5 ms·

IP addresses are not PII, for starters. Plus, the networks won't be giving any of information about you, so GDPR has nothing to do with it.

yjftsjthsd-h 4y ago
If they're literally doing it to target ads, it's definitely PII.
- rglullis 4y ago
  Think of who is "they" who is targeting the ads, and what "they" is collecting the data. Telcos are not giving anything except the IP address. If you go to other websites and don't provide your data to them, all they will have is an identifier about the IP. It is that data that can be managed under GDPR, but IP in isolation means nothing.
tuukkah 4y ago
In addition to PII, GDPR also protects against collection of IP addresses and any other identifiers that can reveal a person: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. [--] Examples of personal data [--] * an Internet Protocol (IP) address" https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- rglullis 4y ago
  It's incredible how people read these things into what they wish it meant instead of what it actually means. I stand by what I said: IP addresses, by themselves, are not PII. To become PII, it needs to come with the data from the person visiting the website.
  - tuukkah 4y ago
    I did not say IPs are PII, I said IPs according to GDPR are personal data.
    - rglullis 4y ago
      Ok, we are going in circles. It depends on the context
      - tuukkah 4y ago
        Your original claim was: > GDPR has nothing to do with it. This is false: if they use the IP address to match the website visitor with the ISP customer, GDPR is very much relevant as GDPR restricts the use of personal data (including IP addresses) like this.
        rglullis 4y ago
        It restricts when it is meant to be correlated with the other data they collect from you. The networks are in the clear.
        tuukkah 4y ago
        Do you disagree with the official link I gave? If so, can you provide a more reliable reference to your reading of the law? Also, as far as I know, PII is a US concept and appears nowhere in the GDPR.
        rglullis 4y ago
        The reliable reference I can give you is the legal team from the company I was working for, who had to deal with all this shit and in the end said that session logs with IP addresses did not count as user data and therefore need not to be listed as part of "user collected data" in our privacy policy. Another way that I can argue for this interpretation is simple: if you want connect to a hotspot in Germany, no one asks you if you opt-in to sharing your IP addresses. These, by itself, are considered "required information to appropriate service" (or something equivalent in legalese). The third argument I can give is a bit circular: if GDPR had any way to rule this illegal, it would already have been met by huge outcry from the proper privacy NGOs. If it has gotten to the point where the companies are announcing tryouts, it means that the networks are confident enough that they are (at least in regards to GDPR) legally in the clear. All in all, I hope that people crying for regulations and government intervention could understand once and for all that the laws that get approved are never going to do what they wished it did. I already got into plenty of arguments here with people that believe that GDPR is effective to protect users, but this is just yet-another example of regulatory capture.
ThePowerOfFuet 4y ago
In the EU this is not the case.

yjftsjthsd-h 4y ago

If they're literally doing it to target ads, it's definitely PII.

rglullis 4y ago
Think of who is "they" who is targeting the ads, and what "they" is collecting the data. Telcos are not giving anything except the IP address. If you go to other websites and don't provide your data to them, all they will have is an identifier about the IP. It is that data that can be managed under GDPR, but IP in isolation means nothing.

tuukkah 4y ago

In addition to PII, GDPR also protects against collection of IP addresses and any other identifiers that can reveal a person: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. [--] Examples of personal data [--] * an Internet Protocol (IP) address" https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

rglullis 4y ago
It's incredible how people read these things into what they wish it meant instead of what it actually means. I stand by what I said: IP addresses, by themselves, are not PII. To become PII, it needs to come with the data from the person visiting the website.
- tuukkah 4y ago
  I did not say IPs are PII, I said IPs according to GDPR are personal data.
  - rglullis 4y ago
    Ok, we are going in circles. It depends on the context
    - tuukkah 4y ago
      Your original claim was: > GDPR has nothing to do with it. This is false: if they use the IP address to match the website visitor with the ISP customer, GDPR is very much relevant as GDPR restricts the use of personal data (including IP addresses) like this.
      - rglullis 4y ago
        It restricts when it is meant to be correlated with the other data they collect from you. The networks are in the clear.
        tuukkah 4y ago
        Do you disagree with the official link I gave? If so, can you provide a more reliable reference to your reading of the law? Also, as far as I know, PII is a US concept and appears nowhere in the GDPR.
        rglullis 4y ago
        The reliable reference I can give you is the legal team from the company I was working for, who had to deal with all this shit and in the end said that session logs with IP addresses did not count as user data and therefore need not to be listed as part of "user collected data" in our privacy policy. Another way that I can argue for this interpretation is simple: if you want connect to a hotspot in Germany, no one asks you if you opt-in to sharing your IP addresses. These, by itself, are considered "required information to appropriate service" (or something equivalent in legalese). The third argument I can give is a bit circular: if GDPR had any way to rule this illegal, it would already have been met by huge outcry from the proper privacy NGOs. If it has gotten to the point where the companies are announcing tryouts, it means that the networks are confident enough that they are (at least in regards to GDPR) legally in the clear. All in all, I hope that people crying for regulations and government intervention could understand once and for all that the laws that get approved are never going to do what they wished it did. I already got into plenty of arguments here with people that believe that GDPR is effective to protect users, but this is just yet-another example of regulatory capture.

ThePowerOfFuet 4y ago

In the EU this is not the case.