7 ms·

The mistake here in Europe is that an ip address is considered personal information: https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-google-web-font

by TekMol 3y ago

The mistake here in Europe is that an ip address is considered personal information: https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-google-web-fonts-ist-dsgvo/ https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-g... This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal. This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider. So in Europe, the whole internet is made illegal based on a wrong assumption.

jdsnape 3y ago
That is not quite completely true - In many cases you can associate it to a user based on their activity too. For example, they might logon which would link the IP to an identity.
- janosett 3y ago
  Yes, but the IP itself is not personal without the connection to other information. I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses.
  - BaseballPhysics 3y ago
    > Yes, but the IP itself is not personal without the connection to other information. By this argument, isn't the same true of a physical home address? > I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses. Except that isn't strictly "the common case". DHCP leases are often for long-ish periods of time on fixed line broadband services. The IP for my home router, for example, has been the same for weeks or months at a time.
  - daveoc64 3y ago
    The concept of being able to identify individuals by combining data sources is a key part of GDPR. If you can look up a user account by IP address, then the IP address is personal data.
  - jeroenhd 3y ago
    All the residential IPv4 addresses have been the same for years, until I switched ISP or moved. Ever since I've lived alone that IP address 100% maps back to me as a person, and I'm not the only person in Europe living on my own. Pretending this situation doesn't exist and forms a privacy risk would be madness. There's nothing wrong with receiving IP addresses on your website, though. You can log IP addresses and use them for detecting fraud and other kinds of abuse without requiring consent. Third parties can do the same, as long as they follow the law and as long as you clearly document what information you're sharing/making users share in your privacy policy. You can't use personal information for tracking and ad purposes without consent, though, and you can't partner up with other companies that do it for you. It doesn't matter if you're tracking IP addresses, cookies, passive fingerprints, or some kind of supercookie; you need a legitimate reason or explicit consent to process that kind of information.
dutchbrit 3y ago
> This is bad, because the IP can only be turned into personal information via cooperation of the users internet provider. Not 100% true, you can often trace back users by IP using leaked databases and through companies that sell user data. Might not be legal, but you definitely don't need cooperation from a ISP.
- zpeti 3y ago
  You might be able to trace an IP back to a user, but you're absolutely not guaranteed that that IP was only used by that particular user. Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then?
  - msm_ 3y ago
    > Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then? ISP knows exactly who used IP at that point in time (they are even obliged by law to log them). Therefore IP from which a request was sent can be used to uniquely identify the device, with 100% certainty. Therefore it is (usually) a personal information.
  - prepend 3y ago
    I don’t think the goal is to find a single IP for a crime or something. In that case, law enforcement just subpoenas and they’ll sort out the thousands using the IP to the actual person (possible with ISP participation). I don’t think it’s insane because the more common use is just to pattern match to identify the individuals. While lots of people may share, many do not (eg, everyone in my home shared an external IP but that is frequently just one person). Google can use this IP and browser traffic to separate out individuals (eg, I don’t watch YouTube and my kid never checks vanguard) to the level they convince advertisers that they know the individual. I expect this is why my kindergartner sees ads for car insurance.
- ericpauley 3y ago
  In that case the database is the PII, not the IP.
red_trumpet 3y ago
> So in Europe, the whole internet is made illegal based on a wrong assumption. No, just websites which include components hosted by third parties. This is not the whole internet (e.g. HN doesn't include third party components).
- TekMol 3y ago
  Use the search function on the bottom of HN. It is provided by a different company. HN is also hosted by a different company. They get your IP too.
  - LelouBil 3y ago
    > Use the search function on the bottom of HN. It is provided by a different company. HN doesn't communicate my IP to this service. > HN is also hosted by a different company. They get your IP too. If they store my IP, they should treat it as PII to be compliant
  - whstl 3y ago
    What they do with the IP matters. Using your IP address to serve the website, or even to do fraud/DDOS prevention, is perfectly fine.
  - zyx321 3y ago
    Yes, and companies doing business in the EU may only use GDPR-compliant hosting. All European providers as well as major international provider like AWS [1] have compliance statements. The EU companies are more likely to take it seriously, e.g. Hetzner only logs the first three segments of your IP (i.e 24bit IPv4 or 48bit IPv6). Every other EU-based provider I've used at least offers it as an option. If you run your own server, there are nginx and apache modules [2] that anonymize your logs. It's real. We're 100% serious. [1] https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf [2] https://www.supertechcrew.com/anonymizing-logs-nginx-apache/ https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
yonixw 3y ago
I was wondering about it too, but I guess that for some customers in rural places (everywhere big like USA an EU) IP address is as good as home address. Combine it with some providers that will not change your IP until manually requested (and not until router restart) and you have a real PII on your hand.
- kalleboo 3y ago
  I used to live somewhere where the reverse-DNS for my IP was literally my home address (student housing network)
sfg 3y ago
If there was a proxy service that acted as an ip mask, and there was a list of the ip addresses of such masking proxies, then could EU customers using such services solve the issue?
- cccbbbaaa 3y ago
  Yes, this is what the Cnil suggests for people that want to use Google Analytics.
- jansan 3y ago
  Yes, but making stuff illegal is much easier than being inventive.
jdietrich 3y ago
>This makes it impossible to use any components hosted by third parties without getting consent by the users. There are six lawful grounds for processing personal data under GDPR; only one of those grounds is consent. Consent is not always necessary, nor is it always sufficient. An IP address is potentially personal data, because it could relate to a natural living person. There are all sorts of legitimate reasons to use that data without consent, the most obvious being to fulfil a request by the user. You will run into issues if you're using that data in ways that aren't strictly necessary - keeping logs indefinitely, using that data for marketing purposes, sharing that data with third parties without good reason and without adequate safeguards etc. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- TekMol 3y ago
  Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request. As they did in the judgement I linked to. A judge can always claim you could have used a local version of whatever external resource you used.
  - olivierduval 3y ago
    Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving. YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
  - jdietrich 3y ago
    A judge can say anything they like, but that doesn't mean it'll be upheld at appeal. If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care. I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
that_guy_iain 3y ago
> This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal. This is based on some very faulty knowledge of GDPR and the law. You are allowed to process data without the consent of the user for various things. This would include their IP address. You're allowed to have third party data processors process data on your behalf without user consent for various things. The Google Font ruling was partially due to who Google is. Google data mines, they're famous for it. So giving Google data they can use to map to your internet persona which may even be linked to your name directly is obviously something many people want to do only when they consent. The fact Google Fonts could be self hosted was another part of the reason for the ruling. That is, sharing the information wasn't required to be able to perform what the actions they wanted to perform, use a font. Data processing done by US companies is not currently GDPR compliant. However, no one is enforcing that. It would be a complete mess and there are far too many. In reality, everyone is ignoring it waiting for the new laws to be created to make it legal. The reason the US companies are an issue is a US court can issue a judgement to a US company and they are forced to comply no matter where the data is. > This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider. This is also not true. If you visit a website that sells B2B accounting software and your IP is identifiable to a company. You could phone up the company and ask to talk to the person who is responsible for finance. If there is only one person, boom easily identifed. There are also various other ways. > So in Europe, the whole internet is made illegal based on a wrong assumption. Really, your comment is wrong based on multiple wrong assumptions.
jacquesm 3y ago
> 'So in Europe, the whole internet is made illegal based on a wrong assumption.' Is based on a wrong assumption.
Semaphor 3y ago
It should be mentioned that we don’t have case law the same way the US does. So one court deciding this does not mean that this is now law.
y7 3y ago
Indeed, the GDPR defines "personal information" as (Article 4 sub 1) > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; This is not out of step with reality nor a wrong assumption, it is simply a definition. It is motivated somewhat in the considerations of the GDPR. > (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
prepend 3y ago
> The IP can only be turned into personal information via cooperation of the users internet provider. It’s not a direct identifier but with geo-ip or other data, it can identify an individual (eg, have 100 possibilities and geoip narrows it down to only 1 in that region based on IP). The PII aspect isn’t based on getting a link from the provider. The PII aspect is based on the IP itself standing out in data and allowing reidentification. It’s not 100% accurate, but accurate enough to make money off advertising.
- smeagull 3y ago
  They're not stable in time either. And they can be misleading if you try to use them to geolocate a user. The ARIN for my IPs makes me appear 500km away.
- tremon 3y ago
  It’s not a direct identifier Except when it is. I have a semi-permanent home IP (it only changes when the MAC address on my router changes and I get assigned a new lease) and only one user in my home. My IP address pretty uniquely identifies me.
  - tredre3 3y ago
    Most cable modem users in north america are in the same situation. And small shops usually have a business package with a static IP too. I don't understand the point keyboard warriors who insist IP doesn't identify a person and IP isn't PII are trying to make. Are they just being pedantic? Because yes, often an IP is shared. Yes, obviously the legal system shouldn't assume a IP equals a person. That would be very problematic. But when it comes to mere tracking, an IP can absolutely identify directly a person. So why not just treat it as such all the time? What's the downside of considering IP to be PII?
RobotToaster 3y ago
>This makes it impossible to use any components hosted by third parties without getting consent by the users. Good. There's very few legitimate uses for third party hosted proprietary components. Why it became standard to load simple things like scripts or fonts from third parties, that can be trivially hosted locally, is beyond me.
- jansan 3y ago
  So hosting an ad is now illegitimate? How about embedding a video? And why should you not embed stuff from a CDN?
  - pph 3y ago
    It is not a problem to load a static (not changing based on user data) ad from your own server. Using a CDN is likely legitimate interest when it is not using private data for other reasons than serving the content. (I'm not a lawyer.)
    - jansan 3y ago
      THat would require small companies having to implement their own Ad business. Sorry, your idea is cute, but completely unrealistic.
  - mcpackieh 3y ago
    Ads (particularly ads served by third parties) have never been legitimate, that's why most users who know what they're about use an adblocker to stop them. Videos should only be embedded once the user consents to that (which could be implemented using a first-party button that the user clicks to affirm their consent and which then loads the third party video component.
    - smeagull 3y ago
      > Ads (particularly ads served by third parties) have never been legitimate That's a very extreme take. They're how many services actually exist. Also, consent to an embedded video? My brother in Christ, your browser requested the video.
mk89 3y ago
As a European, I don't consider this a mistake, for the simple reason that the IP address is so easily abused by trackers and people with bad intentions - the extent of abuse that we have experienced until now is absolutely ridiculous. Hell, even a small startup with a few thousand euros can start to track and trace user behaviour on a massive scale that in reality you wouldn't or shouldn't be able to do. The tooling (free, cheap and not) at our disposal nowadays makes everything so easy that even something that in theory should not serve as identifier can be used to identify you - so let's start with the most common ones: IP, email, etc. The Internet in Europe is not illegal - it's just pure BS that a simple page like reuters.com contains references to 14 external scripts when loaded, when actually all you need is 2 maybe 3 scripts (the CDN to load images and videos + the page itself) - the rest is crap used explicitly to identify and market people - that's it: Ads, Ads and probably uglier things to do just to profile people online.
- smeagull 3y ago
  IP isn't personal, isn't unique, and isn't identifying.
  - theshrike79 3y ago
    The point of the law is that anything that can be easily (technically easily, not contractually or legally) combined with another database to make the first bit of data PII - then it's PII. An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
    - smeagull 3y ago
      So anything is PII. > An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time. Not even then.
- jansan 3y ago
  As another European I consider this a grave mistake and I am not surprised that we do not see many successful startups in Europe. It is part of the narrow-minded micro managing mindset that too many European politicians (especially the greens) have. Instead of finding an innovative solution (how about mandating ISPs to make IP addresses unmappable to a user?) they only know one solution: Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.
mcpackieh 3y ago
> This makes it impossible to use any components hosted by third parties without getting consent by the users. Sounds good to me, that's the way it should be. I shouldn't have to use third party extensions to stop my browser from automatically loading facebook crap every time I visit websites that aren't facebook. Companies should only include 3rd party components in their websites if there is a very good reason for it, and only then after the user has explicitly consented to it.
martin_a 3y ago
> This makes it impossible to use any components hosted by third parties without getting consent by the users. That is simply not true, please do not spread misinformation like this. Using/Embedding third-party resources is allowed IF it is e.g. technically necessary to provide the service or core functionality at all. Collecting personal information and using a third-party service to do so in a shop checkout? That's okay. Collecting personal information and shoving everything into Google Analytics because you want to know how many people visited your site? Not so okay, there are less intrusive ways to do that.

by TekMol 3y ago

jdsnape 3y ago

That is not quite completely true - In many cases you can associate it to a user based on their activity too. For example, they might logon which would link the IP to an identity.

janosett 3y ago
Yes, but the IP itself is not personal without the connection to other information. I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses.
- BaseballPhysics 3y ago
  > Yes, but the IP itself is not personal without the connection to other information. By this argument, isn't the same true of a physical home address? > I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses. Except that isn't strictly "the common case". DHCP leases are often for long-ish periods of time on fixed line broadband services. The IP for my home router, for example, has been the same for weeks or months at a time.
- daveoc64 3y ago
  The concept of being able to identify individuals by combining data sources is a key part of GDPR. If you can look up a user account by IP address, then the IP address is personal data.
- jeroenhd 3y ago
  All the residential IPv4 addresses have been the same for years, until I switched ISP or moved. Ever since I've lived alone that IP address 100% maps back to me as a person, and I'm not the only person in Europe living on my own. Pretending this situation doesn't exist and forms a privacy risk would be madness. There's nothing wrong with receiving IP addresses on your website, though. You can log IP addresses and use them for detecting fraud and other kinds of abuse without requiring consent. Third parties can do the same, as long as they follow the law and as long as you clearly document what information you're sharing/making users share in your privacy policy. You can't use personal information for tracking and ad purposes without consent, though, and you can't partner up with other companies that do it for you. It doesn't matter if you're tracking IP addresses, cookies, passive fingerprints, or some kind of supercookie; you need a legitimate reason or explicit consent to process that kind of information.

dutchbrit 3y ago

> This is bad, because the IP can only be turned into personal information via cooperation of the users internet provider. Not 100% true, you can often trace back users by IP using leaked databases and through companies that sell user data. Might not be legal, but you definitely don't need cooperation from a ISP.

zpeti 3y ago
You might be able to trace an IP back to a user, but you're absolutely not guaranteed that that IP was only used by that particular user. Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then?
- msm_ 3y ago
  > Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then? ISP knows exactly who used IP at that point in time (they are even obliged by law to log them). Therefore IP from which a request was sent can be used to uniquely identify the device, with 100% certainty. Therefore it is (usually) a personal information.
- prepend 3y ago
  I don’t think the goal is to find a single IP for a crime or something. In that case, law enforcement just subpoenas and they’ll sort out the thousands using the IP to the actual person (possible with ISP participation). I don’t think it’s insane because the more common use is just to pattern match to identify the individuals. While lots of people may share, many do not (eg, everyone in my home shared an external IP but that is frequently just one person). Google can use this IP and browser traffic to separate out individuals (eg, I don’t watch YouTube and my kid never checks vanguard) to the level they convince advertisers that they know the individual. I expect this is why my kindergartner sees ads for car insurance.
ericpauley 3y ago
In that case the database is the PII, not the IP.

red_trumpet 3y ago

> So in Europe, the whole internet is made illegal based on a wrong assumption. No, just websites which include components hosted by third parties. This is not the whole internet (e.g. HN doesn't include third party components).

TekMol 3y ago
Use the search function on the bottom of HN. It is provided by a different company. HN is also hosted by a different company. They get your IP too.
- LelouBil 3y ago
  > Use the search function on the bottom of HN. It is provided by a different company. HN doesn't communicate my IP to this service. > HN is also hosted by a different company. They get your IP too. If they store my IP, they should treat it as PII to be compliant
- whstl 3y ago
  What they do with the IP matters. Using your IP address to serve the website, or even to do fraud/DDOS prevention, is perfectly fine.
- zyx321 3y ago
  Yes, and companies doing business in the EU may only use GDPR-compliant hosting. All European providers as well as major international provider like AWS [1] have compliance statements. The EU companies are more likely to take it seriously, e.g. Hetzner only logs the first three segments of your IP (i.e 24bit IPv4 or 48bit IPv6). Every other EU-based provider I've used at least offers it as an option. If you run your own server, there are nginx and apache modules [2] that anonymize your logs. It's real. We're 100% serious. [1] https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf [2] https://www.supertechcrew.com/anonymizing-logs-nginx-apache/ https://www.supertechcrew.com/anonymizing-logs-nginx-apache/

yonixw 3y ago

I was wondering about it too, but I guess that for some customers in rural places (everywhere big like USA an EU) IP address is as good as home address. Combine it with some providers that will not change your IP until manually requested (and not until router restart) and you have a real PII on your hand.

kalleboo 3y ago
I used to live somewhere where the reverse-DNS for my IP was literally my home address (student housing network)

sfg 3y ago

If there was a proxy service that acted as an ip mask, and there was a list of the ip addresses of such masking proxies, then could EU customers using such services solve the issue?

cccbbbaaa 3y ago
Yes, this is what the Cnil suggests for people that want to use Google Analytics.
jansan 3y ago
Yes, but making stuff illegal is much easier than being inventive.

jdietrich 3y ago

>This makes it impossible to use any components hosted by third parties without getting consent by the users. There are six lawful grounds for processing personal data under GDPR; only one of those grounds is consent. Consent is not always necessary, nor is it always sufficient. An IP address is potentially personal data, because it could relate to a natural living person. There are all sorts of legitimate reasons to use that data without consent, the most obvious being to fulfil a request by the user. You will run into issues if you're using that data in ways that aren't strictly necessary - keeping logs indefinitely, using that data for marketing purposes, sharing that data with third parties without good reason and without adequate safeguards etc. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

TekMol 3y ago
Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request. As they did in the judgement I linked to. A judge can always claim you could have used a local version of whatever external resource you used.
- olivierduval 3y ago
  Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving. YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
- jdietrich 3y ago
  A judge can say anything they like, but that doesn't mean it'll be upheld at appeal. If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care. I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.

that_guy_iain 3y ago

> This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal. This is based on some very faulty knowledge of GDPR and the law. You are allowed to process data without the consent of the user for various things. This would include their IP address. You're allowed to have third party data processors process data on your behalf without user consent for various things. The Google Font ruling was partially due to who Google is. Google data mines, they're famous for it. So giving Google data they can use to map to your internet persona which may even be linked to your name directly is obviously something many people want to do only when they consent. The fact Google Fonts could be self hosted was another part of the reason for the ruling. That is, sharing the information wasn't required to be able to perform what the actions they wanted to perform, use a font. Data processing done by US companies is not currently GDPR compliant. However, no one is enforcing that. It would be a complete mess and there are far too many. In reality, everyone is ignoring it waiting for the new laws to be created to make it legal. The reason the US companies are an issue is a US court can issue a judgement to a US company and they are forced to comply no matter where the data is. > This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider. This is also not true. If you visit a website that sells B2B accounting software and your IP is identifiable to a company. You could phone up the company and ask to talk to the person who is responsible for finance. If there is only one person, boom easily identifed. There are also various other ways. > So in Europe, the whole internet is made illegal based on a wrong assumption. Really, your comment is wrong based on multiple wrong assumptions.

jacquesm 3y ago

> 'So in Europe, the whole internet is made illegal based on a wrong assumption.' Is based on a wrong assumption.

Semaphor 3y ago

It should be mentioned that we don’t have case law the same way the US does. So one court deciding this does not mean that this is now law.

y7 3y ago

Indeed, the GDPR defines "personal information" as (Article 4 sub 1) > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; This is not out of step with reality nor a wrong assumption, it is simply a definition. It is motivated somewhat in the considerations of the GDPR. > (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

prepend 3y ago

> The IP can only be turned into personal information via cooperation of the users internet provider. It’s not a direct identifier but with geo-ip or other data, it can identify an individual (eg, have 100 possibilities and geoip narrows it down to only 1 in that region based on IP). The PII aspect isn’t based on getting a link from the provider. The PII aspect is based on the IP itself standing out in data and allowing reidentification. It’s not 100% accurate, but accurate enough to make money off advertising.

smeagull 3y ago
They're not stable in time either. And they can be misleading if you try to use them to geolocate a user. The ARIN for my IPs makes me appear 500km away.
tremon 3y ago
It’s not a direct identifier Except when it is. I have a semi-permanent home IP (it only changes when the MAC address on my router changes and I get assigned a new lease) and only one user in my home. My IP address pretty uniquely identifies me.
- tredre3 3y ago
  Most cable modem users in north america are in the same situation. And small shops usually have a business package with a static IP too. I don't understand the point keyboard warriors who insist IP doesn't identify a person and IP isn't PII are trying to make. Are they just being pedantic? Because yes, often an IP is shared. Yes, obviously the legal system shouldn't assume a IP equals a person. That would be very problematic. But when it comes to mere tracking, an IP can absolutely identify directly a person. So why not just treat it as such all the time? What's the downside of considering IP to be PII?

RobotToaster 3y ago

>This makes it impossible to use any components hosted by third parties without getting consent by the users. Good. There's very few legitimate uses for third party hosted proprietary components. Why it became standard to load simple things like scripts or fonts from third parties, that can be trivially hosted locally, is beyond me.

jansan 3y ago
So hosting an ad is now illegitimate? How about embedding a video? And why should you not embed stuff from a CDN?
- pph 3y ago
  It is not a problem to load a static (not changing based on user data) ad from your own server. Using a CDN is likely legitimate interest when it is not using private data for other reasons than serving the content. (I'm not a lawyer.)
  - jansan 3y ago
    THat would require small companies having to implement their own Ad business. Sorry, your idea is cute, but completely unrealistic.
- mcpackieh 3y ago
  Ads (particularly ads served by third parties) have never been legitimate, that's why most users who know what they're about use an adblocker to stop them. Videos should only be embedded once the user consents to that (which could be implemented using a first-party button that the user clicks to affirm their consent and which then loads the third party video component.
  - smeagull 3y ago
    > Ads (particularly ads served by third parties) have never been legitimate That's a very extreme take. They're how many services actually exist. Also, consent to an embedded video? My brother in Christ, your browser requested the video.

mk89 3y ago

As a European, I don't consider this a mistake, for the simple reason that the IP address is so easily abused by trackers and people with bad intentions - the extent of abuse that we have experienced until now is absolutely ridiculous. Hell, even a small startup with a few thousand euros can start to track and trace user behaviour on a massive scale that in reality you wouldn't or shouldn't be able to do. The tooling (free, cheap and not) at our disposal nowadays makes everything so easy that even something that in theory should not serve as identifier can be used to identify you - so let's start with the most common ones: IP, email, etc. The Internet in Europe is not illegal - it's just pure BS that a simple page like reuters.com contains references to 14 external scripts when loaded, when actually all you need is 2 maybe 3 scripts (the CDN to load images and videos + the page itself) - the rest is crap used explicitly to identify and market people - that's it: Ads, Ads and probably uglier things to do just to profile people online.

smeagull 3y ago
IP isn't personal, isn't unique, and isn't identifying.
- theshrike79 3y ago
  The point of the law is that anything that can be easily (technically easily, not contractually or legally) combined with another database to make the first bit of data PII - then it's PII. An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
  - smeagull 3y ago
    So anything is PII. > An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time. Not even then.
jansan 3y ago
As another European I consider this a grave mistake and I am not surprised that we do not see many successful startups in Europe. It is part of the narrow-minded micro managing mindset that too many European politicians (especially the greens) have. Instead of finding an innovative solution (how about mandating ISPs to make IP addresses unmappable to a user?) they only know one solution: Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.

mcpackieh 3y ago

> This makes it impossible to use any components hosted by third parties without getting consent by the users. Sounds good to me, that's the way it should be. I shouldn't have to use third party extensions to stop my browser from automatically loading facebook crap every time I visit websites that aren't facebook. Companies should only include 3rd party components in their websites if there is a very good reason for it, and only then after the user has explicitly consented to it.

martin_a 3y ago

> This makes it impossible to use any components hosted by third parties without getting consent by the users. That is simply not true, please do not spread misinformation like this. Using/Embedding third-party resources is allowed IF it is e.g. technically necessary to provide the service or core functionality at all. Collecting personal information and using a third-party service to do so in a shop checkout? That's okay. Collecting personal information and shoving everything into Google Analytics because you want to know how many people visited your site? Not so okay, there are less intrusive ways to do that.