3 ms·

It's the salted hash of the IP used to connect. I did build my approach around the Internet's backbone to future proof. Banning my approach would fundamentally

It's the salted hash of the IP used to connect. I did build my approach around the Internet's backbone to future proof. Banning my approach would fundamentally break the Internet. I've made a note and will read into the precedent. Thank you for the research topic.

closewith 4y ago
> Banning my approach would fundamentally break the Internet. That’s simply false. The legal basis for processing an IP address in order to serve an HTTP request in the EU is Art 6 (b): > processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; This does not give you the right to use that data for any other purpose. The approach you’re using is called fingerprinting in the industry (relatively naive fingerprinting given it only uses IP address) and it is the ongoing subject of enforcement action in the EU. Nothing about the approach is compliant. Frankly, if it was this easy to forgo the regulatory impact of the GDPR, every analytics service would do it (many shady ones do).
- shanebellone 4y ago
  Pathview does not fingerprint. Full stop. The salted hash (of the IP address) is used for one purpose: to count unique visits.
  - closewith 4y ago
    To associate individual page views to a single real IP address. That is fingerprinting.
    - shanebellone 4y ago
      Pathview does not associate individual page views to single real IP addresses.
      - closewith 4y ago
        Quite honestly, you are not competent to make that determination. For the purposes of compliance with the GDPR, Pathview does associate individual page views with a single real IP address. From the precedent set by the CNIL ruling on Google Analytics in July, the only way for an analytics tool not to process personal data in the form of an IP address is to relay the request via a first-party proxy (and strip the referer). Your analytics tool cannot accept HTTP requests from the users browser and be compliant with the GDPR without gaining consent. Serving an HTTP request made for the purposes of analytics is processing personal data and there's no legal basis for the processing without consent. > The fundamental problem that prevents these measures from addressing the issue of access of data by non-European authorities is that of direct contact, via an HTTPS connection, between the individual's terminal and servers managed by Google. > The resulting requests allow these servers to obtain the IP address of the Internet user as well as a lot of information about his terminal. This information may realistically allow the user to be re-identified and, consequently, to access his or her browsing on all sites using Google Analytics. > Only solutions allowing to break this contact between the terminal and the server can address this issue. Beyond the case of Google Analytics, this type of solution could also make it possible to reconcile the use of other analytics tools with the GDPR rules on data transfer. Source: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h...
        shanebellone 4y ago
        I've removed the hashed IP address. It is no longer stored and therefore cannot be processed. As I've said multiple times, I will be consulting with a lawyer to ensure Pathview is in compliance with relevant privacy laws. You might be a lawyer (who knows), but I am definitely not.

closewith 4y ago

> Banning my approach would fundamentally break the Internet. That’s simply false. The legal basis for processing an IP address in order to serve an HTTP request in the EU is Art 6 (b): > processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; This does not give you the right to use that data for any other purpose. The approach you’re using is called fingerprinting in the industry (relatively naive fingerprinting given it only uses IP address) and it is the ongoing subject of enforcement action in the EU. Nothing about the approach is compliant. Frankly, if it was this easy to forgo the regulatory impact of the GDPR, every analytics service would do it (many shady ones do).

shanebellone 4y ago
Pathview does not fingerprint. Full stop. The salted hash (of the IP address) is used for one purpose: to count unique visits.
- closewith 4y ago
  To associate individual page views to a single real IP address. That is fingerprinting.
  - shanebellone 4y ago
    Pathview does not associate individual page views to single real IP addresses.
    - closewith 4y ago
      Quite honestly, you are not competent to make that determination. For the purposes of compliance with the GDPR, Pathview does associate individual page views with a single real IP address. From the precedent set by the CNIL ruling on Google Analytics in July, the only way for an analytics tool not to process personal data in the form of an IP address is to relay the request via a first-party proxy (and strip the referer). Your analytics tool cannot accept HTTP requests from the users browser and be compliant with the GDPR without gaining consent. Serving an HTTP request made for the purposes of analytics is processing personal data and there's no legal basis for the processing without consent. > The fundamental problem that prevents these measures from addressing the issue of access of data by non-European authorities is that of direct contact, via an HTTPS connection, between the individual's terminal and servers managed by Google. > The resulting requests allow these servers to obtain the IP address of the Internet user as well as a lot of information about his terminal. This information may realistically allow the user to be re-identified and, consequently, to access his or her browsing on all sites using Google Analytics. > Only solutions allowing to break this contact between the terminal and the server can address this issue. Beyond the case of Google Analytics, this type of solution could also make it possible to reconcile the use of other analytics tools with the GDPR rules on data transfer. Source: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h...
      - shanebellone 4y ago
        I've removed the hashed IP address. It is no longer stored and therefore cannot be processed. As I've said multiple times, I will be consulting with a lawyer to ensure Pathview is in compliance with relevant privacy laws. You might be a lawyer (who knows), but I am definitely not.