4 ms·

I'm being a bit snarky, but maybe the better way involves not tracking people to death.

• shagie 2y ago
  Under the GDPR, an IP address is PII and recording the IP address of a visitor can be problematic. https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include: Internet protocol (IP) addresses; cookie identifiers; and other identifiers such as radio frequency identification (RFID) tags. These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.
  • p_l 2y ago
    The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!). A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest. Worst case you have to mention it in privacy policy. The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.