4 ms·

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID,

doesn't the GDPR protect against storing "Personally identifiable information"? Plausible does use the IP address for the visitor to create a unique visitor ID, but it does not store it, so I am not sure how can you use that information to link it to an individual.

Nextgrid 6y ago
If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.
- gspr 6y ago
  Nitpick: if it's reversible, determinism doesn't matter.
  - Nextgrid 6y ago
    Yep indeed, deterministic isn't really the right word here. Reversibility is all that matters, although am I correct in saying that it would imply determinism?
    - gspr 6y ago
      > am I correct in saying that it would imply determinism? I don't know, because neither "reversibility" nor "determinism" are precisely defined (this is not criticism of your comment in any way). Here's one semi-reasonable interpretation of the two words for which reversibility would not imply determinism: Imagine a "process" (I, too, am being imprecise and calling this a "process" instead of a function) that takes as input an integer between 1 and 6 inclusive. Its output for the input n is a dice roll with a dice that is biased in favor of n, but is otherwise fair. Now, this is not a deterministic process, but if you are allowed to feed it the same input multiple times, you can probablistically reverse it. Anyway, sorry for the tangent – your original point was the important one.
- _the_special_ 6y ago
  I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.
  - Nextgrid 6y ago
    Is the salt key stored, or is it discarded?
    - markosaric 6y ago
      Old salts are deleted to avoid the possibility of linking visitor information from one day to the next. See https://plausible.io/data-policy https://plausible.io/data-policy
  - jefftk 6y ago
    That is deterministic, but the key thing is that it is not reversible
    - wizzwizz4 6y ago
      Technically, you could enumerate all four billion IP addresses (multiplied by all common user agents) to reverse it. This is, however, prohibitively expensive for tracking, so I think it does the job.
      - jaywalk 6y ago
        Not without the salt, which they delete every day. Pretty much impossible.
  - jonahbenton 6y ago
    It depends on whether they retain or can reproduce the salt for a given date. The rule in effect is- a person knows the IP their ISP granted them on the dates they were granted. They ask- do you have any records of me from these IPs on these dates. Assuming Plausible keeps the record of salt by date, the answer is yes, we have records of you, because they can retrieve the salt, recreate the ID, and locate the records. If they do not retain the salt, in contrast, they cannot respond to individual requests for their records and that would also imply they are not able to do day over day returning visitor calculations.
- kevincox 6y ago
  Note that anything deterministic on IPs is reversible. There are only 4 billion IPv4 addresses so brute forcing is trivial. It is more complicated for IPv6 but enough of the internet is IPv4 that you can't ignore that case.
- donohoe 6y ago
  The point to note here is "if". Happily, they (Plausible) don't.
- dbbk 6y ago
  It's not reversible, it's hashed with a daily salt.
M2Ys4U 6y ago
The GDPR regulates the use of "personal data", which is broader in scope than "personally identifiable information": "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"

Nextgrid 6y ago

If the algorithm for turning an IP address into a visitor ID is reversible then that ID is equivalent to the IP address as far as the GDPR is concerned.

gspr 6y ago
Nitpick: if it's reversible, determinism doesn't matter.
- Nextgrid 6y ago
  Yep indeed, deterministic isn't really the right word here. Reversibility is all that matters, although am I correct in saying that it would imply determinism?
  - gspr 6y ago
    > am I correct in saying that it would imply determinism? I don't know, because neither "reversibility" nor "determinism" are precisely defined (this is not criticism of your comment in any way). Here's one semi-reasonable interpretation of the two words for which reversibility would not imply determinism: Imagine a "process" (I, too, am being imprecise and calling this a "process" instead of a function) that takes as input an integer between 1 and 6 inclusive. Its output for the input n is a dice roll with a dice that is biased in favor of n, but is otherwise fair. Now, this is not a deterministic process, but if you are allowed to feed it the same input multiple times, you can probablistically reverse it. Anyway, sorry for the tangent – your original point was the important one.
_the_special_ 6y ago
I could not easily find it on the website, but I remember reading about how they do it, basically the ID is generated by hashing the IP + user-agent + a salt key that is changing on a daily basis. So, no, I do not think it is deterministic.
- Nextgrid 6y ago
  Is the salt key stored, or is it discarded?
  - markosaric 6y ago
    Old salts are deleted to avoid the possibility of linking visitor information from one day to the next. See https://plausible.io/data-policy https://plausible.io/data-policy
- jefftk 6y ago
  That is deterministic, but the key thing is that it is not reversible
  - wizzwizz4 6y ago
    Technically, you could enumerate all four billion IP addresses (multiplied by all common user agents) to reverse it. This is, however, prohibitively expensive for tracking, so I think it does the job.
    - jaywalk 6y ago
      Not without the salt, which they delete every day. Pretty much impossible.
- jonahbenton 6y ago
  It depends on whether they retain or can reproduce the salt for a given date. The rule in effect is- a person knows the IP their ISP granted them on the dates they were granted. They ask- do you have any records of me from these IPs on these dates. Assuming Plausible keeps the record of salt by date, the answer is yes, we have records of you, because they can retrieve the salt, recreate the ID, and locate the records. If they do not retain the salt, in contrast, they cannot respond to individual requests for their records and that would also imply they are not able to do day over day returning visitor calculations.
kevincox 6y ago
Note that anything deterministic on IPs is reversible. There are only 4 billion IPv4 addresses so brute forcing is trivial. It is more complicated for IPv6 but enough of the internet is IPv4 that you can't ignore that case.
donohoe 6y ago
The point to note here is "if". Happily, they (Plausible) don't.
dbbk 6y ago
It's not reversible, it's hashed with a daily salt.

M2Ys4U 6y ago

The GDPR regulates the use of "personal data", which is broader in scope than "personally identifiable information": "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"