3 ms·

Even an email isn't required. It's optional to allow resetting password. They have no real name policy and carry no advertising or even GA. The little JS they

Even an email isn't required. It's optional to allow resetting password. They have no real name policy and carry no advertising or even GA. The little JS they have is harmless. Looks like they have no personal data unless I elect to type it all out in a message. Looks like HN is compliant as is.

ryanwaggoner 8y ago
What about IP address? What about having a DPO or EU rep? (not clear to me whether they need either, and judging by the huge volume of comments on this topic on HN, not clear to a lot of people on both sides of this issue) I'm surprised they don't have any client side analytics, but if they did, would your position change? Would you stop using it immediately? What if they're using server side analytics? Also, is not requiring an email good enough? People once people provide an email, don't they need to advise at that point exactly how it will be used and get the user to agree? Unless it's fully under legitimate interest, I guess?
- oldcynic 8y ago
  IP address by itself is not enough to be considered personal data. Only if they gathered other info would it become so. My ISP can tie IP to my account and other info, so for them it is personal data. If they're not processing personal data they don't need DPO or rep. I'm not against analytics for helping to make a site better or understand how people are using it, eg piwik or processing access logs (ok that's a bit old school now). GA I block along with other analytics services that work across numerous sites. That's nothing against HN or an individual site that's not wanting an aggregate profile growing with the analytics provider. Optional email? Choosing to provide it might be enough opt in. Not sure. There's certainly no restriction of service without or pressure to provide.
  - ryanwaggoner 8y ago
    IP address by itself is not enough to be considered personal data. Only if they gathered other info would it become so. There seems to be disagreement about this. You might be right, but I've seen passionate arguments on both sides, with links to various opinions, etc. And on analytics, I think it's reasonable that you're OK with it, but that doesn't make it compliant. And you blocking GA doesn't make it compliant either.

ryanwaggoner 8y ago

What about IP address? What about having a DPO or EU rep? (not clear to me whether they need either, and judging by the huge volume of comments on this topic on HN, not clear to a lot of people on both sides of this issue) I'm surprised they don't have any client side analytics, but if they did, would your position change? Would you stop using it immediately? What if they're using server side analytics? Also, is not requiring an email good enough? People once people provide an email, don't they need to advise at that point exactly how it will be used and get the user to agree? Unless it's fully under legitimate interest, I guess?

oldcynic 8y ago
IP address by itself is not enough to be considered personal data. Only if they gathered other info would it become so. My ISP can tie IP to my account and other info, so for them it is personal data. If they're not processing personal data they don't need DPO or rep. I'm not against analytics for helping to make a site better or understand how people are using it, eg piwik or processing access logs (ok that's a bit old school now). GA I block along with other analytics services that work across numerous sites. That's nothing against HN or an individual site that's not wanting an aggregate profile growing with the analytics provider. Optional email? Choosing to provide it might be enough opt in. Not sure. There's certainly no restriction of service without or pressure to provide.
- ryanwaggoner 8y ago
  IP address by itself is not enough to be considered personal data. Only if they gathered other info would it become so. There seems to be disagreement about this. You might be right, but I've seen passionate arguments on both sides, with links to various opinions, etc. And on analytics, I think it's reasonable that you're OK with it, but that doesn't make it compliant. And you blocking GA doesn't make it compliant either.