4 ms·

Well we still have HN, even if non-compliant.

jacquesm 8y ago
Why is HN non-compliant? They use Cloudflare which has gone out of their way to be compliant (to the point of offering US citizens and the rest of the world the same protections as EU citizens), and nothing else is included on the page that could track you (check it if you don't believe me). You can anonymize your profile, you can edit it and you can use one of several services to get your data out. On the whole it is pretty good.
- dmitriid 8y ago
  > Why is HN non-compliant? > They use Cloudflare Just the fact that you use some GDPR-compliant service doesn't mean that your product is GDPR-compliant. Because your product has to make sure that it stores, processes, removes, rotates etc. personally-identifiable data in a GDPR-compliant way. E.g. HN doesn't offer a way to request the data they have on me, or to delete my account. This is not GDPR-compliant.
  - adrianmsmith 8y ago
    It only "doesn't offer a way" if you write an email to HN and they refuse to do it, or don't answer. I haven't requested that myself, so I don't know what answer you'd get. But I think, unless there's evidence that someone's got such an answer from them, it would be wrong to assume they won't/can't do it. Deleting data etc. doesn't have to be automated i.e. with a button to do it. Writing to them and them doing it is sufficient.
    - jacquesm 8y ago
      Spot on. That's exactly how it is. It would be nice if the GDPR mandated automated procedures for all of the above that are no more complex than it is to sign up and post in the first place. But that's not quite how it works. There are such requirements in some of our laws with respect to signing up and cancelling paid services.
- nostalgeek 8y ago
  AFAIK you can't delete all your messages on HN, nor even delete your profile. They also do fingerprinting, or else how can they detect people with multiple accounts?
  - jacquesm 8y ago
    > AFAIK you can't delete all your messages on HN Not in an automated way. Have you asked the moderators to remove all your messages? > nor even delete your profile. You can anonymize it. > They also do fingerprinting, or else how can they detect people with multiple accounts? Who says they do? Or is that written from personal experience? Note that 'for the purpose of running the service' is a lawful basis for processing.
- rdlecler1 8y ago
  Do they have an EU representative? Then non compliant.
- zerostar07 8y ago
  they have a public api/funnel to random services, can't edit data / can't download / delete my archive. their privacy policy is not updated, no cookie notice. i was fairly sure they used google analytics but it seems they removed them Some people say that their use of <table>s and inline styles is a punishable offence, i beg to differ.

Why is HN non-compliant? They use Cloudflare which has gone out of their way to be compliant (to the point of offering US citizens and the rest of the world the same protections as EU citizens), and nothing else is included on the page that could track you (check it if you don't believe me). You can anonymize your profile, you can edit it and you can use one of several services to get your data out. On the whole it is pretty good.

dmitriid 8y ago
> Why is HN non-compliant? > They use Cloudflare Just the fact that you use some GDPR-compliant service doesn't mean that your product is GDPR-compliant. Because your product has to make sure that it stores, processes, removes, rotates etc. personally-identifiable data in a GDPR-compliant way. E.g. HN doesn't offer a way to request the data they have on me, or to delete my account. This is not GDPR-compliant.
- adrianmsmith 8y ago
  It only "doesn't offer a way" if you write an email to HN and they refuse to do it, or don't answer. I haven't requested that myself, so I don't know what answer you'd get. But I think, unless there's evidence that someone's got such an answer from them, it would be wrong to assume they won't/can't do it. Deleting data etc. doesn't have to be automated i.e. with a button to do it. Writing to them and them doing it is sufficient.
  - jacquesm 8y ago
    Spot on. That's exactly how it is. It would be nice if the GDPR mandated automated procedures for all of the above that are no more complex than it is to sign up and post in the first place. But that's not quite how it works. There are such requirements in some of our laws with respect to signing up and cancelling paid services.
nostalgeek 8y ago
AFAIK you can't delete all your messages on HN, nor even delete your profile. They also do fingerprinting, or else how can they detect people with multiple accounts?
- jacquesm 8y ago
  > AFAIK you can't delete all your messages on HN Not in an automated way. Have you asked the moderators to remove all your messages? > nor even delete your profile. You can anonymize it. > They also do fingerprinting, or else how can they detect people with multiple accounts? Who says they do? Or is that written from personal experience? Note that 'for the purpose of running the service' is a lawful basis for processing.
rdlecler1 8y ago
Do they have an EU representative? Then non compliant.
zerostar07 8y ago
they have a public api/funnel to random services, can't edit data / can't download / delete my archive. their privacy policy is not updated, no cookie notice. i was fairly sure they used google analytics but it seems they removed them Some people say that their use of <table>s and inline styles is a punishable offence, i beg to differ.