“GDPR compliant” analytics is probably violating GDPR
pilcrow.vercel.app
pilcrow.vercel.app
On the other hand, you have a business relationship with your services provider, and you're free to hold them accountable to any claims in the contract. In my experience, however, any liability is capped to some meager amount in the default ToS.
To answer your question, you need to clarify what you'd be liable for. When you're the data controller, the answer to your question is almost always yes.
It certainly means well but makes a number of jumps that are wrong or untested.
For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely widespread practice and considered necessary.
Likewise, storing data on a personal device (like a cookie) is ok if it is necessary for the service to function (as opposed to unnecessary tracking data or non-critical information). Storing data that manages a session, log-in state, shopping cart, dark-mode preference, is ok)
Thats just a sample.
This person should really consult a lawyer.
Reminder: I am not a lawyer.
If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address.
I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.
"Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't.
I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database.
Reminder: I'm not a lawyer, so this isn't legal advice.
I know the opinion of lawyers about IP addresses. But it's so far from reality that it would break the internet if strictly followed.
"Handling personal data Personal data may not be processed, including its storage and transmission, without a legal basis (Article 6). These legal bases are not applicable to cookies.
Consent: The user has given clear consent for a specific purpose with an affirmative action. Contractual obligation: ‘Contract’ in this case may include terms of service. Legal obligation Vital interests: Saving one’s life. Public task Legitimate interests"
This was in the article, having security logs probably counts as a legitimate interest. Also ISPs giving away your information without your consent and reason is violating the GDPR.
Reminder: I'm not a lawyer, so this isn't legal advice.
IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security.
Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.
I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.
The entire document (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) isn’t short: 54,000 words. But it’s very skimmable so that you can obviously skip quickly over the considerable majority as irrelevant to your situation, and generally pretty easy to read. The parts relevant to the typical developer or business person are actually only a few thousand words of chapters 1–4. I recommend just reading it if it might be relevant to your business, rather than relying on others’ writings about it.
Most of the lawyerly arguments come from people trying to justify bad stuff that they used to get away with but which is clearly contrary to the spirit and generally text of GDPR. (This is my uncharitable description.)
I'm not trying to justify bad stuff.
Even experts in the matter debate about it.
I've been reading about GDPR for weeks and am still not certain I have everything covered to launch my SaaS.
It’s not.
> now every site needs to get your consent
No it doesn’t. You’ve been conned. Look at what they’re trying to get your consent for, and you will find that you would almost always prefer that they not do it.
It is if you are linking to a site hosted in the US because if the browser preloads it you send your IP to a US server which is not allowed.
The referenced lawsuit used a <link> tag, but an <a> tag can result it a browser sending a request too.
>No it doesn’t
It does if they want to follow the law.
>and you will find that you would almost always prefer that they not do it
I don't mind companies having analytics using data they have collected from me.
> It does if they want to flow the law.
No, they can just not do it. Simplifying very slightly: they’re trying to get your consent precisely because they don’t have to do it, therefore they’re not allowed to without consent. I would also note that the sort of consent they solicit on public websites is practically always for storing stuff on your machine (ePD, from 2002) rather than for processing (GDPR, from 2016). But I lack energy to get further involved in this aspect; suffice it to say that their tracking is basically never in your interests at all, and routinely not even in their direct interests.
Which is what browsers can do for link tags. Some browser scan for links on pages and speculatively load them so that if you were to click on them it loads instantly. You as the website author can't prevent this functionality.
>No, they can just not do it
But they want to do it and may have business reasons to do it.
>their tracking is basically never in your interests at all
The tracking likely either improves the service based off analytics which is in my interest or it makes ads more relevant which makes the site more financially viable which is also in my interest if I am gaining value from that site.
Anything like that is user (the browser acting as their agent). You’re obviously not responsible for that. You didn’t ask it to do that automatically, unlike <link rel="stylesheet"> and <script> and the likes.
Things like <link rel="stylesheet">, <script> and <img> are subresources: instructions to the browser to fetch and use the specified resource, so that the page can be rendered properly. As you say, the user agent can choose to ignore these instructions (and text-mode browsers will generally ignore all three of these subresource types), but the page will probably be materially compromised, and the developer placed the subresource there with the expectation that it will be loaded.
A hyperlink is a reference to another page altogether, that it’s up to the user to access if they choose to. It’s not a subresource.
I don't understand why it wasn't immediately obvious to browser vendors that this was going to be how web developers responded to GDPR; and that the browser vendors could/should get ahead of this degradation of the quality of the web-browsing experience by giving the user a way to do GDPR consent at the browser-chrome level by e.g. ticking a box in the browser preferences that will set a request header. (It didn't work for Do Not Track, but Do Not Track is a "request" to a malicious adversary; while "I consent to cookies, so stop prompting me" isn't.)
I can only guess that browser vendors don't like GDPR, and so are avoiding implementing such a GDPR quality-of-life feature in order to ensure that users get just as annoyed by the cookie prompts as they should be, and eventually demand the law be changed.
That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
What should matter is what’s logged. Every request contains an IP that’s how the web works.
https://ec.europa.eu/justice/article-29/documentation/opinio...
The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”.
Interesting. Maybe there is a possibility in the future.
https://digital-strategy.ec.europa.eu/en/library/proposal-re...
https://edpb.europa.eu/sites/default/files/files/file1/edpb_...
... because users absolutely love clicking through those annoying opt-in compliance boxes. So the admin now has the choice of no longer having that data or damaging UX.
The law seems pretty clearly bent on just not letting web admins collect that bedrock baby's-first-metric anymore for European users.
In the cookie case, you can detect a returning visitor by the presence of the cookie, you do not need to assign an unique identifier.
In the hashing case, the hash of the IP and UA counts as PII, at least for the 24 hours while you still have the salt.
NB: this is completely irrelevant except as a mathematical curiosity, because GDPR prohibits any processing of PII (in this case - the fingerprint), not just storing it anywhere, without a legal basis.
Hmm, but using PII in anonymized form is allowed, right? But how do you anonymize PII without processing it?
I use Plausible, which works by hashing IP addresses. Honestly, I disagree with the analysis as given: the claim is that we're assigning a unique ID to each user, but it's really not doing that -- the ID changes, and more than one user may have the same ID.
GDPR is a balancing act, between the rights of the people involved and the desires of data controllers to have useful data. In practice, Plausible presents (at least to my mind) a solution to my legitimate interests with a privacy impact that's suitably minimal for the level of interest I have in the statistics I collect. A cookie is arguably less privacy-preserving, as it has better specificity.
From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional.
Article 5 (Principles) is always a good mention - just having a legal basis is not enough, you always need to respect these principles (such as lawfulness, fairness and transparency).
The dig at pseudonomyzation not being enough is great. It's a personal pet peeve of mine. Pseudonomized data is still personal data!
The GDPR does not prescribe how to anonymize data. It just says "as long as someone can identify a person, then it's personal data." For example, you might think that aggregating based on city is enough to anonymize, but my nephew was at one point the sole person living in a village - that would have directly identified him. Likewise, stripping the last octet of IP addresses might not be enough if I personally own a /24. It's all about context.
The biggest thing I personally learned, was that any solution claiming to be "GDPR proof" probably is not compliant.
This simply isn't data companies should be allowed to collect without meaningful consent.
User visits the site. On the backend, check if their IP+UA is in the bloom filter or not. If not, increase the unique visitor counter and add them to the filter.
Perhaps the filter would need to be preseeded with dummy data to protect the privacy of the first few visitors.
In the first case, it could be argued they still store personally identifiable information (for a limited time, but still). In the second case I think it would be harder to argue the probabilistic data structure with lots of hashes mushed together still constitute personally identifiable information.
> One of the points of the article is that this is non compliant, since you need to transmit the IP+UA to do this calculation to begin with.
IP + UA gets transmitted to the first-party server already. They already have it. The question becomes – is it OK to anonymize this PII we already received for one purpose (serving the web page), to use it for another purpose also (counting unique visitors).
Maybe I'm missing your point, but in the situation we're talking about (so-called "GDPR compliant" analytics), if I set up one of these services on my website, the user's IP+UA are transmitted to a 3rd party, for the sole purpose of analytics including counting unique visitors. My understanding is that this is quite different in the eyes of the GDPR from the question you posed, and is almost always not going to be compliant.
I started researching this last weekend, reading through the GDPR, the ePrivacy Directive, and tons of related court rulings (with the help of Google Translate). 2002/58/EC and EC 2016/679 is engrained into my brain now. I was so nervous releasing to the public, but I breathed a sign of relieve after reading your comment.
1. Analytics
2. Third-party resources
3. CDNs
4. DDOS protection services
What else am I missing?
You can use third-party resources if you self host them (like fonts, images, videos, ...).
Not sure about CDNs, but I don't think a global CDN that's GDPR compliant can exist.
When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box.
(The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)
And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
Yes.
However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
It's how you get war-on-drugs-level legal atrocities.
I don't consider it a loss that there's one less place my phone number and address is posted online.
GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.
(Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.
And yet:
> Clarity is GDPR-compliant as a data controller. For more information, see the Microsoft Privacy Statement.
https://learn.microsoft.com/en-us/clarity/faq
Is this true?
Although I am not sure why these would violate GDPR. Customer usage data is specifically exempt if it's anonymized.
There is a write-up by Cohen and Nissim [1] where they analyze the privacy statutes in the GDPR and derive a formal definition of privacy, which they call Privacy Singling Out, intended to match the text of the document.
They then show how PSO compares to other privacy definitions, and in particular that Differential Privacy implies PSO (and thus satisfies GDPR). Differential Privacy, in turn, is basically an entire field on its own, with entire textbooks [2] and workshops [3]. It also dominates many privacy-focused conferences, and has been used by US Census Bureau.
There are plenty of truly GDPR-compliant analytics one can do. It just takes some effort to understand how.
[1] https://www.pnas.org/doi/10.1073/pnas.1914598117
[2] https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf
Within the spirit of the law, it's okay to say "this is user 1, this is user 2, etc". Pseudo-anonymous data has been specifically called out several times as fine.
In that context, the author is really stretching to claim that any amount of "fingerprinting" is deanonymizing. But there's not a lot of evidence that a fingerprint, no matter how good of one, is in violation of GDPR until it can be tied to a natural* person*.
"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers (...)"
From this, I think we can assume any id connected to a device (and thus user) that can be used re-identify it can be considered personal data, regardless of the time-frame, especially since it mentions "cookie identifiers."
> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
Just from the phrasing of this recital, it's pretty clear that "unique identifiers and other information received by the server" are not regulated here.
Furthermore:
Article 4.5:
> ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Again, without the use of additional information is key. Just because it can be de-anonymized doesn't mean that it is.
Recital 29:
> In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. 2The controller processing the personal data should indicate the authorised persons within the same controller.
I have spent a LOT of time with on our GDPR team. And while GDPR is horrendously complex, I don't think anyone on our legal team would support the assertion that GDPR is countermanding itself.
Also, notice the phrasing "whilst allowing general analysis" - completely separate from Legitimate Interest, GDPR allows for "general analysis" of pseudoanonymous data.
Especially Google is extremely GDPR unsafe. But also DigitalOcean is often not allowed.
But then Azure is an exception because of some legal mumbo jumbo microsoft convinced them off.