News for hackers. Stuff that matters.

A comment on GDPR will pop the adtech bubble. Parent comment

Re:GDPR will pop the adtech bubble by toomuchtodo on Sunday May 13, 2018 @03:03PM (#17060387)
Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.
[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by jimktrains2 on Sunday May 13, 2018 @04:29PM (#17060883)
IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.)

Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by toomuchtodo on Sunday May 13, 2018 @04:40PM (#17060934)
> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

Cookies and other artifacts in the request headers or query parameters that can identify a unique user.

[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by jimktrains2 on Sunday May 13, 2018 @04:43PM (#17060952)
Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.
[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by toomuchtodo on Sunday May 13, 2018 @04:47PM (#17060967)
True! But some cookies are usually tied to a user account, with an email address, and/or other PII.

How careful are you with tacking cookies to requests? Be mindful, and keep documentation.

[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by zaarn on Monday May 14, 2018 @03:25AM (#17063504)
Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.
[ Parent | on HN ]
Re:GDPR will pop the adtech bubble by TheForumTroll on Sunday May 13, 2018 @08:33PM (#17061857)
"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant."

https://eugdprcompliant.com/personal-data/

PII or not PII it is still covered by GDPR.

[ Parent | on HN ]