Hacker News Reader

Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.

View on HN

Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it.

One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.

As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data.

You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data.

As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA.

https://medium.com/@christhaefner/shopify-illegal-in-germany...

Reply on news.ycombinator.com