4 ms·

Ok, let's say I, as a publisher, don't set user cookie if user hasn't registred/logged in, and don't store IP in logs, and don't do browser fingerprinting. Why

Ok, let's say I, as a publisher, don't set user cookie if user hasn't registred/logged in, and don't store IP in logs, and don't do browser fingerprinting. Why can't I load some 3rd party tools? What author is claiming, essentially, that in a mere 2 month from now, you can sue almost any European publisher for data privacy breach. Outrageous claim require outrageous proof.

TimothyBJacobs 9y ago
Because almost assuredly the 3rd party tools collect that information and you are responsible for what you put on your website. The article specifically mentions this when talking about data processors and data controllers.
guitarbill 9y ago
> Why can't I load some 3rd party tools? You can, you just need assurance that they're also GDPR compliant if you want to be GDPR compliant. If the third-party violates GDPR, but requires your website to run on (e.g. third-party JS, other types of beacons), I think judges are going to have a dim view on that, and so you can't simply claim that it's them, not you. (There may be mitigations, e.g. if you have a contract with them that spells out GDPR compliance, but then they break that - but how many people have contracts for the JS they embed?) Edit: One way this argument could be laid out is that by including such third-parties in your website, you're instructing the browser to load them, and therefore effectively forwarding GDPR-related data to them. Technically, this isn't really too different from a REST API call you'd perform on the server, or an AJAX call (although the server call doesn't necessarily forward e.g. the IP).
- nopriorarrests 9y ago
  Interesting. I personally use uBlock and "cookie autodelete", which deletes cookies for all sites except the white-listed ones each 5 minutes, automatically. So if your interpretation is correct, and GDPR affects even completely anonymous users, I'll be seeing and clicking "consent box" each time I go read a newspaper or just do general browsing. Like the "we use cookies" stuff, but on steroids. EDIT: but still, I find this hard to believe, tbh. It means no ads served to anonymous users, and this has consequences I can't even imagine.
  - hexaz 9y ago
    You can display ads, just not personalized ones. Might even lead to more static image or text based ads, which have a higher chance of not being blocked by users
    - nopriorarrests 9y ago
      >You can display ads, just not personalized ones Well, it's 2018, and most publishers rely on some 3rd party ad-tech to serve the ads. They don't have direct contracts with advertisers, and definitely has no tech in house. If 3rd party calls are prohibited, their ad revenue disappears overnight. Will be interesting to see how it develops.
  - guitarbill 9y ago
    Of course you can serve ads, they just can't use any personal information or tracking unless people have consented. Ad blockers will still be a thing. As for consent, you have to be able to refuse. A consent box popping up each time would be the dumbest way to do this, but not that different than those full-screen email/newsletter begging boxes we have now.
    - nopriorarrests 9y ago
      Why dumbest? If we agreed that even incognito browsing contains the traces of PII, publisher has to get my consent, explicitly, that's the whole point of GDPR. I see no other option than to do popup window for each new visitor (where new == has no associated cookie). What are other options?
      - guitarbill 9y ago
        Don't use the PII. Is that really too much to ask?
- written 9y ago
  Also user can require the service to remove his personal information and that means that service provider has to notify services he uses to stop using and remove that PI. How will this work with Google Analytics and things like that? Will random e-shop be required to notify Google to stop using/delete PI for random persons upon request?
nrb 9y ago
Just because you aren't doing browser fingerprinting doesn't mean the third-party script you are loading into the user's browser isn't.

TimothyBJacobs 9y ago

Because almost assuredly the 3rd party tools collect that information and you are responsible for what you put on your website. The article specifically mentions this when talking about data processors and data controllers.

guitarbill 9y ago

> Why can't I load some 3rd party tools? You can, you just need assurance that they're also GDPR compliant if you want to be GDPR compliant. If the third-party violates GDPR, but requires your website to run on (e.g. third-party JS, other types of beacons), I think judges are going to have a dim view on that, and so you can't simply claim that it's them, not you. (There may be mitigations, e.g. if you have a contract with them that spells out GDPR compliance, but then they break that - but how many people have contracts for the JS they embed?) Edit: One way this argument could be laid out is that by including such third-parties in your website, you're instructing the browser to load them, and therefore effectively forwarding GDPR-related data to them. Technically, this isn't really too different from a REST API call you'd perform on the server, or an AJAX call (although the server call doesn't necessarily forward e.g. the IP).

nopriorarrests 9y ago
Interesting. I personally use uBlock and "cookie autodelete", which deletes cookies for all sites except the white-listed ones each 5 minutes, automatically. So if your interpretation is correct, and GDPR affects even completely anonymous users, I'll be seeing and clicking "consent box" each time I go read a newspaper or just do general browsing. Like the "we use cookies" stuff, but on steroids. EDIT: but still, I find this hard to believe, tbh. It means no ads served to anonymous users, and this has consequences I can't even imagine.
- hexaz 9y ago
  You can display ads, just not personalized ones. Might even lead to more static image or text based ads, which have a higher chance of not being blocked by users
  - nopriorarrests 9y ago
    >You can display ads, just not personalized ones Well, it's 2018, and most publishers rely on some 3rd party ad-tech to serve the ads. They don't have direct contracts with advertisers, and definitely has no tech in house. If 3rd party calls are prohibited, their ad revenue disappears overnight. Will be interesting to see how it develops.
- guitarbill 9y ago
  Of course you can serve ads, they just can't use any personal information or tracking unless people have consented. Ad blockers will still be a thing. As for consent, you have to be able to refuse. A consent box popping up each time would be the dumbest way to do this, but not that different than those full-screen email/newsletter begging boxes we have now.
  - nopriorarrests 9y ago
    Why dumbest? If we agreed that even incognito browsing contains the traces of PII, publisher has to get my consent, explicitly, that's the whole point of GDPR. I see no other option than to do popup window for each new visitor (where new == has no associated cookie). What are other options?
    - guitarbill 9y ago
      Don't use the PII. Is that really too much to ask?
written 9y ago
Also user can require the service to remove his personal information and that means that service provider has to notify services he uses to stop using and remove that PI. How will this work with Google Analytics and things like that? Will random e-shop be required to notify Google to stop using/delete PI for random persons upon request?

nrb 9y ago

Just because you aren't doing browser fingerprinting doesn't mean the third-party script you are loading into the user's browser isn't.