4 ms·

Some people are under the impression that ip addresses fall under "personal information". So if the user account is deleted and the associated ip logs are not d

Some people are under the impression that ip addresses fall under "personal information". So if the user account is deleted and the associated ip logs are not deleted this would be a GDPR violation. Another potential violation would be asking a users age(like asking their birthday), but not needing their age for the operation of the service. It is currently unclear how rigorously GDPR will be enforced. In the extreme case of rigorous enforcement nearly all current server/frameworks would cause violations by default and would need to be overhauled. There are a bunch of other examples in the comments that are likely violations for the site as well. It is unclear how many of these apply since it is unclear how the GDPR will be enforced.

jimktrains2 8y ago
> Another potential violation would be asking a users age(like asking their birthday), but not needing their age for the operation of the service. In theory, in the US this could be driven by COPPA, but I havn't seen a birthday asked for that reason in a long time. It also wouldn't be a reason to store it, only to ask and process ephemerally. I believe it's also common in the US for alcohol-related websites to ask age, although that could be misguided, it is common. Again, not a reason to store, but to ask.
- davorak 8y ago
  Yeah I was not clear. My intent was to talking about storing of a birthday vs storing a boolean indicating if the user was the age of majority or a boolean for weather they were 13+ for COPPA. Storing the value, rather than ephemerally processing it, is a matter of convenience so you do not have to ask your authenticated user to re-input their age/birthday/<are you an adult> all of the time. That said it seems unlikely that a regulator would come down hard on a data processor that stored a date vs storing a boolean value.

jimktrains2 8y ago

> Another potential violation would be asking a users age(like asking their birthday), but not needing their age for the operation of the service. In theory, in the US this could be driven by COPPA, but I havn't seen a birthday asked for that reason in a long time. It also wouldn't be a reason to store it, only to ask and process ephemerally. I believe it's also common in the US for alcohol-related websites to ask age, although that could be misguided, it is common. Again, not a reason to store, but to ask.

davorak 8y ago
Yeah I was not clear. My intent was to talking about storing of a birthday vs storing a boolean indicating if the user was the age of majority or a boolean for weather they were 13+ for COPPA. Storing the value, rather than ephemerally processing it, is a matter of convenience so you do not have to ask your authenticated user to re-input their age/birthday/<are you an adult> all of the time. That said it seems unlikely that a regulator would come down hard on a data processor that stored a date vs storing a boolean value.