4 ms·

As a European, I don't consider this a mistake, for the simple reason that the IP address is so easily abused by trackers and people with bad intentions - the e

by mk89 3y ago

As a European, I don't consider this a mistake, for the simple reason that the IP address is so easily abused by trackers and people with bad intentions - the extent of abuse that we have experienced until now is absolutely ridiculous. Hell, even a small startup with a few thousand euros can start to track and trace user behaviour on a massive scale that in reality you wouldn't or shouldn't be able to do. The tooling (free, cheap and not) at our disposal nowadays makes everything so easy that even something that in theory should not serve as identifier can be used to identify you - so let's start with the most common ones: IP, email, etc. The Internet in Europe is not illegal - it's just pure BS that a simple page like reuters.com contains references to 14 external scripts when loaded, when actually all you need is 2 maybe 3 scripts (the CDN to load images and videos + the page itself) - the rest is crap used explicitly to identify and market people - that's it: Ads, Ads and probably uglier things to do just to profile people online.

smeagull 3y ago
IP isn't personal, isn't unique, and isn't identifying.
- theshrike79 3y ago
  The point of the law is that anything that can be easily (technically easily, not contractually or legally) combined with another database to make the first bit of data PII - then it's PII. An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
  - smeagull 3y ago
    So anything is PII. > An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time. Not even then.
jansan 3y ago
As another European I consider this a grave mistake and I am not surprised that we do not see many successful startups in Europe. It is part of the narrow-minded micro managing mindset that too many European politicians (especially the greens) have. Instead of finding an innovative solution (how about mandating ISPs to make IP addresses unmappable to a user?) they only know one solution: Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.
- makeitdouble 3y ago
  > how about mandating ISPs to make IP addresses unmappable to a user? I can't see how this would work in practice: you'd still have the same IP when visiting site A where your real identity is known, and site B where you didn't give them consent to access your information. The only reasonable course of action is to classify your IP as an identifying info, as site A and B exchanging info would result in your exposure (or site A and B being the same site, but you logged as different users...) Perhaps your point was on giving user different IPs for every site, potentially for every request, but then the consequences would have to be handled worldwide.
  - jansan 3y ago
    Well, let's just take a look at the most benign case where a site owner was sued and convicted by simply using Google Fonts without any bad intentions and without selling or transfering any other data to Google. To Google your IP address will be worthless unless they get any link to your identity, so it solved those really simple cases where site owners accidentially violate the GDPR without any bad intentions and have to fear being sues by some random idiot in court.
    - makeitdouble 3y ago
      I see it from two angles: - on the benign intent and accidental violation: is it natural to go load fonts from a third party service in the first place ? I get why we arrived at this point, but hosting yourself the base resources you're using for your site shouldn't feel like some huge burden or leap from the norm. If we really see a shared benefit to having fonts on some common platform, I'd also wish it wasn't Google. Perhaps Cloudflare or Fastly ? - on IP being worthless to Google: is the "unless they get any link to your identity" even hypothetical ? I am a paying Google customer and extensively use their service. And we all do to some extent; trying the "let me live my daily life but block and avoid anything that touches Google" game would still be as critically punishing today as it was 4 or 5 years ago.

by mk89 3y ago

smeagull 3y ago

IP isn't personal, isn't unique, and isn't identifying.

theshrike79 3y ago
The point of the law is that anything that can be easily (technically easily, not contractually or legally) combined with another database to make the first bit of data PII - then it's PII. An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
- smeagull 3y ago
  So anything is PII. > An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time. Not even then.

jansan 3y ago

As another European I consider this a grave mistake and I am not surprised that we do not see many successful startups in Europe. It is part of the narrow-minded micro managing mindset that too many European politicians (especially the greens) have. Instead of finding an innovative solution (how about mandating ISPs to make IP addresses unmappable to a user?) they only know one solution: Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.

makeitdouble 3y ago
> how about mandating ISPs to make IP addresses unmappable to a user? I can't see how this would work in practice: you'd still have the same IP when visiting site A where your real identity is known, and site B where you didn't give them consent to access your information. The only reasonable course of action is to classify your IP as an identifying info, as site A and B exchanging info would result in your exposure (or site A and B being the same site, but you logged as different users...) Perhaps your point was on giving user different IPs for every site, potentially for every request, but then the consequences would have to be handled worldwide.
- jansan 3y ago
  Well, let's just take a look at the most benign case where a site owner was sued and convicted by simply using Google Fonts without any bad intentions and without selling or transfering any other data to Google. To Google your IP address will be worthless unless they get any link to your identity, so it solved those really simple cases where site owners accidentially violate the GDPR without any bad intentions and have to fear being sues by some random idiot in court.
  - makeitdouble 3y ago
    I see it from two angles: - on the benign intent and accidental violation: is it natural to go load fonts from a third party service in the first place ? I get why we arrived at this point, but hosting yourself the base resources you're using for your site shouldn't feel like some huge burden or leap from the norm. If we really see a shared benefit to having fonts on some common platform, I'd also wish it wasn't Google. Perhaps Cloudflare or Fastly ? - on IP being worthless to Google: is the "unless they get any link to your identity" even hypothetical ? I am a paying Google customer and extensively use their service. And we all do to some extent; trying the "let me live my daily life but block and avoid anything that touches Google" game would still be as critically punishing today as it was 4 or 5 years ago.