4 ms·
Note that IP addresses are personal information, so if you're logging them like this, you'll need to get consent (or have some other legal basis) and also handl
by jonas21 3y ago
Note that IP addresses are personal information, so if you're logging them like this, you'll need to get consent (or have some other legal basis) and also handle deletion requests for EU users. One of the many joys of GDPR compliance.
- woodruffw 3y agoThese logs get rotated out after a week, and fall well within the "purpose limitation" clause of the GDPR.
- dexterdog 3y agoOn a personal blog? Good luck enforcing that. If I host the thing myself and your IP address is reaching into my network to read my blog you have to expectation that I'm not going to record the data if I care to.
- TheRealPomax 3y agoOr, you know, it's a personal blog: you don't, because access request IPs are part of how TCP/IP works (it's literally in the name) and cannot identify a person unless your website has a user management system and logs IPs in tandem with session id activity so that that the IP can be resolved to "a person". This is one of those "if someone wants their IP scrubbed, they can request it, but lol no" situations: for blogs run by regular folks instead of services run by businesses, just pointing to "it's in the GDPR" is not enough. The GDPR gets a LOT of things intentionally wrong so it can go after PII-gathering-so-that-can-be-monetized businesses.
- sitzkrieg 3y agocgnat
- mortallywounded 3y agoI log traffic. I use log rotate with a 30 day rotation. No one can complain because it's gone within a GDPR compliant window of 30 days.