Google Tag Manager, the new anti-adblock weapon (2020)

After I read your comment, I disabled UO and installed AN again. Maybe some update fixed the issues. But it didn't. I'm now back using UO again.

Yes, but I never claimed that they were. The text that I linked is a copy of the official GDPR text (and recitals), not an article they wrote on the topic. I used their website, because I find it more usable as they added cross-references links and recital links. But if you prefer, read the official EU version[0], which is the same in content and in words.

>There is no official guidance saying that IP address in logs falls under "legitimate interest"

I haven't said that. I said storing IPs in logs might be legal, if there is a legitimate interest and/or there is consent.

There are actually two official recitals straight up addressing that topic. Recital 47 states (in part): "[...] The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." (This is not meant to be an exhaustive list)

Recital 49 states (in full): "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems."

These recitals were specifically added to address some points that had already been litigated in the past in various European courts.

>and every lawyer I asked advised against it "just to be on the safe side".

Good for your lawyers (that you keep mentioning all across threads). I don't know your lawyers, but they seem overly cautious - even for lawyers - and maybe a little bit under-educated on the subject matter. But they still have a point. You cannot just store access logs containing IP addresses, you have to have a legitimate interest, and be able to articulate this legitimate interest, and see if law makers and courts would consider your "interest" to be "legitimate". Which is easy when it comes to fraud detection and network security/abuse (thanks to the recitals), less easy when it comes to other areas, and pretty easy when it comes to different areas that are clearly against the text or spirit of the GDPR; e.g. nobody will buy an argument of "my legitimate interest is that I want to earn money from tracking and selling user data".

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

[1] https://gdpr.eu/Recital-47-Overriding-legitimate-interest or https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

[2] https://gdpr.eu/Recital-49-Network-and-information-security-... or https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

The high end of most services and products doesn't need to market, they're "saturated" by word-of-mouth alone. For example, I met a guy once who was part of a very high-end IT consultancy. They had A-list customers, all the work they could handle, and their website was a single line of text that basically said, "You have a problem? Email us". In other words, most markets have a subset of "quiet" companies that thrive on word-of-mouth alone.

I disagree.

As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine.

Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons.

If you want to "be on the safe side", handling data correctly will help; cookie banners won't.

https://news.ycombinator.com/item?id=30402052

... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.