Ask HN: GDPR, WordPress.com REST API and Gravatar

Posted by cdarwin on Wednesday January 02, 2019 @12:13PM
from the ask-hn dept.

Hi, I'm building a service based on the wordpress.com REST API (https://developer.wordpress.com/docs/api/) which gives access to wordpress.com data, and based on the Gravatar (https://gravatar.com) service from which I download images.

So, when my users will use my service, their IP and HTTP header will go to WordPress.com and to the Gravatar service, and they say the use IPs to make geolocalization.

Under the GDPR, is it enough I explain this in my privacy policy or do I have to store the consent?

Thank you.

( 1 comment | on HN )

Re:Ask HN: GDPR, WordPress.com REST API and Gravatar by richardk3000 on Thursday January 10, 2019 @04:15AM (#18872561)

For new users, explaining this in the privacy policy and getting their consent is enough. It is wise to store the consent, for a user might complain that he/she never gave their OK, and then it's up to you to prove that they did.

If you already have a user base, you should inform them that you are changing your processing of their data, again they must consent. (you will probably have received those kind of mails or popups on websites during the last year yourself)

Important question: are you offering the service to individuals interacting directly with your service, or are you processing this data on behalf of a business client (the "controller")?

[ Parent | on HN ]