4 ms·

As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the

As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the anonymizeIps option) as it does not associate a user with their actual identity.

Radim 9y ago
Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
- hjnilsson 9y ago
  > Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.
mirko22 9y ago
But GDPR says even if data us anonymized but can be tied to a natural person in “reasonable” manner it is still illegal. then it gives some vage examples of what might be considered reasonable... so a lawyer could still make a case that tracking data is illegal. you also have to explain to your user in clear and plain language using visualization where possible on how data collected is processed.

Radim 9y ago

Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy

hjnilsson 9y ago
> Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.

mirko22 9y ago

But GDPR says even if data us anonymized but can be tied to a natural person in “reasonable” manner it is still illegal. then it gives some vage examples of what might be considered reasonable... so a lawyer could still make a case that tracking data is illegal. you also have to explain to your user in clear and plain language using visualization where possible on how data collected is processed.