idea, you classify visitor into per-country "buckets". Although the buckets would not be of equal size. If you have a single regular visitor from a tiny country, $remote_country could uniquely identify them.

A similar idea would be to have built-in $remote_addr_hash8, $remote_addr_hash16 variables which hash IPv4 and IPv6 addresses down to 8-bit or 16-bit numbers.

There are hacky ways you can do some forms of anonymization already:

https://www.supertechcrew.com/anonymizing-logs-nginx-apache/

Re: Plausible Analytics Isn't GDPR Compliant

#43

Post by franky47 »

mrweasel wrote: post #12
franky47 wrote: post #4

Earlier quoted context omitted.

> If you track a user, you have to get his consent before doing it This would mean any server-side analytics (looking at access logs, which include IP address and user-agent) cannot be used for analytics or tracking, since there is no way for a user to give/deny consent to a page that already has logged information on them.

I would like to see more software having the option of just logging the users country and not the IP, and perhaps just as generic a user agent as possible (Just, is this Chrome, FireFox, Edge, whatever, but nothing else.) for example for Nginx something like: log_format logfmt '$remote_country - [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_generic_user_agent" "$gzip_ratio"'; That wou…

FWIW, CloudFlare can inject a cf_ipcountry header that does that. User-agent parsing is unfortunately more complex, with lots of false readings (not counting bots & crawlers).

Re: Plausible Analytics Isn't GDPR Compliant

#44

Post by markosaric »

_the_special_ wrote: post #19
Nextgrid wrote: post #15

Earlier quoted context omitted.

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.

We generate a daily changing identifier using the visitor’s IP address and User Agent. To anonymize these datapoints, we run them through a hash function with a rotating salt.

hash(daily_salt + website_domain + ip_address + user_agent)

This generates a random string of letters and numbers that is used to calculate unique visitor numbers for the day. Old salts are deleted to avoid the possibility of linking visitor information from one day to the next.

Full details are here: https://plausible.io/data-policy

Re: Plausible Analytics Isn't GDPR Compliant

#45

Post by that_guy_iain »

corentin88 wrote: post #25
donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

GDPR states “For data to be truly anonymised, the anonymisation must be irreversible”. So dropping 3 digits is clearly not enough to anonymize PII, it’s more pseudonymization.

I am curious, how are you going to unanonymise an IP to something that could have 255 combinations (and that's just if you drop that last part on an IPv4). Nevermind that an IP alone is not PII. How can you reverse something that has many possibilties?

Re: Plausible Analytics Isn't GDPR Compliant

#47

Post by dwheeler »

mpitt wrote: post #10
bmcn2020 wrote: post #3

Earlier quoted context omitted.

If you're tracking a user in the EU, you need consent. The GDPR doesn't cover the 'how' -- just that it needs to be done. So, if there's tracking of any kind, you'll need consent. Applies off site as well -- pretty much every cold email tracking software, like Yesware, is in violation of GDPR, since you didn't get the recipient's consent to track their opens and clicks.

Consent is one of the legal bases for processing personally identifiable information[1]. There are five more, among which "legitimate interest" can cover a variety of cases. [1] https://ico.org.uk/for-organisations/guide-to-data-protectio...

One interesting thing about consent under the gdpr is that users can later withdraw consent, and if that is your only legitimate reason, then you have to get rid of all the related data. It's best if you can show that there are multiple legal bases.

Re: Plausible Analytics Isn't GDPR Compliant

#48

Post by markosaric »

jonahbenton wrote: post #35
_the_special_ wrote: post #19

Earlier quoted context omitted.

I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.

It depends on whether they retain or can reproduce the salt for a given date. The rule in effect is- a person knows the IP their ISP granted them on the dates they were granted. They ask- do you have any records of me from these IPs on these dates. Assuming Plausible keeps the record of salt by date, the answer is yes, we have records of you, because they can retrieve the salt, recreate the ID, and locate the records…

Old salts are deleted to avoid the possibility of linking visitor information from one day to the next. So yes, there's no way for us to know whether the same person returns to a website on another day. See https://plausible.io/data-policy

Re: Plausible Analytics Isn't GDPR Compliant

#49

Post by raverbashing »

markosaric wrote: post #41
raverbashing wrote: post #27

I think the article might be reading too much into it Is Plausible actually tracking users? I mean actually allowing you to get a user's history (or IPaddr history) on your website across multiple days? (or a subset of this?) If it does, then yes, it is not compliant without the user agreeing. If it doesn't, then no.

Everything is isolated. There's no way for us nor for our customers to get visitor history across days, across websites or across devices. See https://plausible.io/privacy-focused-web-analytics

Thanks for clarifying

Re: Plausible Analytics Isn't GDPR Compliant

#50

Post by ukutaht »

donohoe wrote: post #17

Plausible Analytics is GDPR compliant - with one possible exception - the IP address which if they dropped the last 3 digits would probably be enough. The blog post conflates general data points with PII. The IP address is considered PII. While other info can be used for fingerprinting, it’s ok to use in some capacity as long as you don’t. For background, I’ve done GDPR implantation a in the past, an a privacy advoca…

Thanks for clearing this up. The general data points and metrics we store are not personal data.

IP address is the only piece of data that we touch that is considered PII under some regulations including GDPR.

The IP address is fully anonymized by hashing it together with a daily changing salt. Old salts are deleted to as to prevent re-identification: https://github.com/plausible/analytics/blob/master/lib/plaus...

According to GDPR Recital 26, anonymized data does not fall within the GDPR at all because data is no longer considered “personal data” following anonymization:

> The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Post reply on HN