4 ms·

The documentation states that rybbit does not use cookies and is compliant with the GDPR. The first part is true but, looking at the code (very nice to have it

The documentation states that rybbit does not use cookies and is compliant with the GDPR. The first part is true but, looking at the code (very nice to have it available), the tracking is done by IP address, trading one piece of tracking data for another. I realize that this is probably the only way it could work but it is not clear to me that tracking by IP address (even over a single session and shredding the data once a day) is any better from a GDPR standpoint.

9283409232 1y ago
I deal with GDPR daily and the truth is that GDPR enforcement doesn't understand what is acceptable from a GDPR standpoint and that is likely why they are in the process of revamping it. You can also anonymize data and that is no longer considered personal data under GDPR so it is possible to hash an IP address and that be acceptable.
- Fraaaank 1y ago
  > You can also anonymize data and that is no longer considered personal data under GDPR so it is possible to hash an IP address and that be acceptable. That's not completely true. Recital 26 of GDPR stipulates that > “information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.” Hashing does not meet this threshold. If the same IP address is hashed using the same method, the result will always be the same, meaning it can be matched. Hashing is therefore considered pseudonimization and under GDPR, pseudonymized data is still considered personal data. Moreover, the act of anonymization itself is a form of processing and therefore falls under the scope of GDPR. So even attempting to anonymize personal data doesn't remove GDPR obligations for the anonimyzation itself.
  - robbie-c 1y ago
    Disclaimer: IANAL > If the same IP address is hashed using the same method, the result will always be the same, meaning it can be matched. The way people get around this is by using an ephemeral salt, that is deleted e.g. daily. After enough time has passed, it'd be impossible to reverse the hash as the salt would be lost.
  - rustc 1y ago
    Plausible uses the same algorithm and they have a page written by a lawyer claiming this is GDPR compliant: https://plausible.io/blog/legal-assessment-gdpr-eprivacy https://plausible.io/blog/legal-assessment-gdpr-eprivacy Edit: Found more discussion here: https://github.com/plausible/analytics/discussions/1963#discussioncomment-11918403 https://github.com/plausible/analytics/discussions/1963#disc... > To summarize, I believe the EDPB has made their position very clear on this in their 2023 guidelines: Plausible's fingerprinting is subject to Article 5(3) of the ePD. Plausible has made their position very clear in their blog post, leaning in the other direction. Until this is tried out in court, I don't believe that there will be any definitive answer.
    - jhpacker 1y ago
      Unlike Plausible and Fathom, it looks like Rybbit is NOT salting by default ( (but that it's an option to enable per site: https://www.rybbit.io/docs/enhanced-privacy https://www.rybbit.io/docs/enhanced-privacy). Which is why they can offer retention reporting. This seems incompatible with ePD.
- dkga 1y ago
  So IP is considered personal information?
  - cccbbbaaa 1y ago
    Yes, that is what case C-582/14 concluded.
KronisLV 1y ago
It doesn't have that much in the way of fancy UI, but I found that Matomo allows you to both choose whether to use cookies / IP or maybe to cut off parts of the IP as well: https://matomo.org/faq/general/configure-privacy-settings-in-matomo/ https://matomo.org/faq/general/configure-privacy-settings-in... People seem to occasionally post cool new solutions, though it doesn't seem like Matomo has gotten that much attention, despite being a pretty strong alternative to Google Analytics (I haven't had that many issues while self-hosting it either).
- AJMaxwell 1y ago
  I have been using Matomo along side GA4 for a month now. The amount of useful data coming from Matomo, even anonymized, is more expansive and easier to access than GA4. Plus self-hosting was pretty easy and it keeps the data on our servers, which just feels right.
keerthiko 1y ago
If the IP address is hashed somehow it would no longer be personally identifying while still being unique enough for analytics purposes, correct? Does geographic grouping data depend on the IP address? If so I suppose it would need to be extracted first before hashing the IP, and I wonder how much that weakens the anonymization.
- kevin_thibedeau 1y ago
  You can hash every IPV4 for a rainbow table. Needs some salt.
  - dylan604 1y ago
    Okay, but that doesn't mean the concept is bad.
    - lmkg 1y ago
      Yes it does. If a user can say "here's my IP address, what data do you have on me?" and you can answer that question, then that's personal data under GDPR. It's pseudynomized, but not anonymized, and pseudynomous data is personal data.
      - wizzwizz4 1y ago
        Even if you can't answer that question, if it can be answered, that's still personal data.
        dylan604 1y ago
        What's the minimum size of an operation before the GDPR kicks in? In other words, are all sites governed by GDPR, or are some companies considered too small to be under the GDPR regulations? I know that there are some regulations that get a pass for smaller outfits. I know nothing about GDPR as a European audience is not my target and not kowtowing for them.
wqtz 1y ago
The jury is out on ip address vs GDPR. Hashed IP address is not anonymous, nor is last digit anonymization anonymous. So, let's not bother with it. I can say all IP address are located in earth and someone would be offended because now we are invading their privacy by knowing which planet they are from. GDPR is not clear on IP address or IP address derived metadata. There is no case law for it, nor acceptable methodology and everyone is speculating about what are the consequences of and it is mostly just opinions from IANALs. GDPR is astrology for non-enterprise companies.
- cccbbbaaa 1y ago
  > GDPR is not clear on IP address or IP address derived metadata. There is no case law for it, There is, see C-582/14 which concludes that IP address, even dynamic, are personal data.

9283409232 1y ago

I deal with GDPR daily and the truth is that GDPR enforcement doesn't understand what is acceptable from a GDPR standpoint and that is likely why they are in the process of revamping it. You can also anonymize data and that is no longer considered personal data under GDPR so it is possible to hash an IP address and that be acceptable.

Fraaaank 1y ago
> You can also anonymize data and that is no longer considered personal data under GDPR so it is possible to hash an IP address and that be acceptable. That's not completely true. Recital 26 of GDPR stipulates that > “information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.” Hashing does not meet this threshold. If the same IP address is hashed using the same method, the result will always be the same, meaning it can be matched. Hashing is therefore considered pseudonimization and under GDPR, pseudonymized data is still considered personal data. Moreover, the act of anonymization itself is a form of processing and therefore falls under the scope of GDPR. So even attempting to anonymize personal data doesn't remove GDPR obligations for the anonimyzation itself.
- robbie-c 1y ago
  Disclaimer: IANAL > If the same IP address is hashed using the same method, the result will always be the same, meaning it can be matched. The way people get around this is by using an ephemeral salt, that is deleted e.g. daily. After enough time has passed, it'd be impossible to reverse the hash as the salt would be lost.
- rustc 1y ago
  Plausible uses the same algorithm and they have a page written by a lawyer claiming this is GDPR compliant: https://plausible.io/blog/legal-assessment-gdpr-eprivacy https://plausible.io/blog/legal-assessment-gdpr-eprivacy Edit: Found more discussion here: https://github.com/plausible/analytics/discussions/1963#discussioncomment-11918403 https://github.com/plausible/analytics/discussions/1963#disc... > To summarize, I believe the EDPB has made their position very clear on this in their 2023 guidelines: Plausible's fingerprinting is subject to Article 5(3) of the ePD. Plausible has made their position very clear in their blog post, leaning in the other direction. Until this is tried out in court, I don't believe that there will be any definitive answer.
  - jhpacker 1y ago
    Unlike Plausible and Fathom, it looks like Rybbit is NOT salting by default ( (but that it's an option to enable per site: https://www.rybbit.io/docs/enhanced-privacy https://www.rybbit.io/docs/enhanced-privacy). Which is why they can offer retention reporting. This seems incompatible with ePD.
dkga 1y ago
So IP is considered personal information?
- cccbbbaaa 1y ago
  Yes, that is what case C-582/14 concluded.

KronisLV 1y ago

It doesn't have that much in the way of fancy UI, but I found that Matomo allows you to both choose whether to use cookies / IP or maybe to cut off parts of the IP as well: https://matomo.org/faq/general/configure-privacy-settings-in-matomo/ https://matomo.org/faq/general/configure-privacy-settings-in... People seem to occasionally post cool new solutions, though it doesn't seem like Matomo has gotten that much attention, despite being a pretty strong alternative to Google Analytics (I haven't had that many issues while self-hosting it either).

AJMaxwell 1y ago
I have been using Matomo along side GA4 for a month now. The amount of useful data coming from Matomo, even anonymized, is more expansive and easier to access than GA4. Plus self-hosting was pretty easy and it keeps the data on our servers, which just feels right.

keerthiko 1y ago

If the IP address is hashed somehow it would no longer be personally identifying while still being unique enough for analytics purposes, correct? Does geographic grouping data depend on the IP address? If so I suppose it would need to be extracted first before hashing the IP, and I wonder how much that weakens the anonymization.

kevin_thibedeau 1y ago
You can hash every IPV4 for a rainbow table. Needs some salt.
- dylan604 1y ago
  Okay, but that doesn't mean the concept is bad.
  - lmkg 1y ago
    Yes it does. If a user can say "here's my IP address, what data do you have on me?" and you can answer that question, then that's personal data under GDPR. It's pseudynomized, but not anonymized, and pseudynomous data is personal data.
    - wizzwizz4 1y ago
      Even if you can't answer that question, if it can be answered, that's still personal data.
      - dylan604 1y ago
        What's the minimum size of an operation before the GDPR kicks in? In other words, are all sites governed by GDPR, or are some companies considered too small to be under the GDPR regulations? I know that there are some regulations that get a pass for smaller outfits. I know nothing about GDPR as a European audience is not my target and not kowtowing for them.

wqtz 1y ago

The jury is out on ip address vs GDPR. Hashed IP address is not anonymous, nor is last digit anonymization anonymous. So, let's not bother with it. I can say all IP address are located in earth and someone would be offended because now we are invading their privacy by knowing which planet they are from. GDPR is not clear on IP address or IP address derived metadata. There is no case law for it, nor acceptable methodology and everyone is speculating about what are the consequences of and it is mostly just opinions from IANALs. GDPR is astrology for non-enterprise companies.

cccbbbaaa 1y ago
> GDPR is not clear on IP address or IP address derived metadata. There is no case law for it, There is, see C-582/14 which concludes that IP address, even dynamic, are personal data.