6 ms·

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection. And requires an opt-in und

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection. And requires an opt-in under EU law, which makes this entire thing even more ridiculous.

codefined 9y ago
Then don't send the correct source IP address, with simple statistics gathering like this I hardly expect they require a response. It would mean there would be no personal data whatsoever.
- kuschku 9y ago
  How would you do that, though? The browser has to open a socket to something to do this, after all. And that already is a violation.
  - Ajedi32 9y ago
    You'd just send a UDP packet with a spoofed source address and forget about it. There's no need to open any sort of 2-way connection for data that's only being transmitted in one direction (from browser to metrics server).
  - moosingin3space 9y ago
    You could transmit the telemetry through Tor.
    - sp332 9y ago
      Tor is blocked in some places and viewed as very suspicious in others. If you're already in a place where you're trying not to draw attention to yourself, using Tor might not a good option.
- Ajedi32 9y ago
  Wouldn't spoofing IP addresses risk the data packets being filtered out by ISPs or other upstream network providers? IMO if keeping IP addresses hidden is a concern, it'd be better to use something like TOR.
- throwaway2048 9y ago
  This isnt how tcp/ip works
  - wongarsu 9y ago
    With udp/ip it would work, if none of the routers on the way to the destination filters spoofed IPs.
- pfg 9y ago
  Most ISPs filter spoofed IP addresses nowadays[1]. Even if your ISP doesn't prevent it, NAT might. You wouldn't get a whole lot of responses this way, and there'd be a strong bias because of regional differences w.r.t. filtering. [1]: https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php
yuhong 9y ago
Does an IP address actually require an opt-in? And if it does, does it only apply if it is being stored?
- claudius 9y ago
  Yes[1], no[2]. An IP address is "personal relationships" data and collecting, processing or using such data is prohibited unless allowed by law or the concerned person gives consent. [1]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_of_personal_data https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_... [2]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overview_of_the_first_principles https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overvi...
  - yorwba 9y ago
    The way I interpret this, if you don't collect, process or use the IP address beyond it being incidentally involved in the transmission of anonymized data, it shouldn't require explicit consent. Otherwise literally everything that connects to the internet in some way would have to treated in that way, and that's not how the law is currently enforced.

codefined 9y ago

Then don't send the correct source IP address, with simple statistics gathering like this I hardly expect they require a response. It would mean there would be no personal data whatsoever.

kuschku 9y ago
How would you do that, though? The browser has to open a socket to something to do this, after all. And that already is a violation.
- Ajedi32 9y ago
  You'd just send a UDP packet with a spoofed source address and forget about it. There's no need to open any sort of 2-way connection for data that's only being transmitted in one direction (from browser to metrics server).
- moosingin3space 9y ago
  You could transmit the telemetry through Tor.
  - sp332 9y ago
    Tor is blocked in some places and viewed as very suspicious in others. If you're already in a place where you're trying not to draw attention to yourself, using Tor might not a good option.
Ajedi32 9y ago
Wouldn't spoofing IP addresses risk the data packets being filtered out by ISPs or other upstream network providers? IMO if keeping IP addresses hidden is a concern, it'd be better to use something like TOR.
throwaway2048 9y ago
This isnt how tcp/ip works
- wongarsu 9y ago
  With udp/ip it would work, if none of the routers on the way to the destination filters spoofed IPs.
pfg 9y ago
Most ISPs filter spoofed IP addresses nowadays[1]. Even if your ISP doesn't prevent it, NAT might. You wouldn't get a whole lot of responses this way, and there'd be a strong bias because of regional differences w.r.t. filtering. [1]: https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php

yuhong 9y ago

Does an IP address actually require an opt-in? And if it does, does it only apply if it is being stored?

claudius 9y ago
Yes[1], no[2]. An IP address is "personal relationships" data and collecting, processing or using such data is prohibited unless allowed by law or the concerned person gives consent. [1]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_of_personal_data https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_... [2]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overview_of_the_first_principles https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overvi...
- yorwba 9y ago
  The way I interpret this, if you don't collect, process or use the IP address beyond it being incidentally involved in the transmission of anonymized data, it shouldn't require explicit consent. Otherwise literally everything that connects to the internet in some way would have to treated in that way, and that's not how the law is currently enforced.