4 ms·
What would i need to add to the my websites privacy policy? What would i need to do to be GDPR and CCPA compliant? Those questions go completely unanswered an
by freemint 4y ago
What would i need to add to the my websites privacy policy?
What would i need to do to be GDPR and CCPA compliant?
Those questions go completely unanswered and should be part of https://pathview.io/get-started https://pathview.io/get-started . If those questions are not unanswered or addressed, the service is a liability. Answering those questions also gives a lot of transperancy to your customer what you are and are not doing. There should be an automatism and promise to inform people that an update to the privacy policy is required.
- shanebellone 4y agoYou don't need a cookie banner or special privacy policy. It doesn't track personal data. You're absolutely right though, the website should mention those things. I'm hesitant to make claims about GDPR and CCPA. Those claims come with questions about the underlying mechanism which is only covered by a provisional patent. I really need a lawyer to move forward on those fronts. Pathview is about two months old, and the website is less than a week. Clarifications will be required, and decisions will be made. Thank you for the extra motivation.
- littlestymaar 4y agoIf you're tracking users, no matter if it's done via cookies or something else, then if falls under GDPR and you at least have something to do about it. GDPR's definition of personal data is much broader than one may expect, you should definitely ask a lawyer on this subject to be sure you're compliant.
- shanebellone 4y agoOnly if you use personal data as defined by GDPR which includes the transmission, processing, and storing of IP addresses or their hashed equivalents. A salted hash cannot be attributed to an individual user. The EU position regards the IPV6 range as sufficiently small to attribute a hash back to an IP with enough motivation and resources. Pathview strictly uses the salted hash to count unique visits. It's as minimally invasive as possible.
- freemint 4y agoI think salted is not enough but peppered per domain and salted sounds good. That way you can not learn what IP visited different websites you track. So hash(IP+domain_bucket_specified_by_user+SALT)
- shanebellone 4y agoFantstic idea! I'll immediately implement this.
- freemint 4y agoCustomized buckets (to aggregate users between multiple (sub-)domains) could be a premium feature if you ever go the freemium route.
- shanebellone 4y agoI've implemented this solution. Great idea. Thanks again for your feedback.