Hacker News Reader

Comment by daedrdev | Hacker News Reader

The EU pushes heavily for consent for tracking, yet you need to track your users locations to keep your trademark, thus requiring that every company has to have a popup asking to track that data.

View on HN

IANAL, but.... you only need consent if it isn't required for your business to function. If you need to track to maintain your trademark, couldn't you argue any business with a trademark needs to track users?

I'm sure it wouldn't work in a real court, but it sounds funny in my head.

You still need a consent

If it is based on legitimate interest, under gdpr you don't.

You are required to inform the affected users, however.

Legitimate interest of the user, not yours. Rule of thumb, if its not a legal requirement, you need consent.

That’s not true. From the law as written:

> legitimate interests pursued by the controller or by a third party…

There are six lawful bases for processing, consent is only one of them.

"legitimate interests" are subject to interpretation on purpose; either legitimate interests on a given instance are lawful, or you're better off relying on consent, since your interpretation and the regulator's interpretation may be different. Check page 7 of https://www.edpb.europa.eu/system/files/2024-10/edpb_guideli...

What's 'legitimate' and what isn't is up for interpretation, but the question of whose interests is clear in the text of the GDPR itself, and it's the controller's (or a third party's) interests which could form the basis of lawful processing.

Interestingly, the GDPR specifically does not include 'benevolent' processing (i.e. processing for legitimate interests of the user) as a lawful basis.

Most trademark holders have much more solid ways of demonstrating their mark's use in commerce, like financial and business records.

Right, but I think this case is interesting for the developer community as it targets specifically open-source use-cases, where you usually have neither extensive user per-country data, nor would you usually care about tracking, or have commercial offerings. This essentially means that you either cannot protect your open-source project name or have always to keep in mind to collect user per-country data, otherwise you risk getting deleted.

Is there no privacy-preserving per-country analytics library? No need to store IP Addresses!

I mean isn't storing location still requiring you to inform your users? It's not just IP that Europe's privacy regulations care about right?

You don't need that. You can provide billing addresses of your customers without tracking web access.

Reply on news.ycombinator.com