Hacker News Reader

Comment by tjoff | Hacker News Reader

"So I searched trough my websites: Remove Facebook Like Button, Remove analytics, Add privacy statement, Add cookie opt-in/out …. the list goes on."

This is exactly why GDPR is so essential.

Not a single thought about why allowing tracking or the trade offs for others gain had occurred before GDPR.

For a blog GDPR is a non-issue.

Though I'm deeply disappointed in how many large sites have interpreted "opt in" as spending 5 minutes vigorously unchecking boxes with ambiguous meaning, hopefully that will bite them hard.

This isn't rocket science. Yes, if you go out of your way trying to game your users privacy as much as possible then things will get hairy. That's a feature and the whole point.

View on HN

> Though I'm deeply disappointed in how many large sites have interpreted "opt in" as spending 5 minutes vigorously unchecking boxes with ambiguous meaning, hopefully that will bite them hard.

The fun part about that one is actually that the "opt in" by default is a blatant violation of the GDPR when that's supposedly what they're trying to to comply with. If you're in the EU, make sure to file a complaint with your data protection agency (e.g. in the UK that's the ICO, in Germany that's your Landesdatenschutzbehörde).

Yeah, it is surreal.

I'm overly stressed out at the moment but I've encountered a couple of local sites that behave quite bad in this regard. I'll probably try to direct an email to the developers and see what they have to say about that and depending on the answer (or lack thereof) I'll continue with a complaint.

Have you actually tried to read and understand GDPR before getting to this level self-righteousness?

A blog writer wants an easy way of tracking popularity of their posts. Clearly I need a protection from this.

The internet is worse off after GDPR.

And they can have easy ways of tracking popularity. You can use Google Analytics and similar products in compliant ways, and the tools for that have existed for ages (at least in the case of GA).

Except that if you add "login with" button then you are suddenly start processing personal data (even if you only store social media ids).

But you don't just store social media ids.

You seem to misunderstand that you're entering into a partnership with a third party. They become a data processor on your behalf. They process a whole lot more, and you have access to a lot of that data. Fortunately, the social media platform includes the privacy policy and consent process in their onboarding of users, so you don't need to worry about it for the purposes of social login.

You actually need to worry, because ids are personal data.

Eve you abandon all these social media platforms and use emails for login, email addresses are still personal data, and you are still processing it.

If you're using Google Analytics, you're paying for the analytics by letting them abuse your users. You can get some protection by using their anonymisation setting and signing a data protection addendum.

If you really want to be on the safe side and respect your users' privacy, the best choice is self-hosting a free analytics tool like Matomo (formerly Piwik). Of course you still need to make sure your hosting company respects your users' privacy too.

It's literally not the GDPR's fault if you're having problems protecting your users' privacy. It's the network effect of entire ecosystems of companies never having had any concern for privacy over decades. Don't complain to the EU, complain to companies not implementing privacy by default and only trying to shoe-horn it in as an afterthought.

Perfect use case for self-hosted analytics, such as https://usefathom.com

Reply on news.ycombinator.com