The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your consent.
“GDPR compliant” analytics is probably violating GDPR
41–50 of 86 posts
Re: “GDPR compliant” analytics is probably violating GDPR
#42Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…
Your examples are both bad.
IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security.
Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.
Re: “GDPR compliant” analytics is probably violating GDPR
#43The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your co…
> illegal to link to third party sites
It’s not.
> now every site needs to get your consent
No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.
Re: “GDPR compliant” analytics is probably violating GDPR
#44Earlier quoted context omitted.
This is one of my pet peeves of GDPR! Your nephew and IP Octet cases are very extreme edge cases that we shouldn't build policy around if there are major drawbacks to including them. It's bad there is ostensibly no compliant way to count anonymized unique users in Europe under the current framework.
I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.
A half-baked idea I had while reading the article was to use bloom filters:
User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter.
Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.
Re: “GDPR compliant” analytics is probably violating GDPR
#45Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…
I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be…
I'm not a lawyer, so this isn't legal advice.
"Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't.
I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database.
Reminder: I'm not a lawyer, so this isn't legal advice.
Re: “GDPR compliant” analytics is probably violating GDPR
#46The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your co…
> Having to get consent has made the web annoying to use because now every site needs to get your consent.
I don't understand why it wasn't immediately obvious to browser vendors that this was going to be how web developers responded to GDPR; and that the browser vendors could/should get ahead of this degradation of the quality of the web-browsing experience by giving the user a way to do GDPR consent at the browser-chrome level by e.g. ticking a box in the browser preferences that will set a request header. (It didn't work for Do Not Track, but Do Not Track is a "request" to a malicious adversary; while "I consent to cookies, so stop prompting me" isn't.)
I can only guess that browser vendors don't like GDPR, and so are avoiding implementing such a GDPR quality-of-life feature in order to ensure that users get just as annoyed by the cookie prompts as they should be, and eventually demand the law be changed.
Re: “GDPR compliant” analytics is probably violating GDPR
#47The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your co…
[deleted]
Re: “GDPR compliant” analytics is probably violating GDPR
#48As someone who prefers to focus on the product, post GDPR, here are some technologies which are just safer to not have, even on a non-ad-driven website, unless you like spending time arguing with lawyers and bureaucrats:
1. Analytics
2. Third-party resources
3. CDNs
4. DDOS protection services
What else am I missing?
Re: “GDPR compliant” analytics is probably violating GDPR
#49The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your co…
> Having to get consent has made the web annoying to use because now every site needs to get your consent. I don't understand why it wasn't immediately obvious to browser vendors that this was going to be how web developers responded to GDPR; and that the browser vendors could/should get ahead of this degradation of the quality of the web-browsing experience by giving the user a way to do GDPR consent at the browser-…
I don’t think we should give fingerprinting scripts another bit of entropy.
Re: “GDPR compliant” analytics is probably violating GDPR
#50Earlier quoted context omitted.
I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be…
I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu…
Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect?
I know the opinion of lawyers about IP addresses. But it's so far from reality that it would break the internet if strictly followed.