Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“GDPR compliant” analytics is probably violating GDPR

pilcrow.vercel.app

Post reply on HN
Print view View original

51–60 of 86 posts

Re: “GDPR compliant” analytics is probably violating GDPR

#51

Post by cuu508 »

Hitton wrote: post #18
fogzen wrote: post #6

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

You can do basically this without cookies with daily random salt (which is not stored longterm) added to the ip + useragent hash mentioned in the article.

It's not quite the same though.

In the cookie case, you can detect a returning visitor by the presence of the cookie, you do not need to assign an unique identifier.

In the hashing case, the hash of the IP and UA counts as PII, at least for the 24 hours while you still have the salt.

Re: “GDPR compliant” analytics is probably violating GDPR

#52

Post by derefr »

dustyharddrive wrote: post #49
derefr wrote: post #46

Earlier quoted context omitted.

> Having to get consent has made the web annoying to use because now every site needs to get your consent. I don't understand why it wasn't immediately obvious to browser vendors that this was going to be how web developers responded to GDPR; and that the browser vendors could/should get ahead of this degradation of the quality of the web-browsing experience by giving the user a way to do GDPR consent at the browser-…

I don’t think we should give fingerprinting scripts another bit of entropy.

Browser vendors seem to think it's perfectly fine to add a bunch of new "low-entropy" Client-Hint request headers. Where the difference between high- vs low-entropy seems to be literal: if the header is just one bit, then the browser vendors don't consider it to be a problem for deanonymization purposes.

Re: “GDPR compliant” analytics is probably violating GDPR

#53

Post by legitster »

pilcrowonpaper wrote: post #37
legitster wrote: post #28

I think there are a few incorrect logical leaps in here. An identification number is only regulated insofar as it can be used to "identify a natural person". The law is referring to something like driver's license # or customer ID number or username or etc (or, increasingly, an IP address). Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specificall…

Author here - I've gotten this question a few times now so I'll update the article to better explain it, but "online identifiers" are considered personal data according to Article 4. Recital 30 states: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers (...)" From this, I…

Sure, but you are not quoting the whole recital:

> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

Just from the phrasing of this recital, it's pretty clear that "unique identifiers and other information received by the server" are not regulated here.

Furthermore:

Article 4.5:

> ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Again, without the use of additional information is key. Just because it can be de-anonymized doesn't mean that it is.

Recital 29:

> In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. 2The controller processing the personal data should indicate the authorised persons within the same controller.

I have spent a LOT of time with on our GDPR team. And while GDPR is horrendously complex, I don't think anyone on our legal team would support the assertion that GDPR is countermanding itself.

Also, notice the phrasing "whilst allowing general analysis" - completely separate from Legitimate Interest, GDPR allows for "general analysis" of pseudoanonymous data.

Re: “GDPR compliant” analytics is probably violating GDPR

#54

Post by spacebanana7 »

gizmo wrote: post #16
spacebanana7 wrote: post #10

Earlier quoted context omitted.

Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.

And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.

With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.

Re: “GDPR compliant” analytics is probably violating GDPR

#55

Post by gizmo »

chrismorgan wrote: post #25
gizmo wrote: post #15

Earlier quoted context omitted.

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights…

Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands a…

I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.

Re: “GDPR compliant” analytics is probably violating GDPR

#56

Post by chrismorgan »

marvinblum wrote: post #50
Janisbtw wrote: post #45

Earlier quoted context omitted.

I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu…

Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it wo…

Consent is only one of the legal bases for personal data processing. An ISP or other network intermediary will use “contractual obligation”.

Re: “GDPR compliant” analytics is probably violating GDPR

#57

Post by orangecat »

chrismorgan wrote: post #25
gizmo wrote: post #15

Earlier quoted context omitted.

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights…

Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands a…

If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.

Re: “GDPR compliant” analytics is probably violating GDPR

#58

Post by Janisbtw »

marvinblum wrote: post #50
Janisbtw wrote: post #45

Earlier quoted context omitted.

I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu…

Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it wo…

I'm not a lawyer, so this isn't legal advice.

"Handling personal data Personal data may not be processed, including its storage and transmission, without a legal basis (Article 6). These legal bases are not applicable to cookies.

Consent: The user has given clear consent for a specific purpose with an affirmative action. Contractual obligation: ‘Contract’ in this case may include terms of service. Legal obligation Vital interests: Saving one’s life. Public task Legitimate interests"

This was in the article, having security logs probably counts as a legitimate interest. Also ISPs giving away your information without your consent and reason is violating the GDPR.

Reminder: I'm not a lawyer, so this isn't legal advice.

Re: “GDPR compliant” analytics is probably violating GDPR

#59

Post by pier25 »

donohoe wrote: post #36

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…

The fact that lawyers are needed and even some lawyers get GDPR wrong is a testament at the failure of GDPR.

I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.

Re: “GDPR compliant” analytics is probably violating GDPR

#60

Post by charcircuit »

chrismorgan wrote: post #43
charcircuit wrote: post #41

The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your co…

> illegal to link to third party sites It’s not. > now every site needs to get your consent No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.

>It's not

It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed.

The referenced lawsuit used a tag, but an tag can result it a browser sending a request too.

>No it doesn’t

It does if they want to follow the law.

>and you will find that you would almost always prefer that they not do it

I don't mind companies having analytics using data they have collected from me.

Post reply on HN