7 ms·

Good approach. IP Addresses are personal data. So the data and the hash is subject to GDPR. You still need consent to collect it - well or some other kind of l

Good approach. IP Addresses are personal data. So the data and the hash is subject to GDPR. You still need consent to collect it - well or some other kind of legal shenanigans. The intent is to track a person, it is not technically necessary. You might have a legitimate interest - but in the end you still have to consider the GDPR to use this tool. https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers...

aspect0545 2y ago
What’s your thought on the approach adjust.com takes? They say you can claim legitimate interest
omnimus 2y ago
Turns out that many officials believe this is fine. Companies using Plausible, Matomo and similar services have been under scrutiny. IP adress is required for site to function - your server cant not collect it. Plausible also only processes it for uniqueness and doesnt save it as is. Interestingly most webservers/firewalls will have to keep track of ip adresses so they will be saved in acess logs and caches. Making them more problematic than Plausible. Yet its most likely fine because the intent is not to track individual users but to improve service/keep it runing. Plausible intent is also not track individual users but collect visitor counts which is something used for improving service too. I think you might be prematurely spreading fear.
- JimDabell 2y ago
  > Turns out that many officials believe this is fine. Who has gone on record with this, and in which jurisdictions?
  - omnimus 2y ago
    I have experience from state funded projects from central european countries. Afaik what they battle/hate most is what goes against the spirit of the law. So mainly popups that are hyperdesigned to be confusing so people are forced or tricked or annoyed thus accepting everything. Another thing they battle is how long data is saved and where the data is shared. If you self host service like plausible or matomo that do everything thats possible to be compliant then it's fine. I think there is marketing tactic ad/analytics companies and marketers use against services like Plausible. They say these services also require cookie popup and wont give you as much detailed info so why would you use them. Most websites would be fine with limited data Plausible provides but it breaks ad/analytics industry business plan.
    - number6 2y ago
      I can understand your frustration regarding these tactics. Other services should outright be banned.
- number6 2y ago
  > Plausible also only processes it for uniqueness and doesnt save it as is That's exactly the point. Processing of personal data to identify a unique person. Regarding firewalls and logs: It's argued that this is legitimate interest as it is stated in Recital 49 of the GDPR. So they got a free pass, for the better or worth. > I think you might be permanently spreading fear Don't get me wrong, I like the approach. But it's not a get out of GDPR free card.
  - janosdebugs 2y ago
    Legitimate interest still requires the data subject to be informed under Art 13. Not sure how that would be accomplished without at least an info banner. (This goes for server logs too.)
    - number6 2y ago
      If you have a website you have to write this in your Privacy Policy and most do. Firewalls are a curious case. It is argued that the data is not collected but transmitted to the controller. Almost as if you get a letter with personal data and now have to deal with it. Yes, it's a stretch. Not happy with it but I don't see any practical solution either...
      - janosd 2y ago
        AFAIK it's not enough to write it in your privacy policy. Art 21 of the GDPR makes this explicit: > (4) At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. I am not a lawyer, but as far as I can tell, there is no legal way to collect PII (including IP address) or place tracking identifiers on the user's device without at least informing the user explicitly under the GDPR and the ePrivacy Directive.
        number6 2y ago
        You are correct. In early days of the GDPR people thought about a page in front of the original page without any data collection presenting only the privacy information. But soon there was an agreement that Art 13 lit. 4 could be interpreted that as long as you don't have any data collection beyond server logs this would be deemed as sufficient. Or in other words if you won't invoke the Art 21 lit. 1 of the GDPR. But since everybody wants to track you on basis of their legitimate interest the web became full of cookie banners
dgroshev 2y ago
That's a bit simplistic. IP addresses are not unequivocally personal data. Let's rewind back a bit, GDPR Art. 4: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; IP addresses only allow to identify a natural person when combined with other data, such as ISP data or a profile built over dozens of websites. This is not the same kind of personal data as a name + address, Breyer notwithstanding (note the bit about the ISP in the judgment). GDPR is not about identifying an abstract entity, it's about identifying a natural person. Doing the former for long enough/with enough data allows the latter, but especially with time-limited in-memory hashes that's a non-existent window of opportunity. In practice this'd probably need to be resolved in court, and I'm sure not a single SME using Plausible or similar will even get a stern letter, much less fined.
- number6 2y ago
  > In practice this'd probably need to be resolved in court, and I'm sure not a single SME using Plausible or similar will even get a stern letter, much less fined. Agreed. Plausible just makes false claims like: > All the site measurement is carried out absolutely anonymously. Cookies are not used and no personal data is collected. There are no persistent identifiers. That's a heavy statement and it is simply not true, as you quoted: > an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person hash(daily_salt + website_domain + ip_address + user_agent) will fall under this definition. But again, you are right, better then anything any other service does
  - Dylan16807 2y ago
    Which part is simply not true? The lack of persistence is one of the main design points. If you're saying it's collection, that gets complicated because that data has to be there for the server to work at all.

aspect0545 2y ago

What’s your thought on the approach adjust.com takes? They say you can claim legitimate interest

omnimus 2y ago

Turns out that many officials believe this is fine. Companies using Plausible, Matomo and similar services have been under scrutiny. IP adress is required for site to function - your server cant not collect it. Plausible also only processes it for uniqueness and doesnt save it as is. Interestingly most webservers/firewalls will have to keep track of ip adresses so they will be saved in acess logs and caches. Making them more problematic than Plausible. Yet its most likely fine because the intent is not to track individual users but to improve service/keep it runing. Plausible intent is also not track individual users but collect visitor counts which is something used for improving service too. I think you might be prematurely spreading fear.

JimDabell 2y ago
> Turns out that many officials believe this is fine. Who has gone on record with this, and in which jurisdictions?
- omnimus 2y ago
  I have experience from state funded projects from central european countries. Afaik what they battle/hate most is what goes against the spirit of the law. So mainly popups that are hyperdesigned to be confusing so people are forced or tricked or annoyed thus accepting everything. Another thing they battle is how long data is saved and where the data is shared. If you self host service like plausible or matomo that do everything thats possible to be compliant then it's fine. I think there is marketing tactic ad/analytics companies and marketers use against services like Plausible. They say these services also require cookie popup and wont give you as much detailed info so why would you use them. Most websites would be fine with limited data Plausible provides but it breaks ad/analytics industry business plan.
  - number6 2y ago
    I can understand your frustration regarding these tactics. Other services should outright be banned.
number6 2y ago
> Plausible also only processes it for uniqueness and doesnt save it as is That's exactly the point. Processing of personal data to identify a unique person. Regarding firewalls and logs: It's argued that this is legitimate interest as it is stated in Recital 49 of the GDPR. So they got a free pass, for the better or worth. > I think you might be permanently spreading fear Don't get me wrong, I like the approach. But it's not a get out of GDPR free card.
- janosdebugs 2y ago
  Legitimate interest still requires the data subject to be informed under Art 13. Not sure how that would be accomplished without at least an info banner. (This goes for server logs too.)
  - number6 2y ago
    If you have a website you have to write this in your Privacy Policy and most do. Firewalls are a curious case. It is argued that the data is not collected but transmitted to the controller. Almost as if you get a letter with personal data and now have to deal with it. Yes, it's a stretch. Not happy with it but I don't see any practical solution either...
    - janosd 2y ago
      AFAIK it's not enough to write it in your privacy policy. Art 21 of the GDPR makes this explicit: > (4) At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. I am not a lawyer, but as far as I can tell, there is no legal way to collect PII (including IP address) or place tracking identifiers on the user's device without at least informing the user explicitly under the GDPR and the ePrivacy Directive.
      - number6 2y ago
        You are correct. In early days of the GDPR people thought about a page in front of the original page without any data collection presenting only the privacy information. But soon there was an agreement that Art 13 lit. 4 could be interpreted that as long as you don't have any data collection beyond server logs this would be deemed as sufficient. Or in other words if you won't invoke the Art 21 lit. 1 of the GDPR. But since everybody wants to track you on basis of their legitimate interest the web became full of cookie banners

dgroshev 2y ago

That's a bit simplistic. IP addresses are not unequivocally personal data. Let's rewind back a bit, GDPR Art. 4: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; IP addresses only allow to identify a natural person when combined with other data, such as ISP data or a profile built over dozens of websites. This is not the same kind of personal data as a name + address, Breyer notwithstanding (note the bit about the ISP in the judgment). GDPR is not about identifying an abstract entity, it's about identifying a natural person. Doing the former for long enough/with enough data allows the latter, but especially with time-limited in-memory hashes that's a non-existent window of opportunity. In practice this'd probably need to be resolved in court, and I'm sure not a single SME using Plausible or similar will even get a stern letter, much less fined.

number6 2y ago
> In practice this'd probably need to be resolved in court, and I'm sure not a single SME using Plausible or similar will even get a stern letter, much less fined. Agreed. Plausible just makes false claims like: > All the site measurement is carried out absolutely anonymously. Cookies are not used and no personal data is collected. There are no persistent identifiers. That's a heavy statement and it is simply not true, as you quoted: > an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person hash(daily_salt + website_domain + ip_address + user_agent) will fall under this definition. But again, you are right, better then anything any other service does
- Dylan16807 2y ago
  Which part is simply not true? The lack of persistence is one of the main design points. If you're saying it's collection, that gets complicated because that data has to be there for the server to work at all.