Plausible Analytics Isn't GDPR Compliant

Re:Plausible Analytics Isn't GDPR Compliant by mrweasel on Friday October 23, 2020 @07:39AM (#24868391)

I would like to see more software having the option of just logging the users country and not the IP, and perhaps just as generic a user agent as possible (Just, is this Chrome, FireFox, Edge, whatever, but nothing else.)

for example for Nginx something like:

log_format logfmt '$remote_country - [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_generic_user_agent" "$gzip_ratio"';

That would assume access to a GeoIP database, but it would be helpful.

[ Parent | on HN ]

Re:Plausible Analytics Isn't GDPR Compliant by cuu508 on Friday October 23, 2020 @08:16AM (#24868631)

$remote_country is interesting idea, you classify visitor into per-country "buckets". Although the buckets would not be of equal size. If you have a single regular visitor from a tiny country, $remote_country could uniquely identify them.

A similar idea would be to have built-in $remote_addr_hash8, $remote_addr_hash16 variables which hash IPv4 and IPv6 addresses down to 8-bit or 16-bit numbers.

There are hacky ways you can do some forms of anonymization already:

https://www.supertechcrew.com/anonymizing-logs-nginx-apache/

[ Parent | on HN ]

Re:Plausible Analytics Isn't GDPR Compliant by franky47 on Friday October 23, 2020 @08:17AM (#24868635)

FWIW, CloudFlare can inject a cf_ipcountry header that does that. User-agent parsing is unfortunately more complex, with lots of false readings (not counting bots & crawlers).

[ Parent | on HN ]