6 ms·

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is

by tensor 4y ago

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

vidarh 4y ago
People in the EU can disclose their own PII to whomever they want, including far more sensitive details than IP addresses, so this isn't an issue. The limitations are on the parties capturing the data, not on the person whose data it is.
johannes1234321 4y ago
> anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?
- ksidudwbw 4y ago
  Just don't be creepy, that's all.
  - gameman144 4y ago
    "Don't be creepy" isn't the law as -written, and is super nebulous to comply with.
- wizeman 4y ago
  > These laws don't bind individual citizens, but companies offering services. Right. EU companies whose websites are accessed by individual citizens and usually have assets stored by US companies, such as CDNs.
__m 4y ago
People are free to give away their PII
- tzmudzin 4y ago
  … but the receiver needs to provide evidence of consent
- mminer237 4y ago
  How do you collect consent from people before you receive their IP addresses?
  - shukantpal 4y ago
    Them giving their IP address is consent. If I put a dollar bill in your hand, I can come around a year later and ask for it back since I didn't "consent" explicitly.
    - roywiggins 4y ago
      When I load a website I have no idea what third-party assets are being loaded in or from where, and have no meaningful information ahead of time to know what I'm actually consenting to by typing "example.com" into the URL bar. Obviously, my IP will be sent to example.com, and I've arguably consented to that, but not to all the other third-party stuff that example.com might have loaded the page up with. (this is also the argument around cookie consent: yes, the browser chooses to accept the cookie. users don't really get an opportunity to refuse them, though. So "the browser accepted the cookies" is not sufficient consent, as far as the EU is concerned)
- bradleybuda 4y ago
  Not in the EU
andy_ppp 4y ago
I thought it was the storage of such data that is illegal not the connection? Obviously logs and analytics are an issue in some cases for this law, but I slightly agree with it; should we not all want our digital footprint to be as small as possible?
- __alexs 4y ago
  How long does your TCP connection need to be open for until it becomes "logs"? The law doesn't care what format that this information is stored in.
  - deleted 4y ago
    [deleted]
  - andy_ppp 4y ago
    Maybe I’m getting confused with GDPR, anyway I think interpretation of these laws that the stop the internet from working completely is usually incorrect in my experience.
    - j16sdiz 4y ago
      This is the golden rule of Statutory Interpretation
- mminer237 4y ago
  No, courts have made it clear that sending EU IP addresses to the US is illegal unless you can prove that the US government can't intercept it or someday force you to log them. No one the US is immune to subpeona, so no one can comply with that requirement. https://www.cnil.fr/sites/default/files/atoms/files/decision_ordering_to_comply_anonymised_-_google_analytics.pdf#page=8 https://www.cnil.fr/sites/default/files/atoms/files/decision...
  - ronsor 4y ago
    I don't think it's that strict, otherwise the court is mandating something that is literally impossible with current internet (routing) architecture.
erinnh 4y ago
Its not about the connection. You can connect to the website. But the website shouldnt save the IP address for anything other than technical relevant purposes. Ie. logs should be ok if its to combat DDOS and the like (for a limited time, ie 24h), but not for advertising purposes.
sveme 4y ago
It‘s not that simple (actually untrue): https://bluecatnetworks.com/blog/is-an-ip-address-pii-the-answer-is-nuanced/ https://bluecatnetworks.com/blog/is-an-ip-address-pii-the-an...
tiborsaas 4y ago
Don't spread FUD please. > anyone in the EU is not even allowed to connect to any website owned by a US company This is blatantly false, of course you are allowed to connect to non-EU websites even if the IP address could be PII in some circumstances. It's the service providers problem to manage the data they collect in legal way.
- nisegami 4y ago
  There _is_ no legal way to manage that data if the service provider is subject to the CLOUD act.
  - tiborsaas 4y ago
    There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.
    - blahyawnblah 4y ago
      Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.
      - jamie_ca 4y ago
        Hash the IP so you can tie sessions, and do frequency analysis for abuse, without having the raw IP that can be geo-decoded?
        throwaway2016a 4y ago
        Hashing IPs is ineffective, the IP namespace is so small a rainbow table (or even brute force) would be trivial so effectively the hash of an I is identical to the IP itself. Unless you salt it but if you do that it becomes useless for analytical, fraud prevention, and security purposes. Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.
lock-the-spock 4y ago
This is not at all correct. Technically necessary use is fully legal under gdpr.
- tensor 4y ago
  I don't think it's legal to send PII to the US under any circumstances. The technically necessary clause works fine only in non-US jurisdictions.
maxboone 4y ago
I'd say that's reasonable use
geofft 4y ago
Honestly, I think if the GDPR had been around before HTTP, we would have seen HTTP as the unreasonable part in this system. You don't have to make a direct TCP/IP connection for two people to communicate. We had systems like Usenet and UUCP that replicated data through a series of servers. Even today, when you use email, you talk to your email provider who talks to the recipient's email provider, and they have no need to share your personal IP addresses in the process. Some providers used to include this in Received: headers, but many today do not, rightly seeing it as a privacy concern. And even on HTTP we had (and still have, in some cases) mirrors, where legally-unrelated entities host copies of each others' data. Someone in the EU can visit http://ftp.icm.edu.pl/pub/linux/Documentation/ http://ftp.icm.edu.pl/pub/linux/Documentation/ and never have their connection known to the US-juridiction host of TLDP. It is both socially sensible for these providers to consent to sharing their own infrastructure IP addresses with other providers (but not share their customers' IP addresses) and legally practical for them to make that consent under the GDPR. Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? I don't want that information. I don't even get that information when using higher-level services like Hacker News or Twitter or GitHub, even though those services operate over HTTP. It's weird that I get it, honestly. I understand there's a huge planetary investment in HTTP, and so the collision of abstractly-reasonable privacy rights with that reality is an extremely hard engineering and policy problem. But that doesn't make the privacy rights unreasonable.
- rootusrootus 4y ago
  > Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? So when you misbehave, I have the means to block you in particular.
  - geofft 4y ago
    My personal website is a publicly-accessible static site. Blocking people from it is not meaningful. It might be meaningful under the model of direct HTTP, where you could be DoSing me or trying to exploit my web server. But if you don't contact me over HTTP, then that problem doesn't arise. There's no meaningful concept of blocking people from a Usenet post I write. Even for indirect HTTP, I don't need to block people from my GitHub Pages or from my HN comments. They're public. If I add dynamic feature like a comment system or discussion forum to my website, then it becomes meaningful, but also at that point I can implement a way for you to consent to sharing your IP address with me as part of signing up.
3np 4y ago
> the implication of their law is very clear. Well, it's certainly not this: > anyone in the EU is not even allowed to connect to any website owned by a US company
utopcell 4y ago
Is it illegal for a EU citizen to access google.com ?
WastingMyTime89 4y ago
> Also, since the EU considers an IP address to be PII As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII. I think you might be confused about the implications the German ruling has because you are from a common law country. One court ruling something doesn’t make it the law in Europe.
- buzer 4y ago
  > As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII. CJEU ruled back in 2016 that IP address is personal data if provider has legal means to identify the person. This includes, as example that was given in the case, laws that give means for service provider to identify the users in the case of cyber attack by requesting help from other authorities. This ruling is from before GDPR and relates to the older Data Protection Directive, but the relevant chapters are largely same (GDPR mostly increased the explicit scope). Ruling: https://curia.europa.eu/juris/document/document.jsf?docid=184668&mode=req&pageIndex=1&dir=&occ=first&part=1&text=&doclang=EN&cid=2713657 https://curia.europa.eu/juris/document/document.jsf?docid=18... The "tl;dr" parts are 30 (the question) & 47-49. The old directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
BlueTemplar 4y ago
This reminds me of people saying that downloading YouTube videos is illegal... even though they need to make them freely available and you need to download them to your hard drive and make copies into RAM and/or VRAM to watch them in the first place. (Note also that YouTube does not actually use a streaming protocol, but replicates some features of streaming protocols like bitrate adaptation by downloading by chunks over HTTP(S).) ---- Also maybe how VLC is illegal to use as is in countries enforcing the DMCA or MPEG licenses : https://wiki.videolan.org/Frequently_Asked_Questions/#What_about_personal.2Fcommercial_usage.3F https://wiki.videolan.org/Frequently_Asked_Questions/#What_a...
deleted 4y ago
[deleted]
einpoklum 4y ago
> since the EU considers an IP address to be PII How can an IP address _not_ be PII? NIST defines [1] PII as: "Information that can be used to distinguish or trace an individual’s identity ... either alone or when combined with other personal or identifying information..." So it's not some EU caprice. [1] : https://csrc.nist.gov/glossary/term/personally_identifiable_information https://csrc.nist.gov/glossary/term/personally_identifiable_...
- Gabezmilk 4y ago
  See "non-deterministic IPs" or "city-wide IPs" (will be the next thing).
openplatypus 4y ago
> Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear. Oh it was. I had this conversation sooo many times. Each time response was: everyone is doing it, we will just wait and see :facepalm:

by tensor 4y ago

vidarh 4y ago

People in the EU can disclose their own PII to whomever they want, including far more sensitive details than IP addresses, so this isn't an issue. The limitations are on the parties capturing the data, not on the person whose data it is.

johannes1234321 4y ago

> anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?

ksidudwbw 4y ago
Just don't be creepy, that's all.
- gameman144 4y ago
  "Don't be creepy" isn't the law as -written, and is super nebulous to comply with.
wizeman 4y ago
> These laws don't bind individual citizens, but companies offering services. Right. EU companies whose websites are accessed by individual citizens and usually have assets stored by US companies, such as CDNs.

__m 4y ago

People are free to give away their PII

tzmudzin 4y ago
… but the receiver needs to provide evidence of consent
mminer237 4y ago
How do you collect consent from people before you receive their IP addresses?
- shukantpal 4y ago
  Them giving their IP address is consent. If I put a dollar bill in your hand, I can come around a year later and ask for it back since I didn't "consent" explicitly.
  - roywiggins 4y ago
    When I load a website I have no idea what third-party assets are being loaded in or from where, and have no meaningful information ahead of time to know what I'm actually consenting to by typing "example.com" into the URL bar. Obviously, my IP will be sent to example.com, and I've arguably consented to that, but not to all the other third-party stuff that example.com might have loaded the page up with. (this is also the argument around cookie consent: yes, the browser chooses to accept the cookie. users don't really get an opportunity to refuse them, though. So "the browser accepted the cookies" is not sufficient consent, as far as the EU is concerned)
bradleybuda 4y ago
Not in the EU

andy_ppp 4y ago

I thought it was the storage of such data that is illegal not the connection? Obviously logs and analytics are an issue in some cases for this law, but I slightly agree with it; should we not all want our digital footprint to be as small as possible?

__alexs 4y ago
How long does your TCP connection need to be open for until it becomes "logs"? The law doesn't care what format that this information is stored in.
- deleted 4y ago
  [deleted]
- andy_ppp 4y ago
  Maybe I’m getting confused with GDPR, anyway I think interpretation of these laws that the stop the internet from working completely is usually incorrect in my experience.
  - j16sdiz 4y ago
    This is the golden rule of Statutory Interpretation
mminer237 4y ago
No, courts have made it clear that sending EU IP addresses to the US is illegal unless you can prove that the US government can't intercept it or someday force you to log them. No one the US is immune to subpeona, so no one can comply with that requirement. https://www.cnil.fr/sites/default/files/atoms/files/decision_ordering_to_comply_anonymised_-_google_analytics.pdf#page=8 https://www.cnil.fr/sites/default/files/atoms/files/decision...
- ronsor 4y ago
  I don't think it's that strict, otherwise the court is mandating something that is literally impossible with current internet (routing) architecture.

erinnh 4y ago

Its not about the connection. You can connect to the website. But the website shouldnt save the IP address for anything other than technical relevant purposes. Ie. logs should be ok if its to combat DDOS and the like (for a limited time, ie 24h), but not for advertising purposes.

sveme 4y ago

It‘s not that simple (actually untrue): https://bluecatnetworks.com/blog/is-an-ip-address-pii-the-answer-is-nuanced/ https://bluecatnetworks.com/blog/is-an-ip-address-pii-the-an...

tiborsaas 4y ago

Don't spread FUD please. > anyone in the EU is not even allowed to connect to any website owned by a US company This is blatantly false, of course you are allowed to connect to non-EU websites even if the IP address could be PII in some circumstances. It's the service providers problem to manage the data they collect in legal way.

nisegami 4y ago
There _is_ no legal way to manage that data if the service provider is subject to the CLOUD act.
- tiborsaas 4y ago
  There is an option for a service provider not to store the IP address anywhere. For users with accounts the standard ToS can handle it.
  - blahyawnblah 4y ago
    Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.
    - jamie_ca 4y ago
      Hash the IP so you can tie sessions, and do frequency analysis for abuse, without having the raw IP that can be geo-decoded?
      - throwaway2016a 4y ago
        Hashing IPs is ineffective, the IP namespace is so small a rainbow table (or even brute force) would be trivial so effectively the hash of an I is identical to the IP itself. Unless you salt it but if you do that it becomes useless for analytical, fraud prevention, and security purposes. Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.

lock-the-spock 4y ago

This is not at all correct. Technically necessary use is fully legal under gdpr.

tensor 4y ago
I don't think it's legal to send PII to the US under any circumstances. The technically necessary clause works fine only in non-US jurisdictions.

maxboone 4y ago

I'd say that's reasonable use

geofft 4y ago

Honestly, I think if the GDPR had been around before HTTP, we would have seen HTTP as the unreasonable part in this system. You don't have to make a direct TCP/IP connection for two people to communicate. We had systems like Usenet and UUCP that replicated data through a series of servers. Even today, when you use email, you talk to your email provider who talks to the recipient's email provider, and they have no need to share your personal IP addresses in the process. Some providers used to include this in Received: headers, but many today do not, rightly seeing it as a privacy concern. And even on HTTP we had (and still have, in some cases) mirrors, where legally-unrelated entities host copies of each others' data. Someone in the EU can visit http://ftp.icm.edu.pl/pub/linux/Documentation/ http://ftp.icm.edu.pl/pub/linux/Documentation/ and never have their connection known to the US-juridiction host of TLDP. It is both socially sensible for these providers to consent to sharing their own infrastructure IP addresses with other providers (but not share their customers' IP addresses) and legally practical for them to make that consent under the GDPR. Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? I don't want that information. I don't even get that information when using higher-level services like Hacker News or Twitter or GitHub, even though those services operate over HTTP. It's weird that I get it, honestly. I understand there's a huge planetary investment in HTTP, and so the collision of abstractly-reasonable privacy rights with that reality is an extremely hard engineering and policy problem. But that doesn't make the privacy rights unreasonable.

rootusrootus 4y ago
> Why should it be the case that when you visit my personal website, which I happen to self-host, I have access to your IP address? So when you misbehave, I have the means to block you in particular.
- geofft 4y ago
  My personal website is a publicly-accessible static site. Blocking people from it is not meaningful. It might be meaningful under the model of direct HTTP, where you could be DoSing me or trying to exploit my web server. But if you don't contact me over HTTP, then that problem doesn't arise. There's no meaningful concept of blocking people from a Usenet post I write. Even for indirect HTTP, I don't need to block people from my GitHub Pages or from my HN comments. They're public. If I add dynamic feature like a comment system or discussion forum to my website, then it becomes meaningful, but also at that point I can implement a way for you to consent to sharing your IP address with me as part of signing up.

3np 4y ago

> the implication of their law is very clear. Well, it's certainly not this: > anyone in the EU is not even allowed to connect to any website owned by a US company

utopcell 4y ago

Is it illegal for a EU citizen to access google.com ?

WastingMyTime89 4y ago

> Also, since the EU considers an IP address to be PII As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII. I think you might be confused about the implications the German ruling has because you are from a common law country. One court ruling something doesn’t make it the law in Europe.

buzer 4y ago
> As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII. CJEU ruled back in 2016 that IP address is personal data if provider has legal means to identify the person. This includes, as example that was given in the case, laws that give means for service provider to identify the users in the case of cyber attack by requesting help from other authorities. This ruling is from before GDPR and relates to the older Data Protection Directive, but the relevant chapters are largely same (GDPR mostly increased the explicit scope). Ruling: https://curia.europa.eu/juris/document/document.jsf?docid=184668&mode=req&pageIndex=1&dir=&occ=first&part=1&text=&doclang=EN&cid=2713657 https://curia.europa.eu/juris/document/document.jsf?docid=18... The "tl;dr" parts are 30 (the question) & 47-49. The old directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

BlueTemplar 4y ago

This reminds me of people saying that downloading YouTube videos is illegal... even though they need to make them freely available and you need to download them to your hard drive and make copies into RAM and/or VRAM to watch them in the first place. (Note also that YouTube does not actually use a streaming protocol, but replicates some features of streaming protocols like bitrate adaptation by downloading by chunks over HTTP(S).) ---- Also maybe how VLC is illegal to use as is in countries enforcing the DMCA or MPEG licenses : https://wiki.videolan.org/Frequently_Asked_Questions/#What_about_personal.2Fcommercial_usage.3F https://wiki.videolan.org/Frequently_Asked_Questions/#What_a...

deleted 4y ago

[deleted]

einpoklum 4y ago

> since the EU considers an IP address to be PII How can an IP address _not_ be PII? NIST defines [1] PII as: "Information that can be used to distinguish or trace an individual’s identity ... either alone or when combined with other personal or identifying information..." So it's not some EU caprice. [1] : https://csrc.nist.gov/glossary/term/personally_identifiable_information https://csrc.nist.gov/glossary/term/personally_identifiable_...

Gabezmilk 4y ago
See "non-deterministic IPs" or "city-wide IPs" (will be the next thing).

openplatypus 4y ago

> Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear. Oh it was. I had this conversation sooo many times. Each time response was: everyone is doing it, we will just wait and see :facepalm: