13 ms·
Show HN: Check if your website violates GDPR
- NmAmDa 5y agoCloudflare obviously the major violation for many sites.
- hauken 5y agoYes. I had to switch the serverless function that checks location to a server in Sweden, or else almost every site was in violation.
- janto 5y agohttps://www.cloudflare.com/gdpr https://www.cloudflare.com/gdpr (seems broken) https://www.cloudflare.com/learning/privacy/what-is-the-gdpr/ https://www.cloudflare.com/learning/privacy/what-is-the-gdpr...
- hauken 5y agoAfter reading that German court has ruled that embedding Google Fonts violates GDPR because IP addresses are sent to the US, I made a webtool to check which servers websites requests.
- amar-laksh 5y agoApparently, HN might be violating GDPR according to the website
- jtbayly 5y agoYep. Now everybody has to decide if they actually believe the EU has the ability to tell them exactly how they have to run their website.
- janto 5y agoAs a visitor to your website how can I know you are respecting my privacy?
- jtbayly 5y agoHow about I put up a huge privacy theater alert box on my site like all the other stupid websites that decided to make a morality play out of following GDPR? Are they all going to add another popover box saying “WE DON’T A USE GOOGLE FONTS! YOU CAN TRUST US WITH YOUR PERSONAL DATA! WE PROMISE!”?
- janto 5y agoIf it's a US site, I know that's a promise that it can't really make, due to US laws. If it's a EU site, then I could hold them legally responsible if it's just theater.
- rpdillon 5y agoThis hits the heart of the issue: how would you know if it's "just theater"? And if you did somehow find out, holding a random site legally responsible (I'm assuming you mean suing them?) will be dicey...even notable European sites don't comply with GDPR (the one example mentioned elsewhere in this thread was https://www.consilium.europa.eu/en/ https://www.consilium.europa.eu/en/, but I'm sure that's not an isolated instance).
- janto 5y agoFor larger businesses, relying on whistleblowers or auditing might be one way. For smaller ones using tools like the one discussed here. Or maybe a browser plugin that automatically notifies visitors. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"
- rpdillon 5y ago
- blitzar 5y agoYep. Now everybody has to decide if they actually believe the government where they live has the ability to tell them exactly when and who, if anyone they are allowed to murder for no reason at all.
- jtbayly 5y agoI don’t live in the EU, which is the main point. The EU says it is illegal for anybody in the world to use Google Fonts. Guess how many people outside the EU care what the EU says they can and can’t do on their website. How many millions of websites are there using Google Fonts right now? How many were there last week? How many will there be next week? That tells you everything you need to know.
- blitzar 5y ago> The EU says it is illegal for anybody in the world to use Google Fonts Total and utter horeshit, and you are fully aware of it.
- jtbayly 5y agoI’m sorry if I misunderstood. The post I’m commenting on said Google Fonts are no no, did it not?
- blitzar 5y agoWhen you sell chicken in the EU it cant be washed in chlorie. That does not mean that the EU have banned anyone in the world from bathing their chickens in chlorine, but if you present your goods to the block it must comply with the laws of the block. Likewise when you present your website to people within the block, you must comply with the laws of the block. btw when you factory farm animals 10 high and they live their entire lives covered in the faeces from the 9 layers of chickens above is actually a good idea to give them a wash and disinfect them.
- 5y ago
- hans1729 5y agoEither the customers who care about privacy trust you, or they don't. Let n cases show up in the news where US-companies are ignoring the respective rulings and the US-market will simply lose any attraction it still has left for european customers. If I have the choice between an american service and a european one, I'll choose the latter every single time, because I wouldn't trust american companies, the american government, or american citizens at all. Your comment isn't the reason why, but very likely stems from the same causes. Also, the public sector matters a lot here: they can't risk to have the data going to the US when they are legally mandated to keep it in Europe. This demand already exists and won't go anywhere, leading to all kinds of services being re-engineered on european soil. Eventually any company who doesn't respect their users privacy will probably be phased out by a european alternative - at least for the customers who care about that sort of thing. Europe made very clear that it does, but sure, time will tell what disrespecting that market segment will do to market shares.
- jtbayly 5y agoYou do realize the vast majority of websites don’t even have customers, right? Ask me how much I care whether my non-existent customers decide they don’t want to be my customer. And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself.
- hans1729 5y ago>And I’ll ask you how in the world a visitor to my website is supposed to know or care whether my site is hosted in the US or EU. I’m not even 100% sure myself. Pretty sure we'll see indicators for that in browsers in the foreseeable future. The internet will be a much more zoned-space in the future, so much seems obvious. > You do realize the vast majority of websites don’t even have customers, right? customer <- visitor
- rpdillon 5y agoThis path leads towards the balkanization of the web, which is a step backward in my estimation. This tool reports that static sites with no JS, no cookies, and no third-party requests are in violation because they are hosted in a place other than the EU. That surprises me greatly. It seems from your comments downthread that this is the direction you see things going (i.e. a more fragmented internet), and that may be correct, but I see it as a huge loss, and I _highly_ doubt it will solve any of the privacy problems we have. Now that I think about it, if an IP address is PII, and leaking PII outside of the EU is a violation, I wonder if any P2P network can be legal in the EU, since P2P networks leak IPs globally. How would IPFS or Bittorrent work? A quick search shows that this is indeed an issue, and the most P2P networks don't support the necessary revocation of PII necessary. IEEE has an early access paper[0] about exactly this issue: > To comply with the criteria of the European Union's General Data Protection Regulation, it is important to ensure that personal data can be completely removed by their owners. To improve the privacy and security of the P2P file-sharing system, we propose a revocable and monitorable P2P file-sharing system over a consortium blockchain to achieve revocation of files in the decentralized environment. So, for everyone who said blockchain is a solution in search of a problem, I present GDPR-compliant P2P networks! I'm mostly kidding, my brief read through the abstract suggests this also requires a bunch of other heavy-handed measures, like securely verifying the P2P executable using Intel SGX. It's hard for me to imagine such a system gaining any sort of widespread use, but I've been wrong before. [0]: https://ieeexplore.ieee.org/abstract/document/9684748 https://ieeexplore.ieee.org/abstract/document/9684748
- jpdpeters 5y agoPretty sweet tool!
- dkyc 5y agoIt's interesting that people begin to realize now to which ridiculous conclusions GDPR taken at its word leads: - IP addresses are personally identifiable information (PII), and hence require consent to process - Transferring PII to servers outside of Europe, or servers owned by organizations with legal residence outside of Europe (aka American tech companies), is not allowed That means it is non-compliant to host your website at e.g. AWS, because it would mean AWS has technical means of accessing your customer's IP addresses, and AWS is owned by an American company. It doesn't matter whether you use a EU-based data center, because he jurisdiction of the parent company matters. This effectively rules out AWS, Google Cloud, Azure, and of course pretty much all CDN providers. And effectively everyone is non-compliant.
- krageon 5y ago> ridiculous conclusions > - IP addresses are personally identifiable information I really thought you were going to go in a different direction than this. This is very obvious and there's nothing ridiculous about it. To most people in the EU, an IP address gives a very high resolution to a person. > That means it is non-compliant to host your website at e.g. AWS Yes, this is correct. AWS, Azure and GCP cannot possibly be compliant. It's taking everyone a while to figure this out. There's nothing wrong with that, privacy-sensitive information should never touch the US. No US-based company can guarantee your privacy. > effectively everyone is non-compliant. This is of course hyperbole. If you don't log or track you are perfectly compliant in every case.
- dmitriid 5y agoAdditionally, for data that's strictly needed for your business, you don't even need to ask consent, but you're responsible for keeping data safe. It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN.
- krageon 5y ago> It's weird how the whole "you need to keep your users' data safe and not collect more than is necessary" is such a controversial topic for some on HN. I think it stems from a long lawless time online where everyone was free to aggressively exploit everyone else. The fact that such behaviour is becoming frowned upon is something that we should expect will generate some friction. That said, I also find it hard to empathise with.
- kjhughes 5y agoThanks for making and showing us. Minor bug report: URL input field hangs in spinning state if given URL does not exist, forcing page reload to try again.
- hauken 5y agoThanks! Haven’t caught that one before. The map state also persist from second search on, but I soon have a fix on that.
- teddyh 5y agoIt would be very useful if you could link directly to the test of a specific site, so you could send that link directly to people.
- worg 5y agoit seems https://www.violating-gdpr.com/ https://www.violating-gdpr.com/ violates GDPR itself by using vercel
- hauken 5y agoThe irony. ;) But the way the courts interpret GDPR essential parts of the internet are technically illegal if you are based in Europe.
- dmitriid 5y ago> the way the courts interpret GDPR essential parts of the internet are technically illegal if you are based in Europe. wat
- hauken 5y ago[dead]
- kuschku 5y ago> essential Google Fonts SaaS and Google Analytics aren’t essential. Self-hosted Google Fonts and Matomo get you a long way.
- worg 5y agoI agree on those, one of the few things I'd consider hard to replace is CDN
- vollmond 5y agoHmm. My site itself is hosted in the US, so it catches my site as one of the violations. Does GDPR differentiate between first-party and third-party servers in this case?
- hauken 5y agoThe solution doesn’t differentiate between first-party or third-party servers. As long as any servers are outside Europe, it marks the site as in violation.
- pbronez 5y agoYou explain this in the "how does this website work?" FAQ, but you could be even more up front about it. I expected this to try to do something interesting about cookie management or privacy policies (which is pretty hard TBH). You're asserting that embedding any content hosted outside the EU is a GDPR violation. That is HUGE NEWS. I had no idea. That seems crazy.
- 3np 5y agoIt’s a violation if it happens without consent. If PII (which IP address counts as) is shared (for example by fetching Google Fonts from a US-based CDN) regardless of consent, that is a violation. Many sites have a consent wall but will throw out third-party requests even if consent is not explicitly given. If you do those requests only for logged in users who have individually consented (oh, and grandfathering in old users who did not consent will require the same new consent), that does not in itself count as a violation. Also, explicit consent is not required for strictly necessary things. "Because this way is easier and cheaper and almost everyone else in our industry is doing it" is not sufficient reason.
- bombcar 5y agoIt doesn’t handle redirects well - domain.com redirecting to www.domain.com makes it freak out.
- Advent_Poetry9 5y agoCool. Thanks for making this.
- smlavine 5y agoI don't store cookies, don't even have JS on my site. But it violates the GDPR just because it's hosted in New York?
- lmkg 5y agoThe most recent court rulings that that because of the US CLOUD Act, all transfers of personal data to the United States are unlawful. Personal data includes IP addresses. These rulings are under appeal, but at the end of the day it's basically true that GDPR and CLOUD are fundamentally incompatible.
- cush 5y agoGDPR and INTERNET, you mean
- rovr138 5y agoSo, based on how networks and the internet works, no one from Europe can access a site if it's hosted in the US? Based on how networks work, you need to know where to send back those packets. Or do we have to all just blanket disable access to users from Europe. This is insane.
- deleted 5y ago[deleted]
- TacticalCoder 5y ago> ... at the end of the day it's basically true that GDPR and CLOUD are fundamentally incompatible. There are going to be a shitload of companies trying to offer EU-only cloud services that are going to comply with the GDPR (I'm not saying they'll all succeed, but there's obviously a market now). I don't see how the GDPR and the cloud are incompatible. I do however see how GDPR and american companies offering cloud services from servers based outside the EU are incompatible.
- lmkg 5y ago
- oliverdangelom 5y ago
- jka 5y agoThanks for sharing this! https://www.reciperadar.com/ https://www.reciperadar.com/ does (potentially, as per the notes on the page) pass. To provide further assurances to users, all of the code[1] to run the service is made available to the public, including logging/analytics functionality[2]. It's (currently?) hard to guarantee to end users that there aren't any other tricks going on, and to match the version running in production (on a single computer in my office room) to the relevant git commit, but the goal is to incrementally move in the direction of additional (verifiable) transparency for the service. [1] - https://github.com/openculinary/ https://github.com/openculinary/ [2] - https://github.com/openculinary/api/blob/24ac611b1c14b754f23203ce1463e2813b09ac66/reciperadar/api/recipes.py#L76-L91 https://github.com/openculinary/api/blob/24ac611b1c14b754f23...
- hash872 5y agoI don't mean to be confrontational, but as an American with websites in the US- why would I care? The most basic tenet of sovereignty is that a country's laws stop at their border, unless otherwise agreed in a treaty. I may be violating GPDR, I may be violating some Internet content laws in Zimbabwe and Cambodia as well, but laws don't cross borders. Just as an example off the top of my head- in Thailand, it's illegal to insult their king. Would anyone here refrain from posting anti-Thai monarch content on their website, in fear of breaking the laws in Thailand? If not, why would I care about GPDR? Imagine what a non-sequitur it would be if if someone told an American employer based here in the states, that you're violating EU employment law. By definition it.... doesn't apply. I do understand that if I ran a business with European customers, I would need to be in compliance with EU law- I get that- but genuinely confused why I would care otherwise. Are your websites in compliance with Zimbabwean Internet law?
- colechristensen 5y agoYou and your business are crossing borders when you serve traffic to foreign customers, and are thus party to their laws. No I'm not a lawyer, but if you really never intend to have any customers in Europe you'll probably be fine (ask a lawyer, not the Internet) but if you do or might then you're playing a game with whether or not you'll be caught or if the consequences will be more advantageous than mitigating them. America projects it's laws worldwide with the global financial system and anything with even a remote connection to the states is a poison pill that is used to prosecute behavior which is almost exclusively outside its borders. Other legal entities can do the same, but to a lesser extent.
- wepple 5y ago> You and your business are crossing borders when you serve traffic I’d argue that if the request originates outside my country, the customer has crossed the border with the intent to bring the content back to their country
- rovr138 5y agoI'd definitely put the onus on them. It's pretty insane that even routing and logs will cause issues because of a law on their side.
- zelphirkalt 5y agoHm, this seems to work incorrectly. The login website of https://www.personio.de/login/ https://www.personio.de/login/ after you specify a company to login for does load Google Fonts and those do not show up in the results as violation or at all.
- hauken 5y agoYes. It doesn’t pick up everything. I’m just parsing the dom and checking for apparent things like script tags etc. I could have used puppeteer or similar to check all requests made, but the user experience became very slow, so I skipped that.
- Proven 5y ago
- sleepydog 5y agoIt told me my site is probably violating GDPR. It's a static blog and doesn't collect any information or use any cookies, but it's hosted in the US. There would be ip addresses in the nginx logs, but those would be the ips of the proxy load balancer from my cloud provider.
- bryanrasmussen 5y agoI guess it is not violating anything then.
- dekhn 5y agoI know some folks really like GDPR but I think it overreaches in a number of areas which probably were not fully recognized before the law was created.
- rovr138 5y agoOn the FAQ at the bottom, could you add links to the recent decisions from the German and other courts?
- hauken 5y agoI have added links to the news about the decisions, but I see that the CSS styling made them similar to the rest of the text. I have fixed that now!
- JohnTHaller 5y agoIt always feels like the failed EU cookie policy and the GDPR would be better served by an "EU mode browser". It would have third party cookies disabled and first party cookies would prompt for approval the way all browsers used to work. It would disable third party image, css, js, and font hosting without prompting for approval and warning of privacy implications, since all of those can be used to take IP addresses by the third parties. It could even serve up a 'do not track' style indicator for certain privacy settings.
- deleted 5y ago[deleted]
- pabe 5y agoIt seems like you're in problematic GDPR territory as soon as you're instructing the users browser to contact a webservice of a company that is subsidiary of an US company (see e.g. https://www.lexology.com/library/detail.aspx?g=196d55c7-beeb-43cc-9af0-5dedbfcf6149 https://www.lexology.com/library/detail.aspx?g=196d55c7-beeb...) The problem here is the IP address is classified as personal data. So, it might be illegal to allow an EU residents browser to even request a website hosted by e.g. AWS Ireland in Region Germany as AWS belongs to Amazon US. We're actually thinking to serve EU customers via Hetzner and Bunny.net CDN to guarantee GDPR compliance.
- kuba-orlik 5y agoAs a GDPR auditor, this website just does a very superficial job, and doesn't go anywhere close to deep enough. It could at least check if third-party cookies are being set without consent, which is a major GDPR red flag
- hauken 5y agoYes, it does a very superficial job. But to check for third-party cookies and if they are being set without consent is very difficult to normalize and check for. For now, this is just a simple tool to check where a website fetches its information. However, it takes a shortcut by only traversing the DOM. It would be more precise if it checked all network activity from a site, but then it would have to fire up a browser for every search, and the loading times would be much, much longer (yes, I tried). But if people find this helpful, I could work more on it to add more features as you suggest.