3 ms·
IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.
by landryraccoon 9y ago
IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.
- ec109685 9y agoAsk for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.
- landryraccoon 9y agoSo at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?
- lagadu 9y agoYes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.
- codedokode 9y agoPlease see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318 https://news.ycombinator.com/item?id=16964318
- codedokode 9y agoThe best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.
- codedokode 9y agoYou don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address. I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration. Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.