4 ms·

It’s not obvious they did nothing wrong. The referenced statute creates an obligation to respond to inquiries and not everyone is comfortable making their own

by jcims 5y ago

It’s not obvious they did nothing wrong. The referenced statute creates an obligation to respond to inquiries and not everyone is comfortable making their own decision whether or not it applies to them.

smsm42 5y ago
It creates an obligation to businesses selling user data, or ones with revenues over 25 millions. It's not hard to find either: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa The CCPA applies to for-profit businesses that do business in California and meet any of the following: Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.
- andybak 5y ago
  I'm reading that and I can already see things that require me to think hard about whether it might apply. > any of the following OK > Buy, receive, or sell the personal information of 50,000 or more California residents, "receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging. You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply. "For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"
  - xena 5y ago
    As the author of that article, I bet I meet that bar as soon as one of my posts gets on the front page of Hacker News, very easily if I post multiple articles which ended up getting popular like I have this month.
    - master-lincoln 5y ago
      Why are you collecting personal information (IPs) of your readers though?
      - xena 5y ago
        Really I have the nginx logs going to the disk so that I can have prometheus-nginx scrape them for referer patterns (it getting above a certain threshold for a given referer is how I know when my article got posted somewhere), status code rates and overall to make sure that the core functions of the site (such as the RSS feed) are working like I expect. I could probably change it to write the logs to a unix fifo instead of a unix file, but I actually do end up going back to look at the logs for things like people attempting to exploit my code so I can harden my site appropriately.
        Beldin 5y ago
        Thanks! That's an informative reply. I was wondering whether not logging could be an option. That's now quite clear.
        xena 5y ago
        I just checked the logs and did some reverse IP lookups at random and it turns out nearly all the IP addresses I have are cloudflare IPs. So I don't even have IP addresses logged the way I thought I did! Yay me!
      - jcims 5y ago
        Not OP, but IPs are not always considered personal information. If you never establish the identity of the consumer directly, its not clear that the effort required to convert that address to an identity meets the bar of 'reasonably capable'. The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.
      - dawnbreez 5y ago

by jcims 5y ago

smsm42 5y ago

It creates an obligation to businesses selling user data, or ones with revenues over 25 millions. It's not hard to find either: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa The CCPA applies to for-profit businesses that do business in California and meet any of the following: Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.

andybak 5y ago
I'm reading that and I can already see things that require me to think hard about whether it might apply. > any of the following OK > Buy, receive, or sell the personal information of 50,000 or more California residents, "receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging. You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply. "For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"
- xena 5y ago
  As the author of that article, I bet I meet that bar as soon as one of my posts gets on the front page of Hacker News, very easily if I post multiple articles which ended up getting popular like I have this month.
  - master-lincoln 5y ago
    Why are you collecting personal information (IPs) of your readers though?
    - xena 5y ago
      Really I have the nginx logs going to the disk so that I can have prometheus-nginx scrape them for referer patterns (it getting above a certain threshold for a given referer is how I know when my article got posted somewhere), status code rates and overall to make sure that the core functions of the site (such as the RSS feed) are working like I expect. I could probably change it to write the logs to a unix fifo instead of a unix file, but I actually do end up going back to look at the logs for things like people attempting to exploit my code so I can harden my site appropriately.
      - Beldin 5y ago
        Thanks! That's an informative reply. I was wondering whether not logging could be an option. That's now quite clear.
        xena 5y ago
        I just checked the logs and did some reverse IP lookups at random and it turns out nearly all the IP addresses I have are cloudflare IPs. So I don't even have IP addresses logged the way I thought I did! Yay me!
    - jcims 5y ago
      Not OP, but IPs are not always considered personal information. If you never establish the identity of the consumer directly, its not clear that the effort required to convert that address to an identity meets the bar of 'reasonably capable'. The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.
    - dawnbreez 5y ago