7 ms·

“GDPR compliant” analytics is probably violating GDPR

75 points by amadeuspagel 3y ago

welder 3y ago
Are you held liable by using them if they "lied" to you about being compliant?
- randunel 3y ago
  The beauty of GDPR is that it clearly distinguishes between a "data processor" and a "data controller". Services such as cloud computing providers, including databases used to store data, are merely data processors. You, the contracting party, would be the data controller, held liable for anything that happens with the data. On the other hand, you have a business relationship with your services provider, and you're free to hold them accountable to any claims in the contract. In my experience, however, any liability is capped to some meager amount in the default ToS. To answer your question, you need to clarify what you'd be liable for. When you're the data controller, the answer to your question is almost always yes.
shadowgovt 3y ago
I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box. (The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)
- Nextgrid 3y ago
  The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
  - shadowgovt 3y ago
    Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
    - rrdharan 3y ago
      > If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
      - shadowgovt 3y ago
        Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.
  - spacebanana7 3y ago
    Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.
    - gizmo 3y ago
      And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
      - 3y ago
- superkuh 3y ago
  What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.
  - madeofpalk 3y ago
    WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'. I don't consider it a loss that there's one less place my phone number and address is posted online.
  - chrismorgan 3y ago
    Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.
  - Hitton 3y ago
    This is wrong. Look how whois works on .eu domain.
- gizmo 3y ago
  Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.
  - chrismorgan 3y ago
    Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
    - gizmo 3y ago
      I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
    - orangecat 3y ago
      If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
      - account42 3y ago
        Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
fogzen 3y ago
I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
- chrismorgan 3y ago
  ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
  - fogzen 3y ago
    I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.
    - frereubu 3y ago
      In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.
      - fogzen 3y ago
        The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone. What should matter is what’s logged. Every request contains an IP that’s how the web works.
        3y ago
dalben 3y ago
I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always a good mention - just having a legal basis is not enough, you always need to respect these principles (such as lawfulness, fairness and transparency). The dig at pseudonomyzation not being enough is great. It's a personal pet peeve of mine. Pseudonomized data is still personal data! The GDPR does not prescribe how to anonymize data. It just says "as long as someone can identify a person, then it's personal data." For example, you might think that aggregating based on city is enough to anonymize, but my nephew was at one point the sole person living in a village - that would have directly identified him. Likewise, stripping the last octet of IP addresses might not be enough if I personally own a /24. It's all about context. The biggest thing I personally learned, was that any solution claiming to be "GDPR proof" probably is not compliant.
- deleted 3y ago
  [deleted]
- fasteddie 3y ago
  This is one of my pet peeves of GDPR! Your nephew and IP Octet cases are very extreme edge cases that we shouldn't build policy around if there are major drawbacks to including them. It's bad there is ostensibly no compliant way to count anonymized unique users in Europe under the current framework.
  - shkkmo 3y ago
    I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.
    - 3y ago
draw_down 3y ago
[dead]
mcny 3y ago
What I don't understand is how come nobody talks about Microsoft Clarity? I don't know anything about GDPR but I would think if anything violates GDPR, it would be a literal screen recording app that tracks your mouse movements and can show literally where you put your mouse and your moves on the screen. And yet: > Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Statement. https://learn.microsoft.com/en-us/clarity/faq https://learn.microsoft.com/en-us/clarity/faq Is this true?
- legitster 3y ago
  See also CrazyEgg, or HotJar. Although I am not sure why these would violate GDPR. Customer usage data is specifically exempt if it's anonymized.
- brianoconnor 3y ago
  If you use clarity (you are the controller, ms the processor) you are responsible for obtaining the necessary consent from your users. That consent should make it clear to the user what behavioral data is collected. (Commonly referred to as cookie banner).
legitster 3y ago
I think there are a few incorrect logical leaps in here. An identification number is only regulated insofar as it can be used to "identify a natural person". The law is referring to something like driver's license # or customer ID number or username or etc (or, increasingly, an IP address). Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specifically called out several times as fine. In that context, the author is really stretching to claim that any amount of "fingerprinting" is deanonymizing. But there's not a lot of evidence that a fingerprint, no matter how good of one, is in violation of GDPR until it can be tied to a natural* person*.
- pilcrowonpaper 3y ago
  Author here - I've gotten this question a few times now so I'll update the article to better explain it, but "online identifiers" are considered personal data according to Article 4. Recital 30 states: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers (...)" From this, I think we can assume any id connected to a device (and thus user) that can be used re-identify it can be considered personal data, regardless of the time-frame, especially since it mentions "cookie identifiers."
  - legitster 3y ago
    Sure, but you are not quoting the whole recital: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. Just from the phrasing of this recital, it's pretty clear that "unique identifiers and other information received by the server" are not regulated here. Furthermore: Article 4.5: > ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; Again, without the use of additional information is key. Just because it can be de-anonymized doesn't mean that it is. Recital 29: > In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. 2The controller processing the personal data should indicate the authorised persons within the same controller. I have spent a LOT of time with on our GDPR team. And while GDPR is horrendously complex, I don't think anyone on our legal team would support the assertion that GDPR is countermanding itself. Also, notice the phrasing "whilst allowing general analysis" - completely separate from Legitimate Interest, GDPR allows for "general analysis" of pseudoanonymous data.
CaptainNegative 3y ago
This article is incomplete without any mention of strong privacy techniques such as differential privacy. There is a write-up by Cohen and Nissim [1] where they analyze the privacy statutes in the GDPR and derive a formal definition of privacy, which they call Privacy Singling Out, intended to match the text of the document. They then show how PSO compares to other privacy definitions, and in particular that Differential Privacy implies PSO (and thus satisfies GDPR). Differential Privacy, in turn, is basically an entire field on its own, with entire textbooks [2] and workshops [3]. It also dominates many privacy-focused conferences, and has been used by US Census Bureau. There are plenty of truly GDPR-compliant analytics one can do. It just takes some effort to understand how. [1] https://www.pnas.org/doi/10.1073/pnas.1914598117 https://www.pnas.org/doi/10.1073/pnas.1914598117 [2] https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf [3] https://tpdp.journalprivacyconfidentiality.org/2022/ https://tpdp.journalprivacyconfidentiality.org/2022/
donohoe 3y ago
Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely widespread practice and considered necessary. Likewise, storing data on a personal device (like a cookie) is ok if it is necessary for the service to function (as opposed to unnecessary tracking data or non-critical information). Storing data that manages a session, log-in state, shopping cart, dark-mode preference, is ok) Thats just a sample. This person should really consult a lawyer. Reminder: I am not a lawyer.
- chrismorgan 3y ago
  Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security. Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.
- marvinblum 3y ago
  I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address. I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.
  - Janisbtw 3y ago
    I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't. I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database. Reminder: I'm not a lawyer, so this isn't legal advice.
wouldbecouldbe 3y ago
According to local Dutch governments pretty much everything that touches a US server is a violation. Especially Google is extremely GDPR unsafe. But also DigitalOcean is often not allowed. But then Azure is an exception because of some legal mumbo jumbo microsoft convinced them off.
charcircuit 3y ago
The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your consent.
- chrismorgan 3y ago
  > illegal to link to third party sites It’s not. > now every site needs to get your consent No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.
  - charcircuit 3y ago
    >It's not It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed. The referenced lawsuit used a <link> tag, but an <a> tag can result it a browser sending a request too. >No it doesn’t It does if they want to follow the law. >and you will find that you would almost always prefer that they not do it I don't mind companies having analytics using data they have collected from me.
    - chrismorgan 3y ago
      Ah, I take it you’re referring to the Google Fonts case, then? That’s completely different from linking to a third-party site: that’s loading resources from a third-party site. For a hyperlink, any fetching is user-initiated and you’re obviously not on the hook for that. (The one arguable exception is if you explicitly cause prefetch or prerender on, say, link hover. That would then obviously be on you, because you made it happen.) > It does if they want to flow the law. No, they can just not do it. Simplifying very slightly: they’re trying to get your consent precisely because they don’t have to do it, therefore they’re not allowed to without consent. I would also note that the sort of consent they solicit on public websites is practically always for storing stuff on your machine (ePD, from 2002) rather than for processing (GDPR, from 2016). But I lack energy to get further involved in this aspect; suffice it to say that their tracking is basically never in your interests at all, and routinely not even in their direct interests.
nickpp 3y ago
As someone who prefers to focus on the product, post GDPR, here are some technologies which are just safer to not have, even on a non-ad-driven website, unless you like spending time arguing with lawyers and bureaucrats: 1. Analytics 2. Third-party resources 3. CDNs 4. DDOS protection services What else am I missing?
- tpxl 3y ago
  You can do a lot of analytics without touching personal data. Page view counts, countries people visit from (assuming it's low enough granularity (not personally identifiable) and you don't use a third party service), times people visit. All the juicy stuff, really. You can use third-party resources if you self host them (like fonts, images, videos, ...). Not sure about CDNs, but I don't think a global CDN that's GDPR compliant can exist.
zoobab 3y ago
Disable logging and you are done.

75 points by amadeuspagel 3y ago

welder 3y ago

Are you held liable by using them if they "lied" to you about being compliant?

randunel 3y ago
The beauty of GDPR is that it clearly distinguishes between a "data processor" and a "data controller". Services such as cloud computing providers, including databases used to store data, are merely data processors. You, the contracting party, would be the data controller, held liable for anything that happens with the data. On the other hand, you have a business relationship with your services provider, and you're free to hold them accountable to any claims in the contract. In my experience, however, any liability is capped to some meager amount in the default ToS. To answer your question, you need to clarify what you'd be liable for. When you're the data controller, the answer to your question is almost always yes.

shadowgovt 3y ago

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box. (The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)

Nextgrid 3y ago
The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
- shadowgovt 3y ago
  Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
  - rrdharan 3y ago
    > If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
    - shadowgovt 3y ago
      Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.
- spacebanana7 3y ago
  Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.
  - gizmo 3y ago
    And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
    - 3y ago
superkuh 3y ago
What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.
- madeofpalk 3y ago
  WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'. I don't consider it a loss that there's one less place my phone number and address is posted online.
- chrismorgan 3y ago
  Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.
- Hitton 3y ago
  This is wrong. Look how whois works on .eu domain.
gizmo 3y ago
Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.
- chrismorgan 3y ago
  Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
  - gizmo 3y ago
    I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
  - orangecat 3y ago
    If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
    - account42 3y ago
      Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.

fogzen 3y ago

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

chrismorgan 3y ago
ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
- fogzen 3y ago
  I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.
  - frereubu 3y ago
    In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.
    - fogzen 3y ago
      The cookie is the same for all users. There is no value unique to each user. All that is logged is “a visit to this page occurred at X time” and if the request contained the cookie then it is marked “unique”. The cookie value is the same for everyone. What should matter is what’s logged. Every request contains an IP that’s how the web works.
      - 3y ago

dalben 3y ago

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation. From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional. Article 5 (Principles) is always a good mention - just having a legal basis is not enough, you always need to respect these principles (such as lawfulness, fairness and transparency). The dig at pseudonomyzation not being enough is great. It's a personal pet peeve of mine. Pseudonomized data is still personal data! The GDPR does not prescribe how to anonymize data. It just says "as long as someone can identify a person, then it's personal data." For example, you might think that aggregating based on city is enough to anonymize, but my nephew was at one point the sole person living in a village - that would have directly identified him. Likewise, stripping the last octet of IP addresses might not be enough if I personally own a /24. It's all about context. The biggest thing I personally learned, was that any solution claiming to be "GDPR proof" probably is not compliant.

deleted 3y ago
[deleted]
fasteddie 3y ago
This is one of my pet peeves of GDPR! Your nephew and IP Octet cases are very extreme edge cases that we shouldn't build policy around if there are major drawbacks to including them. It's bad there is ostensibly no compliant way to count anonymized unique users in Europe under the current framework.
- shkkmo 3y ago
  I don't think there is any way to reliably count unique users without collecting an inappropriate level o f personal data. Even tracking unique devices requires significantly undermining privacy. This simply isn't data companies should be allowed to collect without meaningful consent.
  - 3y ago

draw_down 3y ago

[dead]

mcny 3y ago

What I don't understand is how come nobody talks about Microsoft Clarity? I don't know anything about GDPR but I would think if anything violates GDPR, it would be a literal screen recording app that tracks your mouse movements and can show literally where you put your mouse and your moves on the screen. And yet: > Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Statement. https://learn.microsoft.com/en-us/clarity/faq https://learn.microsoft.com/en-us/clarity/faq Is this true?

legitster 3y ago
See also CrazyEgg, or HotJar. Although I am not sure why these would violate GDPR. Customer usage data is specifically exempt if it's anonymized.
brianoconnor 3y ago
If you use clarity (you are the controller, ms the processor) you are responsible for obtaining the necessary consent from your users. That consent should make it clear to the user what behavioral data is collected. (Commonly referred to as cookie banner).

legitster 3y ago

I think there are a few incorrect logical leaps in here. An identification number is only regulated insofar as it can be used to "identify a natural person". The law is referring to something like driver's license # or customer ID number or username or etc (or, increasingly, an IP address). Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specifically called out several times as fine. In that context, the author is really stretching to claim that any amount of "fingerprinting" is deanonymizing. But there's not a lot of evidence that a fingerprint, no matter how good of one, is in violation of GDPR until it can be tied to a natural* person*.

pilcrowonpaper 3y ago
Author here - I've gotten this question a few times now so I'll update the article to better explain it, but "online identifiers" are considered personal data according to Article 4. Recital 30 states: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers (...)" From this, I think we can assume any id connected to a device (and thus user) that can be used re-identify it can be considered personal data, regardless of the time-frame, especially since it mentions "cookie identifiers."
- legitster 3y ago
  Sure, but you are not quoting the whole recital: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. Just from the phrasing of this recital, it's pretty clear that "unique identifiers and other information received by the server" are not regulated here. Furthermore: Article 4.5: > ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; Again, without the use of additional information is key. Just because it can be de-anonymized doesn't mean that it is. Recital 29: > In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. 2The controller processing the personal data should indicate the authorised persons within the same controller. I have spent a LOT of time with on our GDPR team. And while GDPR is horrendously complex, I don't think anyone on our legal team would support the assertion that GDPR is countermanding itself. Also, notice the phrasing "whilst allowing general analysis" - completely separate from Legitimate Interest, GDPR allows for "general analysis" of pseudoanonymous data.

CaptainNegative 3y ago

This article is incomplete without any mention of strong privacy techniques such as differential privacy. There is a write-up by Cohen and Nissim [1] where they analyze the privacy statutes in the GDPR and derive a formal definition of privacy, which they call Privacy Singling Out, intended to match the text of the document. They then show how PSO compares to other privacy definitions, and in particular that Differential Privacy implies PSO (and thus satisfies GDPR). Differential Privacy, in turn, is basically an entire field on its own, with entire textbooks [2] and workshops [3]. It also dominates many privacy-focused conferences, and has been used by US Census Bureau. There are plenty of truly GDPR-compliant analytics one can do. It just takes some effort to understand how. [1] https://www.pnas.org/doi/10.1073/pnas.1914598117 https://www.pnas.org/doi/10.1073/pnas.1914598117 [2] https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf [3] https://tpdp.journalprivacyconfidentiality.org/2022/ https://tpdp.journalprivacyconfidentiality.org/2022/

donohoe 3y ago

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely widespread practice and considered necessary. Likewise, storing data on a personal device (like a cookie) is ok if it is necessary for the service to function (as opposed to unnecessary tracking data or non-critical information). Storing data that manages a session, log-in state, shopping cart, dark-mode preference, is ok) Thats just a sample. This person should really consult a lawyer. Reminder: I am not a lawyer.

chrismorgan 3y ago
Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security. Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.
marvinblum 3y ago
I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address. I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.
- Janisbtw 3y ago
  I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't. I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database. Reminder: I'm not a lawyer, so this isn't legal advice.

wouldbecouldbe 3y ago

According to local Dutch governments pretty much everything that touches a US server is a violation. Especially Google is extremely GDPR unsafe. But also DigitalOcean is often not allowed. But then Azure is an exception because of some legal mumbo jumbo microsoft convinced them off.

charcircuit 3y ago

The EU should be blocked from the greater internet until they can fix their laws to be compatible with an open internet. The fact that it is illegal to link to third party sites is ridiculous. I much prefer an internet where sites can freely link to other sites and they can freely do analytics to improve their services. Having to get consent has made the web annoying to use because now every site needs to get your consent.

chrismorgan 3y ago
> illegal to link to third party sites It’s not. > now every site needs to get your consent No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.
- charcircuit 3y ago
  >It's not It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed. The referenced lawsuit used a <link> tag, but an <a> tag can result it a browser sending a request too. >No it doesn’t It does if they want to follow the law. >and you will find that you would almost always prefer that they not do it I don't mind companies having analytics using data they have collected from me.
  - chrismorgan 3y ago
    Ah, I take it you’re referring to the Google Fonts case, then? That’s completely different from linking to a third-party site: that’s loading resources from a third-party site. For a hyperlink, any fetching is user-initiated and you’re obviously not on the hook for that. (The one arguable exception is if you explicitly cause prefetch or prerender on, say, link hover. That would then obviously be on you, because you made it happen.) > It does if they want to flow the law. No, they can just not do it. Simplifying very slightly: they’re trying to get your consent precisely because they don’t have to do it, therefore they’re not allowed to without consent. I would also note that the sort of consent they solicit on public websites is practically always for storing stuff on your machine (ePD, from 2002) rather than for processing (GDPR, from 2016). But I lack energy to get further involved in this aspect; suffice it to say that their tracking is basically never in your interests at all, and routinely not even in their direct interests.

nickpp 3y ago

As someone who prefers to focus on the product, post GDPR, here are some technologies which are just safer to not have, even on a non-ad-driven website, unless you like spending time arguing with lawyers and bureaucrats: 1. Analytics 2. Third-party resources 3. CDNs 4. DDOS protection services What else am I missing?

tpxl 3y ago
You can do a lot of analytics without touching personal data. Page view counts, countries people visit from (assuming it's low enough granularity (not personally identifiable) and you don't use a third party service), times people visit. All the juicy stuff, really. You can use third-party resources if you self host them (like fonts, images, videos, ...). Not sure about CDNs, but I don't think a global CDN that's GDPR compliant can exist.

zoobab 3y ago

Disable logging and you are done.