3 ms·
Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure l
by losvedir 5y ago
Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say, China or Russia.
- Hnrobert42 5y agoFor that matter, does the fact that reaching my self hosted site must travel the last mile along a service I paid for (my ISP), mean I must gain consent for using them?
- jlokier 5y agoWith Hetzner you can get a GDPR compliant Data Processing Agreement (DPA) when using them for hosting. https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitung-gemaess-art-28-ds-gvo-steht-ab-sofort-online-zur-verfuegung-eintrag/ https://www.hetzner.com/news/vertrag-zur-auftragsverarbeitun... It's ok that their infrastructure logs IPs that it has to. They commit via their DPA to protecting personal data such as embedded in those logs, not logging what they don't need, not keeping it longer than necessary, only sharing it with third parties that agree similar protections, anonymising and aggregating as needed, etc. You probably want an agreement like that with a hosting provider for another reason, not just IP logging: They have physical access to all your on site storage, user databases, etc. It's good that they commit to treating data on those physical systems with appropriate respect.