3 ms·

I mean, most "unique view counters" store the users IP address, so that would be right out. I'm fairly sure even being aware of what complying with a complex le

I mean, most "unique view counters" store the users IP address, so that would be right out. I'm fairly sure even being aware of what complying with a complex legal documents implies constitutes enough of a complication that it's worth mentioning. It is a complication, but I believe it's worded so that small companies and individuals are immune from its consequences.

deleted 5y ago
[deleted]
martin_a 5y ago
You could always hash the IP on the client side before sending it to your counter. That way you have no information which you can backtrack to a specific IP and therefore a person.
- BenjiWiebe 5y ago
  Except there's so few IPs (v4) you could just bruteforce it in not too much time.
  - WesolyKubeczek 5y ago
    There are different kinds of hashes. You can, for example, assign numbers to your incoming IPs. The first one to come in gets 1, the second gets 2, and so on. Numbers zero out at midnight, correlation between them and real IPs are at the load balancer. Good luck bruteforcing these.
WesolyKubeczek 5y ago
As long as you can describe the full extent to which the collected IP addresses are being used and which data they are being correlated with, and use a language comprehensible without requiring a legal degree, you can very easily be compliant. Once you involve an undisclosed number of "trusted partners" and start using weasel words to describe what you're using the data for and who you're giving them to, not so much. That said, an IP address is a shitty device to detect unique visitors. Session cookies, as long as you aren't trying to correlate them to usage patterns and such, are more reliable (you can tell that this is the same phone jumping networks, or you can tell apart users coming from behind multiple layers of NAT) and anonymous.

3 ms·

I mean, most "unique view counters" store the users IP address, so that would be right out. I'm fairly sure even being aware of what complying with a complex le

by erulabs 5y ago

deleted 5y ago
[deleted]
martin_a 5y ago
You could always hash the IP on the client side before sending it to your counter. That way you have no information which you can backtrack to a specific IP and therefore a person.
- BenjiWiebe 5y ago
  Except there's so few IPs (v4) you could just bruteforce it in not too much time.
  - WesolyKubeczek 5y ago
    There are different kinds of hashes. You can, for example, assign numbers to your incoming IPs. The first one to come in gets 1, the second gets 2, and so on. Numbers zero out at midnight, correlation between them and real IPs are at the load balancer. Good luck bruteforcing these.
WesolyKubeczek 5y ago
As long as you can describe the full extent to which the collected IP addresses are being used and which data they are being correlated with, and use a language comprehensible without requiring a legal degree, you can very easily be compliant. Once you involve an undisclosed number of "trusted partners" and start using weasel words to describe what you're using the data for and who you're giving them to, not so much. That said, an IP address is a shitty device to detect unique visitors. Session cookies, as long as you aren't trying to correlate them to usage patterns and such, are more reliable (you can tell that this is the same phone jumping networks, or you can tell apart users coming from behind multiple layers of NAT) and anonymous.