Hacker News Reader

Comment by surfmike | Hacker News Reader

What does not collecting too much data mean in practice? It seems a lot of analytics would be in the grey area, esp. when trying doing reverse geo lookups. A more simple example: can I use Apache which gathers people's IP addresses, browser info, referring links if I don't necessarily know how I'll use it?

View on HN

An example: I have a website and I don't need to know the IP addresses, browser info or referrer urls of visiting User Agents. So allowing Apache to log that information would be "collecting too much data".

Thus, Apache is configured with the following LogFormat[0] which associates an explicit format[1] with a nickname (here, "essential"):-

    LogFormat "%{%FT%T%z}t \"%r\" %>s %B %D %L" essential

and in VirtualHost contexts, a CustomLog[2]:-

    CustomLog ${APACHE_LOG_DIR}/access.log essential

[0]: https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#lo...

[1]: https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#fo...

[2]: https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#cu...

You can get in trouble in the EU if you log IP addresses without explicit consent:

https://www.eff.org/deeplinks/2010/06/european-officials-goo...

Interesting, so basically everyone running web servers with default settings is breaking the law.

Which leads us to the unfortunate lack of a good "don't provoke avoidable user agreement inflation" manifesto. Perfect hiding place for "agreeing" to the much more nasty stuff.

When you need the data to fulfill your business goal, it is ok (as long as your users know that you collect this type of data).

What we encourage to avoid is "collecting everything, just in case..."

As long as you anonymize things, analytics are fine :)

IP addresses have been ruled to be "personal identifying information" in Europe, which is why Googla analytics offers an option to anonymize the last set of digits.

Reply on news.ycombinator.com