6 ms·

If undisclosed, it is outright illegal in Europe, as the IP address can be mapped to an individual's identity in some typical scenarios.

• cmeacham98 4y ago
  This is a common misconception. IP addresses are only considered PII if you are in the position of being able to decode them to an identity. An anonymous version checking service obviously does not count.
  • davidmurdoch 4y ago
    Playing devils advocate here, but one interpretation of the law is that if any script that obtains the IP addresses could reverse it to an identity, then you are in violation.
    • cmeacham98 4y ago
      Sure, and "one interpretation" of the sky is that it is purple. Or instead of making random interpretations up, we could look at actual cases like Breyer v. Germany, and see how the laws are interpreted in real life.
      • davidmurdoch 4y ago
        And I could interpret your text as Klingon. But that's not reasonable. My interpretation above was reasonable. An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.
        • cmeacham98 4y ago
          Again, as I have said multiple times in this thread existing EU case law has made it clear IPs are only PII if and ONLY if you are able to do the conversion yourself (or give it to someone who can). Storing IPs in your web server logs is for an anonymous version checker is totally ok (as long as you aren't an ISP or someone who can do the conversion). You can make up your own interpretations of the law as much as you want, but in real life the interpretation from the CJEU (for US readers like me, the EU's equivalent of the Supreme Court) is the one that matters.
  • tejado 4y ago
    Sure the IP is PII because you are not allowed to publish it as others could relate the IP to the identity. But as others already said: if you don’t store the IP (eg in logs) it should be fine.
    • cmeacham98 4y ago
      You could store the IPs in logs until the heat death of the universe and it would be fine, as long as you aren't able to translate it to an indentity (or give it to someone who can). The point of my comment is that an IP is only considered PII when possessed by someone who can do the conversion.
• jai_ 4y ago
  No that is not how the GDPR works. It would be illegal specifically if you _collected and stored_ the IP address information from the phone home requests to process in some form later. If you simply process the web request, and don't store the IP address then there it no issue. If you do end up storing IP address in a log somewhere, then simply having the logs deleted in a documented and reasonable timeframe will be enough. "Documented and reasonable timeframe" is intentionally vague since business requirements are varied, but if you can justify whatever you come up with, then there is no issue. Simply do not hold onto user data for longer that what is required for the purposes of the user request. That's it.
• davidmurdoch 4y ago
  It's not "outright illegal", AFAIK. If you can point me to a place that definitely says it is illegal (or not) I'd really appreciate it! From what I've learned about EU regulations, ANY time you have technology that serves an EU citizen there is the potential for you to be sued over potential violations of the intentionally overreaching and vague privacy laws. The EU is so incredibly hostile to small business and FOSS.
  • neoromantique 4y ago
    >The EU is so incredibly hostile to small business and FOSS. It's not EU being hostile, but rather US being incredibly lax(to put it mildly) about privacy issues, so that we even consider these violations a norm.
    • davidmurdoch 4y ago
      Oh, so the EU makes vague laws that hurt the small guy because they are mad at the US?
      • neoromantique 4y ago
        No, the "small guy" should not be entitled to violate privacy and rights of EU citizens (or any people, for that matter), just because US doesn't grant same protections.
        • davidmurdoch 4y ago
          The small guy can't afford to abide by these vague and over-reaching regulations, is my point.
          • neoromantique 4y ago
            It doesn't cost you anything to not collect my PII.