4 ms·

I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor wor

I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.

shadowgovt 5y ago
if your site is running on apache with default logging, or a shared host like DreamHost, you are probably not fully in compliance with the letter of the GDPR since you're logging IP addresses and aren't using them for necessary site operations. ... especially if the log just grows and grows and never rotates. The GDPR is a very wide-reaching law. Of course, there's no real need to worry since, practically speaking, it was intended as a cudgel to beat FAANG with and not a dagger to stab indies with. If you're comfortable with the safety of your operations being "The folks with legal power to enforce won't wield it on you", you have nothing to worry about.
- UnpossibleJim 5y ago
  The problem is, they can enforce it on you at any time of their choosing should you do something deemed unpopular or troublesome. While the cudgel was intended for FAANG, the dagger still hangs to stab any indie that gets out of line. Why would I rely on the kindness of government not to enforce a poorly written law?
  - shadowgovt 5y ago
    Your position is mine, which is why I'm surprised at how broad the support for GDPR seems to be around here. "Broad government power is okay as long as they're clubbing the right people" is certainly a mood.
  - mariusor 5y ago
    I don't think "enforce" means what you think it means. If you are contacted about a GDPR matter usually you have time to fix it before it's "a violation" that incurs penalties.
    - UnpossibleJim 5y ago
      It's "squishy" terms in law, like "usually" that I find bothersome. Granted, I haven't read the complete specifics of all of the minutia when it comes to the GDPR, I'll admit. I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Should I start publishing a blog or some such which was antithetical to the prevailing party doctrine, that happened to gain traction with the public, terms like usually tend to go out of the window. Al Capone wasn't indicted on bootlegging after all.
      - M2Ys4U 5y ago
        Enforcement action must be "proportionate", so even if you are pulled up by a supervisory authority it's unlikely they're going to give you a massive fine straight off the bat - especially if you are trying to comply and can demonstrate that.
        UnpossibleJim 5y ago
        I think everyone seems to be missing the point of what I'm saying, and maybe it's my fault. In the defense of the law that people have given to me, so far, the terms "Usually" and "Unlikely" have come up. Neither of those terms are very satisfactory if I write a critical piece critical of the government and am taken to the full extent of the GDPR's breadth, with little ability to fight it, being a small, independent, self published journalist who had a friend set up a server using the default Apache settings(this is an example - I am not). In such a case, a massive fine would not only bankrupt that person but would silence such critical dissension from occurring in a much needed vocal minority. Investigative journalism from non-corporate outlets, through non-corporate outlets is a wonderful thing, which has become a rarity, and has the potentiality of becoming illegal due to clerical mishaps. While I do understand the necessity of a user's privacy, I also understand the necessity of "removing the tumor and saving the leg", to borrow a colloquialism. Broad-brush approaches have quite a few down-stream consequences, which are seldom realized until it's too late. We've only to look at "the war on terror" and the domestic surveillance that came about in the name of "safety" to understand that =/
PragmaticPulp 5y ago
> A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. Not true. I've spent far too much time with expensive lawyers going through the painful details of GDPR compliance and edge cases. If you keep logs at all, anywhere, then technically you could be at risk of crossing the GDPR. Don't assume that you're free and clear because you haven't gone out of your way to add any analytics.
- Nextgrid 5y ago
  If you keep logs forever, yes you'll be in trouble (though probably much less than plastering your website with analytics or ads). Keep logs for a reasonable amount of time (90 days) and you'll be fine. Well, given the current state of GDPR enforcement, you'll be fine whatever you do. But lawyers are going to lawyer and consent management platforms will be delighted to scare you into buying their "solution", even if nitpicking by bringing up edge-cases that are unlikely to occur and for which no case law exists nor will ever exist.
  - ratww 5y ago
    Correct. The intent for keeping IP addresses in logs also matters. To give two examples: if you're keeping logs for legal reasons, then it is perfectly fine. If you're keeping for anti-fraud reasons, this is also fine and can be considered "legitimate interest" (as long as the amount of time for storage is reasonable, as you said). If you intend to use this data for other reasons, then you need consent before doing so.

I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.

shadowgovt 5y ago

if your site is running on apache with default logging, or a shared host like DreamHost, you are probably not fully in compliance with the letter of the GDPR since you're logging IP addresses and aren't using them for necessary site operations. ... especially if the log just grows and grows and never rotates. The GDPR is a very wide-reaching law. Of course, there's no real need to worry since, practically speaking, it was intended as a cudgel to beat FAANG with and not a dagger to stab indies with. If you're comfortable with the safety of your operations being "The folks with legal power to enforce won't wield it on you", you have nothing to worry about.

UnpossibleJim 5y ago
The problem is, they can enforce it on you at any time of their choosing should you do something deemed unpopular or troublesome. While the cudgel was intended for FAANG, the dagger still hangs to stab any indie that gets out of line. Why would I rely on the kindness of government not to enforce a poorly written law?
- shadowgovt 5y ago
  Your position is mine, which is why I'm surprised at how broad the support for GDPR seems to be around here. "Broad government power is okay as long as they're clubbing the right people" is certainly a mood.
- mariusor 5y ago
  I don't think "enforce" means what you think it means. If you are contacted about a GDPR matter usually you have time to fix it before it's "a violation" that incurs penalties.
  - UnpossibleJim 5y ago
    It's "squishy" terms in law, like "usually" that I find bothersome. Granted, I haven't read the complete specifics of all of the minutia when it comes to the GDPR, I'll admit. I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Should I start publishing a blog or some such which was antithetical to the prevailing party doctrine, that happened to gain traction with the public, terms like usually tend to go out of the window. Al Capone wasn't indicted on bootlegging after all.
    - M2Ys4U 5y ago
      Enforcement action must be "proportionate", so even if you are pulled up by a supervisory authority it's unlikely they're going to give you a massive fine straight off the bat - especially if you are trying to comply and can demonstrate that.
      - UnpossibleJim 5y ago
        I think everyone seems to be missing the point of what I'm saying, and maybe it's my fault. In the defense of the law that people have given to me, so far, the terms "Usually" and "Unlikely" have come up. Neither of those terms are very satisfactory if I write a critical piece critical of the government and am taken to the full extent of the GDPR's breadth, with little ability to fight it, being a small, independent, self published journalist who had a friend set up a server using the default Apache settings(this is an example - I am not). In such a case, a massive fine would not only bankrupt that person but would silence such critical dissension from occurring in a much needed vocal minority. Investigative journalism from non-corporate outlets, through non-corporate outlets is a wonderful thing, which has become a rarity, and has the potentiality of becoming illegal due to clerical mishaps. While I do understand the necessity of a user's privacy, I also understand the necessity of "removing the tumor and saving the leg", to borrow a colloquialism. Broad-brush approaches have quite a few down-stream consequences, which are seldom realized until it's too late. We've only to look at "the war on terror" and the domestic surveillance that came about in the name of "safety" to understand that =/

PragmaticPulp 5y ago

> A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. Not true. I've spent far too much time with expensive lawyers going through the painful details of GDPR compliance and edge cases. If you keep logs at all, anywhere, then technically you could be at risk of crossing the GDPR. Don't assume that you're free and clear because you haven't gone out of your way to add any analytics.

Nextgrid 5y ago
If you keep logs forever, yes you'll be in trouble (though probably much less than plastering your website with analytics or ads). Keep logs for a reasonable amount of time (90 days) and you'll be fine. Well, given the current state of GDPR enforcement, you'll be fine whatever you do. But lawyers are going to lawyer and consent management platforms will be delighted to scare you into buying their "solution", even if nitpicking by bringing up edge-cases that are unlikely to occur and for which no case law exists nor will ever exist.
- ratww 5y ago
  Correct. The intent for keeping IP addresses in logs also matters. To give two examples: if you're keeping logs for legal reasons, then it is perfectly fine. If you're keeping for anti-fraud reasons, this is also fine and can be considered "legitimate interest" (as long as the amount of time for storage is reasonable, as you said). If you intend to use this data for other reasons, then you need consent before doing so.