6 ms·

And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done i

• simion314 8y ago
  What site you run and why you need to log my personal data(IP,browser,other identifying data) do you have good reasons to keep it forever or you purge it after you analyze it?
  • anilshanbhag 8y ago
    How is IP and browser personal data ? If you think it is, you should not be on the internet.
    • simion314 8y ago
      IP and browser fingerprinting is used to identify you around the internet, why would someone need to fingerprint me if it has good intentions. If you wnat some stats on who visits you like countries, what browsers and OSs they use , you can count them and discard the data after you would not need to keep it.
    • ealexhudson 8y ago
      Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time. Personal data consists of things that identify individuals, but also things that can be used in conjunction with other information to identify individuals. You might not like that, but the regulators are pretty clear on this point.
      • geocar 8y ago
        The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.
        • evfanknitram 8y ago
          That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.
          • geocar 8y ago
            Yes. That's The ICO's position: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe...
          • bostik 8y ago
            This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers. Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort. Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted: - The tuple (bank account number, country) is enough to target an individual. - The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß] Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect. Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers. ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.
            • evfanknitram 8y ago
    • smt88 8y ago
      So your face is also not personal data, in your opinion? The sensitivity of data can change based on context. My name isn't sensitive until it's attached to something like browser history or medical files.
    • deleted 8y ago
      [deleted]
    • sethhochberg 8y ago
      The article we're in the comments for is about the GDPR - as defined in article 4 of the GDPR, IP addresses constitute personal data. In many cases, a specific IP address, even a dynamic one, can be used to uniquely identify a natural person. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected. Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.
    • bjelkeman-again 8y ago
      I actually think you need to do some homework if you honestly think so.
    • closeparen 8y ago
      Anything and everything that’s about a person in any way is personal data.
    • IncRnd 8y ago
      IP and browser information are definitely PII, which is Personally Identifiable Information. Those are PII, because they can be used to personally identify an individual.
      • switch007 8y ago
        PII is not a GDPR term, by the way.
        • IncRnd 8y ago
          Correct. There is a similar concept, but it is not the same as PII in the US. Recital 26: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. Since the concepts mentioned in the comment, IP and browser information, are already being used to single people out for tracking, those particular types of information can definitely be viewed as the equivalent concept under GDPR, as defined in Recital 26.
    • oldcynic 8y ago
      IP address alone on an anonymous web access log need not be. Start combining it with persistent cookies or a logged in user etc and it clearly becomes personal data as it is then enough to identify someone. The clause in the regulation is quite clearly worded: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."
  • njx 8y ago
    How can a SAAS defend chargeback claims without IP address? Stripe stores IP address and the proof that the user paid for the subscription using the same IP and created an account ties them together.
    • PeterisP 8y ago
      Have a timeout, that may be a valid reason to store it for the chargeback limitation (120 days IIRC) but definitely not a valid reason to store it forever, as the parent post was talking about.
• nikanj 8y ago
  Why do you need analytics, aside from ads and ad-tech?
  • eganist 8y ago
    ...to understand whether I'm reaching my target demographics e.g. for the sake of the success of my non-ad-related business?
    • dawnerd 8y ago
      And to see what devices you should support? If all your traffic mobile? Maybe the mobile version gets more love. Lots of old ie users? Guess you gotta use old school css. Now that I think about t I’ve never used analytics for anything ad related.
      • lovich 8y ago
        If someone hits you from an iPhone 6 in turkey you can just incrementally your count of those two values without needing to store that IP 13.157.207.156 is in turkey and has an iPhone 6 and youve correlated that data through Facebook's ad network so that now they having a profile built around them despite not even having a Facebook account. Everyone's been sucking up all the data they can just in case they need it, and actual people are being harmed by it through data breaches. I get why people are upset about these changes happening to their businesses, but what did everyone expect when the industry has failed to self regulate against their worst excesses? The rest of society isn't just going to let you hurt them so you can make more money
    • simion314 8y ago
      How can you tell what demographic am I in just from my IP and browser fingerprinting? Do you have more sites or correlate the data with third parties? I think is fine if you just count the browser,OS, and country the user is from but I don't think is OK to keep more details then that
  • jasonlotito 8y ago
    Security, such as analyzing how quickly a form is filled out, or whether the person is coming from a location that is known to be home to a lot of fraud, and other such checks, for example. Using that data as well to improve learning so we do a better job of detecting fraud and not flagging legitimate customers appropriately. Also, using analytics to determine if a user is having issues on the site. For example, are users having a difficult time filling out forms, or becoming confused, and being able to provide help in an appropriate manner. These are just two things I immediately thought of. Security, and customer support. I'm sure there are many other users of analytics aside from ads and ad-tech.
• ocdtrekkie 8y ago
  You shouldn't need to keep any personal information on your visitors to get meaningful data.
  • lajhsdfkl 8y ago
    How can AB testing work without storing personally identifiable information?
    • user5994461 8y ago
      AB testing doesn't require personally identifiable information.
      • lajhsdfkl 8y ago
        How do you bucket users into a control and enabled group without having some way of identifying them? (usually ip address)
        • ocdtrekkie 8y ago
          Why are you bucketing users? If you have some sort of current session for their presence on the site, flip a coin and assign them your A or B. Store nonpersonalized info about their experience on the site associated with the given A or B.
        • Sylos 8y ago
          You could for example bucket them based on the last digit of their IP address. So, everyone whose IP address ends in 0, 1, 2, 3 or 4 gets the new version, everyone else gets the old version. You don't need to store the IP address for that, you just need a rule that decides which version to serve as the user requests it.
    • bostik 8y ago
      Generate stand-alone, opaque identifiers for whatever sessions you want to analyse. Make sure these tags are ephemeral and decoupled from anything else. Then, store only the flow data, discard everything else. Or if you need to keep some data around for the test duration, delete all of it once your A/B test has concluded.
• mulmen 8y ago
  I don't see how self-hosting has anything to do with it honestly. This is about tracking people without their consent. It's about preserving rights of individuals. Self hosting is no more or less acceptable than third party hosting. It's not a technical issue.
  • jimktrains2 8y ago
    Are you also against access logs?
    • toomuchtodo 8y ago
      Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.
      • jimktrains2 8y ago
        IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.) Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.
        • toomuchtodo 8y ago
          > Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything. Cookies and other artifacts in the request headers or query parameters that can identify a unique user.
          • jimktrains2 8y ago
            Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.
            • toomuchtodo 8y ago
• abraae 8y ago
  Sounds like you'll have some urgent reading to do when/if you receive your first GDPR access request.
• scollins 8y ago
  Serious question: What are the odds of someone offical even noticing that you are in violation of GDPR? It's not like they'll enforce GDPR and collect $7.89 in fines from small businesses.
  • themodelplumber 8y ago
    Why would you care about someone official? I'd care more about a bot that is set up to save the officials some work.
  • alkonaut 8y ago
    A good question. But that’s not how these things work. The law has to be self enforced or it’s useless - since as you say, how will small to medium businesses ever be caught violating? Megacorps comply because of mega fines. Small business comply because their owners or future buyers are a larger Corp who fears that their sub-subsidiary might be in violation, causing a future mega fine. So small businesses who care about the value of their company follow these rules. It’s almost exactly the same reason small business buy software licenses. It’s not of fear of fines but because otherwise they don’t look like a serious company. I question I have been wondering is how many companies will leave some violations such as data in backups - simply because removing it is too expensive so it’s a risk worth taking. I honestly haven’t understood how backup of data fits into the requirement to delete data of a certain age?
    • isostatic 8y ago
      All it takes is one disgruntled employee
    • bostik 8y ago
      GDPR has the concept of backups and their expiration windows covered. I'll pick an example from my work. Data can be deleted from the active set, at which point it takes extra effort to retrieve it. (If you can't SELECT it anymore from the warm slaves, it's gone.) But as long as you can make a point-in-time-recovery from your backups, the data is still present in the inactive set. Using the inactive set requires, by definition, extra effort. So you need to state that fact in the data protection/retention policy, AND put reasonable technical enforcement mechanisms ("controls") in place to ensure that backups are expired and fully deleted after a given retention period. The older your unexpired backups get, the less valuable they should become.
• M2Ys4U 8y ago
  Yes, that is wrong. You MUST tell your users that you are tracking them, and what the data you collect will be used for.
• belorn 8y ago
  Piwik has several blog post about this very topic, for example: https://matomo.org/blog/2017/09/gdpr-potential-consequences-matomo/ https://matomo.org/blog/2017/09/gdpr-potential-consequences-... You can disable the tracking parts in Piwik, or you can assume a legal stance under one of the 6 exceptions like "Legitimate interests" (https://matomo.org/blog/2018/04/lawful-basis-for-processing-personal-data-under-gdpr-with-matomo/ https://matomo.org/blog/2018/04/lawful-basis-for-processing-...).
  • amag 8y ago
    Thanks, that's very interesting! I wasn't aware that IP address is considered personal data under GDPR... That seems exploitable...
    • mulmen 8y ago
      In what way are you thinking IP address as PII is exploitable? My first thought is that you could impersonate a person by spoofing their IP address. PII identifies a person but I don't think anyone is advocating for (solely) IP-address based bank logins.