41–49 of 49 posts
Earlier quoted context omitted.
And you are now in violation of GDPR
Isn't the site owner in charge of GDPR for the site? Aren't they already non-compliant by hotlinking a resource from someone where there's no agreement about personal data? Wouldn't it still be the site owner's responsibility not to let a 3rd party send even more personal data over?
Earlier quoted context omitted.
The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.
IP addresses in your http server log are a violation? Well then you may as well fine every hardware owner and ISP middleman between me and the user!
Earlier quoted context omitted.
I'm not an expert on GDPR at all so forgive me if these are dumb questions but how? I thought GDPR pertained to a user's personal info? Sending back info about the webpage the script is used on isn't the same. Also who would be in violation, the leachers or the OP? Does GDPR even apply if OP is just a random person on the internet and not a company operating in the EU?
The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.
The article proposes one solution as being to essentially serve up different content to whoever is hotlinking the script, but then says "Obviously, I don't wanna do this." It seems like the clearest solution to me, so I don't know why it's a bad option. The replacement solution worked for 3D Realms many years ago after a bunch of journalists, fansites, and forums would link to their game screenshots. When someone did…
Except they'd claim you maliciously did it and caused economic damages by breaking their system and then bring the lawyers in. Pretty much the same narrative as what that Liberty Liberty Liberty guy did when he upped the semver noting a breaking change and pushed it.
Earlier quoted context omitted.
I'm not an expert on GDPR at all so forgive me if these are dumb questions but how? I thought GDPR pertained to a user's personal info? Sending back info about the webpage the script is used on isn't the same. Also who would be in violation, the leachers or the OP? Does GDPR even apply if OP is just a random person on the internet and not a company operating in the EU?
The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.
For instance, I've seen plenty of claims that storing IPs in logs is fine for "security purposes", though I don't know of any court cases specifically affirming that.
[1] https://gdpr.eu/article-6-how-to-process-personal-data-legal...
The author is too kind. I don't know why you should bend over backwards for anti-social folks, it just allows them to perpetuate their bad behavior.
You have no obligation for other sites' users. The maintainers of those sites have that obligation, and if their site breaks due to hotlinking, it is 100% their problem. You aren't hurting their users; they are hurting their users.
You would be doing them and their users a service by teaching them a lesson. It's not just "anti-social", it's plain dangerous to integrate untrusted/uncontrolled code into your site.
The article proposes one solution as being to essentially serve up different content to whoever is hotlinking the script, but then says "Obviously, I don't wanna do this." It seems like the clearest solution to me, so I don't know why it's a bad option. The replacement solution worked for 3D Realms many years ago after a bunch of journalists, fansites, and forums would link to their game screenshots. When someone did…
Except they'd claim you maliciously did it and caused economic damages by breaking their system and then bring the lawyers in. Pretty much the same narrative as what that Liberty Liberty Liberty guy did when he upped the semver noting a breaking change and pushed it.