Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“GDPR compliant” analytics is probably violating GDPR

pilcrow.vercel.app

Post reply on HN
Print view View original

71–80 of 86 posts

Re: “GDPR compliant” analytics is probably violating GDPR

#71

Post by frereubu »

fogzen wrote: post #22
frereubu wrote: post #19

Earlier quoted context omitted.

In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.

The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone. What should matter is what’s logged. Every request contains an IP that’s how the web works.

Ah yes - I misread your suggestion. Seems feasible in that case.

Re: “GDPR compliant” analytics is probably violating GDPR

#72

Post by azmodeus »

cuu508 wrote: post #44
shkkmo wrote: post #33

Earlier quoted context omitted.

I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.

A half-baked idea I had while reading the article was to use bloom filters: User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter. Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.

I think this is a great idea

Re: “GDPR compliant” analytics is probably violating GDPR

#73

Post by charcircuit »

chrismorgan wrote: post #67
charcircuit wrote: post #66

Earlier quoted context omitted.

>that’s loading resources from a third-party site Which is what browsers can do for link tags. Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. You as the website author can't prevent this functionality. >No, they can just not do it But they want to do it and may have business reasons to do it. >their tracking is basically never in your interest…

> Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. Anything like that is user (the browser acting as their agent). You’re obviously not responsible for that. You didn’t ask it to do that automatically, unlike and and the likes.

How is the link tag any different? It's also a link which is optional to access. One's user agent could choose not to request it. script tags are optional too.

Re: “GDPR compliant” analytics is probably violating GDPR

#74

Post by ThePowerOfFuet »

cuu508 wrote: post #44
shkkmo wrote: post #33

Earlier quoted context omitted.

I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.

A half-baked idea I had while reading the article was to use bloom filters: User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter. Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.

Not a bad idea, but IP addresses are personal data too.

Re: “GDPR compliant” analytics is probably violating GDPR

#75

Post by tpxl »

nickpp wrote: post #48

As someone who prefers to focus on the product, post GDPR, here are some technologies which are just safer to not have, even on a non-ad-driven website, unless you like spending time arguing with lawyers and bureaucrats: 1. Analytics 2. Third-party resources 3. CDNs 4. DDOS protection services What else am I missing?

You can do a lot of analytics without touching personal data. Page view counts, countries people visit from (assuming it's low enough granularity (not personally identifiable) and you don't use a third party service), times people visit. All the juicy stuff, really.

You can use third-party resources if you self host them (like fonts, images, videos, ...).

Not sure about CDNs, but I don't think a global CDN that's GDPR compliant can exist.

Re: “GDPR compliant” analytics is probably violating GDPR

#76

Post by ttepasse »

chrismorgan wrote: post #8
fogzen wrote: post #6

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.

Back in 2012 the EU’s Article 29 Data Protection Working Party* published an rather readable opinion about the different cookie consent exemptions. Yes, first party analytics are not essential. The WP29 even proposed to exempt them in a hypothetical future privacy directive.

https://ec.europa.eu/justice/article-29/documentation/opinio...

The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”.

Interesting. Maybe there is a possibility in the future.

https://digital-strategy.ec.europa.eu/en/library/proposal-re...

https://edpb.europa.eu/sites/default/files/files/file1/edpb_...

Re: “GDPR compliant” analytics is probably violating GDPR

#77

Post by angoragoats »

cuu508 wrote: post #44
shkkmo wrote: post #33

Earlier quoted context omitted.

I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.

A half-baked idea I had while reading the article was to use bloom filters: User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter. Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.

This is effectively what the “GDPR compliant” providers mentioned in the article are already doing, namely, a one-way hash of the IP+UA. One of the points of the article is that this is non compliant, since you need to transmit the IP+UA to do this calculation to begin with.

Re: “GDPR compliant” analytics is probably violating GDPR

#78

Post by chrismorgan »

charcircuit wrote: post #73
chrismorgan wrote: post #67

Earlier quoted context omitted.

> Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. Anything like that is user (the browser acting as their agent). You’re obviously not responsible for that. You didn’t ask it to do that automatically, unlike and and the likes.

How is the link tag any different? It's also a link which is optional to access. One's user agent could choose not to request it. script tags are optional too.

They’re radically different.

Things like , and are subresources: instructions to the browser to fetch and use the specified resource, so that the page can be rendered properly. As you say, the user agent can choose to ignore these instructions (and text-mode browsers will generally ignore all three of these subresource types), but the page will probably be materially compromised, and the developer placed the subresource there with the expectation that it will be loaded.

A hyperlink is a reference to another page altogether, that it’s up to the user to access if they choose to. It’s not a subresource.

Re: “GDPR compliant” analytics is probably violating GDPR

#79

Post by cuu508 »

angoragoats wrote: post #77
cuu508 wrote: post #44

Earlier quoted context omitted.

A half-baked idea I had while reading the article was to use bloom filters: User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter. Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.

This is effectively what the “GDPR compliant” providers mentioned in the article are already doing, namely, a one-way hash of the IP+UA. One of the points of the article is that this is non compliant, since you need to transmit the IP+UA to do this calculation to begin with.

But do they store individual IP+UA hashes, or do they mush them together in a bloom filter or a HyperLogLog data structure?

In the first case, it could be argued they still store personally identifiable information (for a limited time, but still). In the second case I think it would be harder to argue the probabilistic data structure with lots of hashes mushed together still constitute personally identifiable information.

> One of the points of the article is that this is non compliant, since you need to transmit the IP+UA to do this calculation to begin with.

IP + UA gets transmitted to the first-party server already. They already have it. The question becomes – is it OK to anonymize this PII we already received for one purpose (serving the web page), to use it for another purpose also (counting unique visitors).

Re: “GDPR compliant” analytics is probably violating GDPR

#80

Post by graftak »

marvinblum wrote: post #40
donohoe wrote: post #36

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely…

I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be…

You get the same security benefits by truncating and/or hashing the ip address before storage.
Post reply on HN