4 ms·

I have a website to host some basic static content and maybe a few pieces of text. I don't feel like this makes my life any more burdensome. Do you maybe mean t

I have a website to host some basic static content and maybe a few pieces of text. I don't feel like this makes my life any more burdensome. Do you maybe mean that it will become increasingly burdensome to own a website that collects analytics on users, or something similar?

Robotbeat 4y ago
An enthusiast web forum that captures IP address, often used for helping to enforce troll bans.
- WaxProlix 4y ago
  They're also not businesses, usually. I didn't read the entirety of the bill, but does an IP address alone constitute PII here?
  - judge2020 4y ago
    Yes, IPs are PII given they can be linked across websites. In addition, many ISPs in the US do dynamic IP assignment but will let you keep your ipv4 for years if you don't go offline for too long (i've gone 24 hours without the router connected to the internet on ATT without losing my IP). And the 'business' requirement is more about "doing business" in the state and not "the service provider is a legally registered business", so individuals also must comply.
- deleted 4y ago
  [deleted]
bhelkey 4y ago
> Do you maybe mean that it will become increasingly burdensome to own a website that collects analytics on users, or something similar? I think you are underestimating the impact. Anything that stores account names or emails (forms, comment sections, commerce sites, ...) is a very broad list. Even if none of this is true and you ONLY serve static content without analytics delivered to the user you are not guaranteed to be safe. Apache by default logs IP addresses [1]. [1] https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-apache-web-server-most https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-...
hot_gril 4y ago
Does your static webserver log IP addresses of requests? Most do by default.
- pclmulqdq 4y ago
  My static site sits behind cloudflare and logs to /dev/null. It's possible (actually pretty easy) to configure things like this.
autoexec 4y ago
It does look like you'd be required to perform a data protection impact assessment every two years and submit a report on it. Likely your report won't be complicated because there will be very little impact, but you'll still have to file the paperwork and maintain records to be able to prove that you did the work and that the required updates were performed on schedule without fail.

Robotbeat 4y ago

An enthusiast web forum that captures IP address, often used for helping to enforce troll bans.

WaxProlix 4y ago
They're also not businesses, usually. I didn't read the entirety of the bill, but does an IP address alone constitute PII here?
- judge2020 4y ago
  Yes, IPs are PII given they can be linked across websites. In addition, many ISPs in the US do dynamic IP assignment but will let you keep your ipv4 for years if you don't go offline for too long (i've gone 24 hours without the router connected to the internet on ATT without losing my IP). And the 'business' requirement is more about "doing business" in the state and not "the service provider is a legally registered business", so individuals also must comply.
deleted 4y ago
[deleted]

bhelkey 4y ago

> Do you maybe mean that it will become increasingly burdensome to own a website that collects analytics on users, or something similar? I think you are underestimating the impact. Anything that stores account names or emails (forms, comment sections, commerce sites, ...) is a very broad list. Even if none of this is true and you ONLY serve static content without analytics delivered to the user you are not guaranteed to be safe. Apache by default logs IP addresses [1]. [1] https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-apache-web-server-most https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-...

hot_gril 4y ago

Does your static webserver log IP addresses of requests? Most do by default.

pclmulqdq 4y ago
My static site sits behind cloudflare and logs to /dev/null. It's possible (actually pretty easy) to configure things like this.

autoexec 4y ago

It does look like you'd be required to perform a data protection impact assessment every two years and submit a report on it. Likely your report won't be complicated because there will be very little impact, but you'll still have to file the paperwork and maintain records to be able to prove that you did the work and that the required updates were performed on schedule without fail.