Show HN: Trackless - A GDPR-Friendly Google Analytics Opt-In Button

Re:Show HN: Trackless - A GDPR-Friendly Google Analytics Opt... by jdietrich on Sunday May 27, 2018 @12:37PM (#17167704)

The law doesn't care how a browser works. The law doesn't care that it's the browser making the HTTP request. The law doesn't care if the JS library is delivered by pixies travelling through the ether on rainbows. You put the embed in that page, so you're responsible for what happens next. You acted (intentionally or negligently) to cause the user's browser to make a HTTP request to a third party, which might cause their personal data to be unlawfully processed.

You're not absolutely and totally responsible for anything that might possibly happen under any circumstances, but you're required to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation (Art. 24).

If you embed a JS library from Google Cloud CDN and compile a written risk assessment with copies of Google's privacy policy for that product and their EU-US Privacy Shield and ISO 27018 certifications, you're probably fine no matter what happens.

If you embed a JS library from SuspiciousCDN.ru because someone on 4chan gave you the link and your user data ends up on WikiLeaks, you're going to have some serious explaining to do.

[ Parent | on HN ]

Re:Show HN: Trackless - A GDPR-Friendly Google Analytics Opt... by Silhouette on Sunday May 27, 2018 @12:47PM (#17167751)

But as I've already noted in other comments, this heavy-handed interpretation breaks a large part of the modern web, including many common practices that are in visitors' interests and not doing anything shady at all. Expecting every instance of embedding on the entire web, even among freely available pages using freely available services, to go full lawyer not just initially but on an ongoing basis, simply isn't a reasonable approach to take. An interpretation that puts significant extra liability on those freely offered sites and services regardless of whether they are intentionally doing anything shady is how you get extreme reactions like people geoblocking the EU.

[ Parent | on HN ]

Re:Show HN: Trackless - A GDPR-Friendly Google Analytics Opt... by jdietrich on Sunday May 27, 2018 @01:10PM (#17167874)

If you're fine with running untrusted third-party code on your website, that's your prerogative. The European Union will shed no tears if you choose geoblocking over responsible business practices.

[ Parent | on HN ]

Re:Show HN: Trackless - A GDPR-Friendly Google Analytics Opt... by Silhouette on Sunday May 27, 2018 @02:06PM (#17168193)

There is a difference between untrusted and unverified or informal.

Do I expect visitors to my personal blog to have any security or privacy problems because I use Google Fonts to make it look nice? No.

Do I have any sort of formal agreement that is binding on Google to guarantee that, or that obliges them to notify me if they change their privacy policy in this respect? Also no.

And exactly the same applies to, for example, numerous popular JS libraries that are hosted for free on reputable CDNs.

[ Parent | on HN ]