4 ms·

Please explain why this isn’t compliant?

bpfrh 4y ago
Because the GDPR isn't about any specific technology, but concerns any processing of personal data: https://gdpr.eu/what-is-gdpr/ https://gdpr.eu/what-is-gdpr/ Edit: Huh, I stand corrected I don't know if this would count as personal data.
- eurasiantiger 4y ago
  Storing a cache header is not an issue, but if it is used as a unique identifier for user analytics purposes, it is almost certainly personally identifying information, at least after combining with other data. Since they are not disclosing that they store something they use to ID users, it is likely a GDPR violation, at least in spirit, and that spirit is exactly what GDPR seeks to control.
  - bonestamp2 4y ago
    > after combining with other data The post says that they don't combine datapoints because that would negate privacy.
    - eurasiantiger 4y ago
      They don’t but anyone using their service could.
  - ATsch 4y ago
    It is personal data regardless of how it is used. The only question is if that use of personal data is permissive. Using it for user analytics, which is neither required to run the service, nor in the users interest, nor reasonably expected by the user, is almost definitly illegitimate use.
jahewson 4y ago
See my reply to b34r. In addition assigning users into “anonymous” cohorts is a similar principle to FLoC which is likely not GDPR compliant https://searchengineland.com/googles-current-floc-tests-arent-gdpr-compliant-347168 https://searchengineland.com/googles-current-floc-tests-aren...
- dahfizz 4y ago
  > Processing personal data to generate the cohort assignment without the proper consent could also be a violation Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though?
  - eganist 4y ago
    > Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though? Quoting the European commission: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data." I'd hazard a guess that it's the second part under which the EC might find this to be within scope.
    - dahfizz 4y ago
      If I gave you a list of all the last-modified headers from a day, how would you use that information to identify a person?
  - ATsch 4y ago
    The definition of personal data under the GDPR is anything that can be used to uniquely identify a natural person (with sufficiently high probability). Both cookies and date-modified meet that definition identically, as do IP addresses. That doesn't mean you can't use it at all. It just places strong restrictions on what purpodes you can use it for. The important point is just that those restrictions are the same under GDPR for all of these technologies. It doesn't matter how you uniquely identify users, what matters is what you do with that information.
whartung 4y ago
Arguably this can become personally identifiable, much like a persons height of 7 feet becomes personally identifiable. How many 7 foot people live in Elko Nevada? (I have no idea, perhaps there's an entire colony of them.) But most very tall people, well, stand out. "You're that tall guy from Elko!" Early on, it's not personally identifiable. No doubt there can be a lot of folks visiting the site only 10 times and never again. But as someone continues to visit, they begin to narrow down who they are to "You're that guy that comes in here every day with a yellow hat". They may not "know" who you are but, they "know" who you are. Eventually, there may be that one person that has the highest hit rate, who always stands out.
- Spivak 4y ago
  > You're that guy that comes in here every day with a yellow hat Yes but you have absolutely nothing at all to associate that back to a person. Where are you going to find the data "personal information of some kind of the people who visit your site a lot?" You're not collecting it.
- jefftk 4y ago
  > there may be that one person that has the highest hit rate, who always stands out. They could stop incrementing once they get to 10 (or something that's high but common enough to be shared by 1,000s of people).
erdos4d 4y ago
This is a form of data collection and tracking that is definitely against GDPR unless the user is informed of it and consents to it. As it stands, there is no such notification or consent. IANAL but I strongly suspect will get you fined in the EU.
- pyrolistical 4y ago
  What personal information is being collected here?
  - erdos4d 4y ago
    GDPR doesn't just cover personal info, it also forbids tracking without consent, which includes cookies and other means. This is just a technical trick to track someone sans cookie, so I'm 100% certain they will fine anyone doing it unless they get consent.
    - LegionMammal978 4y ago
      The GDPR is entirely about personal data stored by the processor [0]. In principle, if the tracking is entirely client-side, and never produces any traces in how the client accesses your server, then the GDPR alone has no ability to stop it. (Not to say that it cannot run afoul of other regulations.) If the results of the tracking are somehow sent back to your server, then it most likely becomes personal data subject to the GDPR. [0] https://gdpr-text.com/read/article-1/ https://gdpr-text.com/read/article-1/
XCSme 4y ago
I assume because it stores persistent data on the user's PC without consent (last-modified), just like a cookie.

Because the GDPR isn't about any specific technology, but concerns any processing of personal data: https://gdpr.eu/what-is-gdpr/ https://gdpr.eu/what-is-gdpr/ Edit: Huh, I stand corrected I don't know if this would count as personal data.

eurasiantiger 4y ago
Storing a cache header is not an issue, but if it is used as a unique identifier for user analytics purposes, it is almost certainly personally identifying information, at least after combining with other data. Since they are not disclosing that they store something they use to ID users, it is likely a GDPR violation, at least in spirit, and that spirit is exactly what GDPR seeks to control.
- bonestamp2 4y ago
  > after combining with other data The post says that they don't combine datapoints because that would negate privacy.
  - eurasiantiger 4y ago
    They don’t but anyone using their service could.
- ATsch 4y ago
  It is personal data regardless of how it is used. The only question is if that use of personal data is permissive. Using it for user analytics, which is neither required to run the service, nor in the users interest, nor reasonably expected by the user, is almost definitly illegitimate use.

jahewson 4y ago

See my reply to b34r. In addition assigning users into “anonymous” cohorts is a similar principle to FLoC which is likely not GDPR compliant https://searchengineland.com/googles-current-floc-tests-arent-gdpr-compliant-347168 https://searchengineland.com/googles-current-floc-tests-aren...

dahfizz 4y ago
> Processing personal data to generate the cohort assignment without the proper consent could also be a violation Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though?
- eganist 4y ago
  > Using personal data to assign a cohort counts as using personal data. Duh. The approach described in the article doesn't use any personal data, though? Quoting the European commission: "Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data." I'd hazard a guess that it's the second part under which the EC might find this to be within scope.
  - dahfizz 4y ago
    If I gave you a list of all the last-modified headers from a day, how would you use that information to identify a person?
- ATsch 4y ago
  The definition of personal data under the GDPR is anything that can be used to uniquely identify a natural person (with sufficiently high probability). Both cookies and date-modified meet that definition identically, as do IP addresses. That doesn't mean you can't use it at all. It just places strong restrictions on what purpodes you can use it for. The important point is just that those restrictions are the same under GDPR for all of these technologies. It doesn't matter how you uniquely identify users, what matters is what you do with that information.

whartung 4y ago

Arguably this can become personally identifiable, much like a persons height of 7 feet becomes personally identifiable. How many 7 foot people live in Elko Nevada? (I have no idea, perhaps there's an entire colony of them.) But most very tall people, well, stand out. "You're that tall guy from Elko!" Early on, it's not personally identifiable. No doubt there can be a lot of folks visiting the site only 10 times and never again. But as someone continues to visit, they begin to narrow down who they are to "You're that guy that comes in here every day with a yellow hat". They may not "know" who you are but, they "know" who you are. Eventually, there may be that one person that has the highest hit rate, who always stands out.

Spivak 4y ago
> You're that guy that comes in here every day with a yellow hat Yes but you have absolutely nothing at all to associate that back to a person. Where are you going to find the data "personal information of some kind of the people who visit your site a lot?" You're not collecting it.
jefftk 4y ago
> there may be that one person that has the highest hit rate, who always stands out. They could stop incrementing once they get to 10 (or something that's high but common enough to be shared by 1,000s of people).

erdos4d 4y ago

This is a form of data collection and tracking that is definitely against GDPR unless the user is informed of it and consents to it. As it stands, there is no such notification or consent. IANAL but I strongly suspect will get you fined in the EU.

pyrolistical 4y ago
What personal information is being collected here?
- erdos4d 4y ago
  GDPR doesn't just cover personal info, it also forbids tracking without consent, which includes cookies and other means. This is just a technical trick to track someone sans cookie, so I'm 100% certain they will fine anyone doing it unless they get consent.
  - LegionMammal978 4y ago
    The GDPR is entirely about personal data stored by the processor [0]. In principle, if the tracking is entirely client-side, and never produces any traces in how the client accesses your server, then the GDPR alone has no ability to stop it. (Not to say that it cannot run afoul of other regulations.) If the results of the tracking are somehow sent back to your server, then it most likely becomes personal data subject to the GDPR. [0] https://gdpr-text.com/read/article-1/ https://gdpr-text.com/read/article-1/

XCSme 4y ago

I assume because it stores persistent data on the user's PC without consent (last-modified), just like a cookie.