4 ms·

> So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a

> So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a week in the logs to use fail2ban), do they need a "privacy" section? I dont think they do. There are such sites indeed and I havent seen any prompts in them. > so, collecting ips for a week in the logs to use fail2ban IP by solely itself wouldnt constitute 'Personally identifiable information' as far as I know. But Im not sure. > I ask because a privacy section requires a lawyer Not really. Website privacy legal templates already exist and they are pretty standard at this point.

Fire-Dragon-DoL 4y ago
Well the prompt is required only if you have to accept stuff, otherwise a privacy section would be sufficient. IP is considered identifiable information if it's used for some purpose (e.g. statistics for website visits). I'm pretty sure it's considered "legit use" if it's for filtering malicious users. Could you point to some of those standards? I had a customers reaching out and found myself without any idea how to handle that privacy section.
- unity1001 4y ago
  Prompt is necessary to accept/reject in case there is any potential of collecting data. Since you cant collect data if someone does not have an accept button. if you dont collect data, I believe you dont need to disclose it. > IP is considered identifiable information Not at all. IP by itself is meaningless and it just points to a computer or a proxy. Only if you have other information then it starts becoming identifiable. Even in court cases that involve IPs its not enough - the ISP gives the IP to the court, but then the court must find who was the person using that IP at that given point in time in that house, even the person using the computer. > Could you point to some of those standards? You can just google privacy section templates with GDPR keyword. There are a lot of templates as such. WordPress itself provides an easy way to create such templates and it already has GDPR tools built in.
  - Fire-Dragon-DoL 4y ago
    Thank you!

Fire-Dragon-DoL 4y ago

Well the prompt is required only if you have to accept stuff, otherwise a privacy section would be sufficient. IP is considered identifiable information if it's used for some purpose (e.g. statistics for website visits). I'm pretty sure it's considered "legit use" if it's for filtering malicious users. Could you point to some of those standards? I had a customers reaching out and found myself without any idea how to handle that privacy section.

unity1001 4y ago
Prompt is necessary to accept/reject in case there is any potential of collecting data. Since you cant collect data if someone does not have an accept button. if you dont collect data, I believe you dont need to disclose it. > IP is considered identifiable information Not at all. IP by itself is meaningless and it just points to a computer or a proxy. Only if you have other information then it starts becoming identifiable. Even in court cases that involve IPs its not enough - the ISP gives the IP to the court, but then the court must find who was the person using that IP at that given point in time in that house, even the person using the computer. > Could you point to some of those standards? You can just google privacy section templates with GDPR keyword. There are a lot of templates as such. WordPress itself provides an easy way to create such templates and it already has GDPR tools built in.
- Fire-Dragon-DoL 4y ago
  Thank you!