Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“GDPR compliant” analytics is probably violating GDPR

pilcrow.vercel.app

Post reply on HN
Print view View original

61–70 of 86 posts

Re: “GDPR compliant” analytics is probably violating GDPR

#61

Post by patrakov »

cuu508 wrote: post #51
Hitton wrote: post #18

Earlier quoted context omitted.

You can do basically this without cookies with daily random salt (which is not stored longterm) added to the ip + useragent hash mentioned in the article.

It's not quite the same though. In the cookie case, you can detect a returning visitor by the presence of the cookie, you do not need to assign an unique identifier. In the hashing case, the hash of the IP and UA counts as PII, at least for the 24 hours while you still have the salt.

You can completely, at all, avoid storing PII for the purpose of estimating the number of unique visitors. The answer is to use HyperLogLog (see e.g. https://en.wikipedia.org/wiki/HyperLogLog or http://antirez.com/news/75) on a strong fingerprint of the user's device. In this case, only some small amount of aggregate data across all seen fingerprints is stored.

NB: this is completely irrelevant except as a mathematical curiosity, because GDPR prohibits any processing of PII (in this case - the fingerprint), not just storing it anywhere, without a legal basis.

Re: “GDPR compliant” analytics is probably violating GDPR

#62

Post by chrismorgan »

pier25 wrote: post #59
donohoe wrote: post #36

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…

The fact that lawyers are needed and even some lawyers get GDPR wrong is a testament at the failure of GDPR. I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.

GDPR as a whole is very accessible legislation.

The entire document (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) isn’t short: 54,000 words. But it’s very skimmable so that you can obviously skip quickly over the considerable majority as irrelevant to your situation, and generally pretty easy to read. The parts relevant to the typical developer or business person are actually only a few thousand words of chapters 1–4. I recommend just reading it if it might be relevant to your business, rather than relying on others’ writings about it.

Most of the lawyerly arguments come from people trying to justify bad stuff that they used to get away with but which is clearly contrary to the spirit and generally text of GDPR. (This is my uncharitable description.)

Re: “GDPR compliant” analytics is probably violating GDPR

#63

Post by seydor »

dalben wrote: post #12

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always…

The most interesting fact is that there's now a postgrad degree in gdpr

Re: “GDPR compliant” analytics is probably violating GDPR

#64

Post by cuu508 »

patrakov wrote: post #61
cuu508 wrote: post #51

Earlier quoted context omitted.

It's not quite the same though. In the cookie case, you can detect a returning visitor by the presence of the cookie, you do not need to assign an unique identifier. In the hashing case, the hash of the IP and UA counts as PII, at least for the 24 hours while you still have the salt.

You can completely, at all, avoid storing PII for the purpose of estimating the number of unique visitors. The answer is to use HyperLogLog (see e.g. https://en.wikipedia.org/wiki/HyperLogLog or http://antirez.com/news/75 ) on a strong fingerprint of the user's device. In this case, only some small amount of aggregate data across all seen fingerprints is stored. NB: this is completely irrelevant except as a mathemati…

> NB: this is completely irrelevant except as a mathematical curiosity, because GDPR prohibits any processing of PII (in this case - the fingerprint), not just storing it anywhere, without a legal basis.

Hmm, but using PII in anonymized form is allowed, right? But how do you anonymize PII without processing it?

Re: “GDPR compliant” analytics is probably violating GDPR

#65

Post by chrismorgan »

charcircuit wrote: post #60
chrismorgan wrote: post #43

Earlier quoted context omitted.

> illegal to link to third party sites It’s not. > now every site needs to get your consent No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.

>It's not It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed. The referenced lawsuit used a tag, but an tag can result it a browser sending a request too. >No it doesn’t It does if they want to follow the law. >and you will find that you would almost always prefer that they not do it I don't mind companies having analytics using…

Ah, I take it you’re referring to the Google Fonts case, then? That’s completely different from linking to a third-party site: that’s loading resources from a third-party site. For a hyperlink, any fetching is user-initiated and you’re obviously not on the hook for that. (The one arguable exception is if you explicitly cause prefetch or prerender on, say, link hover. That would then obviously be on you, because you made it happen.)

> It does if they want to flow the law.

No, they can just not do it. Simplifying very slightly: they’re trying to get your consent precisely because they don’t have to do it, therefore they’re not allowed to without consent. I would also note that the sort of consent they solicit on public websites is practically always for storing stuff on your machine (ePD, from 2002) rather than for processing (GDPR, from 2016). But I lack energy to get further involved in this aspect; suffice it to say that their tracking is basically never in your interests at all, and routinely not even in their direct interests.

Re: “GDPR compliant” analytics is probably violating GDPR

#66

Post by charcircuit »

chrismorgan wrote: post #65
charcircuit wrote: post #60

Earlier quoted context omitted.

>It's not It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed. The referenced lawsuit used a tag, but an tag can result it a browser sending a request too. >No it doesn’t It does if they want to follow the law. >and you will find that you would almost always prefer that they not do it I don't mind companies having analytics using…

Ah, I take it you’re referring to the Google Fonts case, then? That’s completely different from linking to a third-party site: that’s loading resources from a third-party site. For a hyperlink, any fetching is user-initiated and you’re obviously not on the hook for that. (The one arguable exception is if you explicitly cause prefetch or prerender on, say, link hover. That would then obviously be on you, because you m…

>that’s loading resources from a third-party site

Which is what browsers can do for link tags. Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. You as the website author can't prevent this functionality.

>No, they can just not do it

But they want to do it and may have business reasons to do it.

>their tracking is basically never in your interests at all

The tracking likely either improves the service based off analytics which is in my interest or it makes ads more relevant which makes the site more financially viable which is also in my interest if I am gaining value from that site.

Re: “GDPR compliant” analytics is probably violating GDPR

#67

Post by chrismorgan »

charcircuit wrote: post #66
chrismorgan wrote: post #65

Earlier quoted context omitted.

Ah, I take it you’re referring to the Google Fonts case, then? That’s completely different from linking to a third-party site: that’s loading resources from a third-party site. For a hyperlink, any fetching is user-initiated and you’re obviously not on the hook for that. (The one arguable exception is if you explicitly cause prefetch or prerender on, say, link hover. That would then obviously be on you, because you m…

>that’s loading resources from a third-party site Which is what browsers can do for link tags. Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. You as the website author can't prevent this functionality. >No, they can just not do it But they want to do it and may have business reasons to do it. >their tracking is basically never in your interest…

> Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly.

Anything like that is user (the browser acting as their agent). You’re obviously not responsible for that. You didn’t ask it to do that automatically, unlike and and the likes.

Re: “GDPR compliant” analytics is probably violating GDPR

#68

Post by shadowgovt »

rrdharan wrote: post #13
shadowgovt wrote: post #7

Earlier quoted context omitted.

Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

> If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad…

Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting.

It's how you get war-on-drugs-level legal atrocities.

Re: “GDPR compliant” analytics is probably violating GDPR

#70

Post by pier25 »

chrismorgan wrote: post #62
pier25 wrote: post #59

Earlier quoted context omitted.

The fact that lawyers are needed and even some lawyers get GDPR wrong is a testament at the failure of GDPR. I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.

GDPR as a whole is very accessible legislation. The entire document ( https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... ) isn’t short: 54,000 words. But it’s very skimmable so that you can obviously skip quickly over the considerable majority as irrelevant to your situation, and generally pretty easy to read. The parts relevant to the typical developer or business person are actually only a few thousand…

> Most of the lawyerly arguments come from people trying to justify bad stuff

I'm not trying to justify bad stuff.

Even experts in the matter debate about it.

I've been reading about GDPR for weeks and am still not certain I have everything covered to launch my SaaS.

Post reply on HN