Comment by bad_user | Hacker News Reader

Comment by bad_user | Hacker News Reader

Parent Full thread

> I think that currently pretty much every service, device and website violates the GDPR.

Not really, my website doesn't :-)

In case you're using Google Analytics, it's easy to make it compliant, you just activate IP anonymization, which you had to do anyway, out of common sense and because tracking by IP without consent was illegal anyway in countries like Germany.

[1] https://support.google.com/analytics/answer/2763052

[2] https://developers.google.com/analytics/devguides/collection...

> When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads.

Yes, I saw this behavior too, but I like to think that many businesses are not as unscrupulous. But I do take care of my privacy as an ongoing investment ... I'm Google free, I sandbox Facebook, I use privacy blockers, VPN, the works.

GDPR is IMO a godsend. I'm sure the cost will be high for many companies, but that's just karma.

That GA feature does NOT provide any useful anonymity, and I doubt it meet the requirements of the GDPR.

re the aip=1 feature: https://news.ycombinator.com/item?id=17167346

why masking the least interesting byte isn't anonymous: https://news.ycombinator.com/item?id=17170468

> I'm sure the cost will be high for many companies, but that's just karma.

What about for companies that do handle user data responsibly, but have trouble with the formal compliance costs?

If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries, Australia, etc and GDPR compliance shouldn't cost anything.

There's also no such thing as responsible data handling for services tracking users without their consent. If no explicit consent was given, consent obtained with a layman explanation and with no dark patterns, then it shouldn't be legal.

The problem often isn't how the data ends up being used, the problem is that the data is collected in the first place.

Not sure what your question is. If they handle data responsibly they're already compliant, no? In which case what compliance costs do such companies face?

Mostly, I think GDPR makes reasonable requests for how you obtain, handle, store and use personal data. I think that the compliance cost for a company already doing ‘the right thing’ should be relatively low.

(Argument hinges on the idea that GDPR does overreach in what it asks to be compliant, happy to be proven wrong)

If you want to "handle user data" in any way but can't afford the formal compliance costs, then one less company is hoovering up user data. I don't see the problem.

Reply on news.ycombinator.com