> the magic link shouldn't directly take you to the thing, but rather be an interstitial, so that security vetting prefetch can be managed The magic link is ta

> the magic link shouldn't directly take you to the thing, but rather be an interstitial, so that security vetting prefetch can be managed The magic link is taking you to a website that requires you to click to activate the link's token. MSFT is not only crawling all links on the page, but also clicking all elements with a click handler. It's necessary to add a recaptcha, but the problem stays the same: taking a secret that was not addressed to you doesn't allow you to access, process, and store the PII that you can find with that secret. > I don't see how this is a GDPR violation. Crawling the data and evaluting security or malware issues doesn't fall under GDPR. Saving the content would... ‘processing’ means any operation (...) whether or not by automated means, such as (...) retrieval, storage, (...), use, (...) or destruction [https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/] Microsoft retrieves the data, stores it (temporarily), uses it and deletes it (from memory). So all of these actions are subject to GDPR. The data cannot be deemed "publicly available", according to https://iapp.org/news/a/publicly-available-data-under-gdpr-main-considerations/ https://iapp.org/news/a/publicly-available-data-under-gdpr-m... > Also not clear why the magiclink doesn't work. Just because MSFT used it to crawl, why can't the user also use it later? The magic link contains a ~40 byte long token that is valid for a couple of minutes, just like an OTP.