4 ms·

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

by Hamuko 3y ago

rhn_mk1 3y ago
GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.
- Hamuko 3y ago
  The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.
konha 3y ago
> Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.
jgrahamc 3y ago
See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/
- jacooper 3y ago
  I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.
  - jacooper 3y ago
    Found it*
happymellon 3y ago
GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR. GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.
- pelasaco 3y ago
  > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.
  - happymellon 3y ago
    You say "or" but then just give examples of what I said. > law infringement implications They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation". Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.
    - pelasaco 3y ago
      yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches. > You say "or" but then just give examples of what I said. > law infringement implications No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.
- SahAssar 3y ago
  > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal. The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.
openplatypus 3y ago
Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.
- jhpacker 3y ago
  Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it. One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.
  - openplatypus 3y ago
    As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data. You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data. As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA. https://medium.com/@christhaefner/shopify-illegal-in-germany-4b7f61576aa3 https://medium.com/@christhaefner/shopify-illegal-in-germany...
dolmen 3y ago
If data about EU citizen goes outside EU, it is illegal.

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

by Hamuko 3y ago

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

rhn_mk1 3y ago

GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.

Hamuko 3y ago
The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.

konha 3y ago

> Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.

jgrahamc 3y ago

See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/

jacooper 3y ago
I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.
- jacooper 3y ago
  Found it*

happymellon 3y ago

GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR. GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

pelasaco 3y ago
> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.
- happymellon 3y ago
  You say "or" but then just give examples of what I said. > law infringement implications They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation". Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.
  - pelasaco 3y ago
    yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches. > You say "or" but then just give examples of what I said. > law infringement implications No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.
SahAssar 3y ago
> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal. The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.

openplatypus 3y ago

Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.

jhpacker 3y ago
Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it. One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.
- openplatypus 3y ago
  As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data. You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data. As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA. https://medium.com/@christhaefner/shopify-illegal-in-germany-4b7f61576aa3 https://medium.com/@christhaefner/shopify-illegal-in-germany...

dolmen 3y ago

If data about EU citizen goes outside EU, it is illegal.