4 ms·
It's more complicated than that. Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any o
by cdjk 8y ago
It's more complicated than that.
Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use.
Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies.
Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links.
Don't forget that ip addresses are considered personal data.
And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.
- EGreg 8y agoWhat is a good primer and checklist on this law?
- ec109685 8y agoBe careful about interpreting the law if you aren’t a lawyer: 1) IP addressed aren’t a personal identifier since more than one person can use the same IP 2) Google analytics is a processor of data and the general consent you get from your users can grant you the ability to use google analytics since its use helps you enhance the site and make a better user experience 3) You need a data processor agreement to provide access to data that the processor has collected on your user’s behalf. Given you run your aws services, that should be straightforward to provide access.
- emidln 8y agoIf IPs aren’t personal because more than one person can have them, how is the name John Smith a piece of personal information? Anyone can have that name and a lot of people do have that name.
- ec109685 8y agoJohn Smith is personal information, but not a personal identified, so you couldn’t let the user access their data based on IP address or their John Smith name.
- kuschku 8y agoThe whole point of the law is to destroy the business model of people using Google Analytics, Google AdSense, Amazon affiliate links, etc. So that maybe someday we'll have a web without tracking again.
- twanvl 8y ago> Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links. Assuming that these cookies are only set after clicking the link, and that there is no personal information in the links, then what is the problem? In any case, Amazon setting cookies is not your problem, it is Amazon's.
- cdjk 8y agoAffiliate links could be between the user and amazon. I’m not super familiar with affiliate marketing, but you’re right it probably depends on if the cookie is set when the page loads or when the user clicks on the link.