If you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it.

But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".

Well, you can totally contribute to a privacy violating network … so long as the data is located and processed in France.

They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).

> so long as the data is located and processed in France.

... you also have to ask for permission first.

The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.

> you can totally contribute to a privacy violating network … so long as the data is located and processed in France.

While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.

That's why this whole thing is nothing but protectionism.

At this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.

I'd be interested to hear exactly what default configuration violates GDPR, as that wasn't something I'd heard before. However, even if that is the case, that would imply that the defaults should be changed.

Imagine that you run a workplace where floor space is relatively expensive. To avoid increasing the floor space, you determine exactly how wide each hallway must be, exactly how much space is required, and build everything to that specification. Your hiring decisions take the weight of an applicant into account, so that nobody will be too large for those hallways. Then a law comes along saying that your coal mine is dangerous, and your use of child labor is unethical. "But look at the cost!", you cry, "I can't afford to enlarge every tunnel to accommodate full-grown adults!" But there was no reason the tunnels couldn't have been built larger in the first place.

There was no reason why the web and the internet could not have chosen to respect privacy by default, and thereby avoid the current costs of changing their software and business models. If it is true that the default apache configurations violate privacy standards, just as any configuration of Google Analytics violates privacy standards, then that is a sign of just how much the regulation is needed.

> I'd be interested to hear exactly what default configuration violates GDPR

https://law.stackexchange.com/questions/42438/do-default-apa...

It would appear public IP addresses are PII. Apache (and most web servers) log those by default.

A case can be made, on a site-by-site basis, that those are necessary for providing the functionality of the site. But that's a hard case to make if the logs are never actually read, and then if they're collected for that purpose, timely deletion is important (and unless your host also configures log rotation and disposal, timely deletion isn't happening).

I'm pretty sure all of this has to be declared in a privacy declaration anyway, even if they are collected for site operations purposes and deleted in a timely fashion. With all these constraints, probably safer to run in a privacy-configured Docker in one of the big Cloud hosts than to stand up one's own apache install.

Thank you, that was an aspect I hadn't considered. That said, I'm not sure how much I agree with the conclusion of this particular answer. My understanding is that IP addresses are only considered personal data if they either uniquely identify a person (e.g. a static IP address), or can be joined with additional available data to uniquely identify (e.g. a dynamic IP address logged by somebody who also has logs on the dynamic IP assignment).

In addition, that there is an exception allowing the collection of personal data for legitimate interests without prior consent. While that has been erroneously argued to enable a business model (e.g. Facebook's ongoing collection), server security by applying IP address bans would be be a more solid case [1].

[0] https://www.whitecase.com/publications/alert/court-confirms-...

[1] https://law.stackexchange.com/questions/28603/how-to-satisfy...

Put up a static website and you're fine.

Collect people's data (and that's what a user analytics system does) and then you're responsible for it, and you have to follow the rules.

Static websites can collect data too. Lots of stuff can go into web server logs.

And web server logs are fine for troubleshooting and detecting abuse, you don't even need to ask for consent!

Only things like tracking, ads, and sending data to areas without equivalent privacy laws are forbidden. The intent and usage of the collected information is a big part of what is and isn't allowed.

Source? AFAIK web-server logs logging IPs are not allowed under GDPR.

I looked into this at back when the GDPR came into effect [0]. I am not a lawyer but in summary:

Web sites are allowed to log data (including visitor requests and IPs) required for the smooth running of the site. It could be argued that keeping logs allows for trouble-shooting so web server logging is probably OK in most circumstances.

However, there is no reason to keep months/years of logs around. Having this data is actually a liability under the GDPR and you should be aggressively deleting logs after a few days.

[0] https://sheep.horse/2018/6/the_eu_general_data_protection_re...

>It could be argued

I, for one, would not like to argue this in court. I heard many lawyers advising against storing IP addresses.

And yes, long-term analytics are a no-no. So good luck comparing your website performance year to year or even detecting seasonality.

That would be interesting. They all log IPs by default. Here's an example from nginx:

192.168.1.122 - - [10/Feb/2022:11:32:35 +0000] "GET /audio/pop.wav HTTP/1.1" 206 28366 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"

So true.

I have a collection of small, US-focused websites.

I'm investigating low-effort ways to geo-fence the EU. At some point it just becomes easier to ban Europeans, rather than keep up with whatever they'll come up with next. I saw in this thread that the Google fonts on my website are now a problem as well!? That's the first I heard of it.

> That’s the first I heard of it.

This is the perfect example of why government oversight is needed. You run a bunch of websites and aren’t aware that you are inadvertently involved in violating the privacy of the people who visit your sites. How are non-technical people supposed to deal with this?

No, this is a perfect example of the exact opposite.

A bureaucrat on the other side of the planet comes to a conclusion and I, who never voted for this person or knew about their existence, am legally bound by their decision.

On pain of who knows what fines or penalties. I’m nearly overwhelmed by the amount of work on my core product, I can’t add “keep up with European legal opinion” to my todo list as well.

As I said, it’s simpler to just geofence everything.

You don't need GA for a website either. Many websites probably don't even need any form of analytics at all.

Do you really think we are in a better place now with GPDR and all these annoying cookie banners all over the place?

Overall, yes. At the very least it's been incredibly enlightening. It's amazing how random websites have 50 "partners" all of which for some reason need to know what I'm doing.

So you think your "enlightenment" is worth the millions of work-hours people are putting in just to read and click a cookie banner they give absolutely not a single crap about?

They wouldn't have to do this if they didn't spew personal information indiscriminately to scumbag "partners". So yes, I do think that is worthwhile. The cost is born by the correct people.

The cost is borne by every single internet user in EU clicking countless stupid boxes every single day - for nothing.

Also by the EU users losing access to ad-supported free services.

Not for nothing, as you can see in this post. Little by little we're stopping to send private data to the US. That's a good thing, even if it's painful at the start.

>That's a good thing

Says who?! I have zero problems sending my private data to the US. I did it for years and I still think is one of the better places to send my private data to. Definitely better than my own country.

Answering here because there's a thread depth limit.

> Free content and services. What do you lose in exchange?

Privacy. What I do shouldn't really be anybody else's business.

An ad-targeted web. IMO ads are a plague on useful content, because everything is about getting views and clicks. This makes actual content less useful and more annoying to consume. It incentivizes posting low effort, watered down content rather than smaller amounts of great content. It also means content creators are trying to please the advertiser, and not me.

Risk of manipulation. Lots of effort has gone into figuring out how to best manipulate people, and when you know who somebody is and how to best tailor any given message to them, you can get pretty far. I'm quite sure that I also have buttons that can be pushed if somebody knows how, and I don't particularly like the thought of that.

Me, obviously, since I made the comment?

And why the heck would I want to give my data to a bunch of random companies? What's the benefit in it for me, anyway?

> What's the benefit in it for me, anyway?

Free content and services. What do you lose in exchange?

And every single user outside the EU. I never voted for these crazy runaway regulations, but I can’t browse many sites on mobile at all with all the damn banners.

EU bureaucrats are effectively prescribing how the web should work for everyone. Ridiculous.

Yes.

Never a shortage of people willing to dictate other people how to live their lives.

Never a shortage of people mad that they can't eat trans fats or inhale leaded gasoline exhaust anymore, either. Not great analogies, since giving up personal info to use free services is a reasonable choice for individuals... But in aggregate, it's like giving up a bit of sovereignty to be that transparent. Microtargetting has helped enable some serious societal harms, i.e. spreading lies to the gullible while evading scrutiny from others, and that pales to how intelligence agencies can use the hoards of personal data. I think France and the EU are moving in the right direction, given the CLOUD act exists, and given all the other bad societal effects enabled by a surveillance focused economy. US politics hasn't weathered the shift well, unless of course your fitness function for politics is how resilient the elected government is against voters, i.e. how little can it serve their interests without losing power.

Noone is dictating you how to live your life. The recent EU privacy laws are about giving people a choice how there data is used. You are free to accept the cookies. You are even free to automate that via browser extensions. You are free to build websites in ways that don't require tracking user data and thus don't require consent. You are free to vote for politicans that are against privacy right or even campaign yourself.

But a fundamental issue with freedom is that sometimes freedoms conflict with each other. Here the freedom to do whatever you want conflicts with the right to privacy of others and the EU has decided that in this instance the right to privace takes precedence.

I am not free to use add-supported US services when they stop being provided to EU citizens due the onerous requirements imposed on them by privacy laws.

I am not free to use a website and give away "my data" by default without having to click Allow All on a damn cookie popup.

The EU politicians unilaterally decided to steal these freedoms from all EU citizens.

The right to privacy is not a freedom. I am not sure it's even a real right. But it was easily accessible even before the current privacy laws, even if it needed a little technical competence. It wasn't the default though. And the current laws do not provide me the privacy I actually need: from EU government(s).

> I am not free to use add-supported US services when they stop being provided to EU citizens due the onerous requirements imposed on them by privacy laws.

Those companies are free to not to do business wit you but it is not the EU privacy laws making that decision. Those companies can provide their service in a privacy-respecting way and many will - the EU is not a small market to give up on. You can also use a VPN.

> I am not free to use a website and give away "my data" by default without having to click Allow All on a damn cookie popup.

You think users should need to be technically competent to block cookies but don't want to be technically competent to install an extension like https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...

And don't forget that hose consent popups are likely specifically designed to be annoying in order to get you mad at the privacy laws. Don't fall for it - the EU privacy laws do not required websites to be user-unfriendly.

> The EU politicians unilaterally decided to steal these freedoms from all EU citizens.

I am not going to pretend the EU is a perfect democracy, but ultimately, those decisions are made by those elected by the peole - directly or indirectly.

> The right to privacy is not a freedom. I am not sure it's even a real right.

It is a real right that has historically been enforced in many EU countries. The recent laws do nothing more than update that enforcement to the digital age.

> But it was easily accessible even before the current privacy laws, even if it needed a little technical competence.

No, it really wasn't. You can block cookies but you cannot stop companies from tracking you via the 10 million other ways they have available or to trade information about you with third parties. You cannot use technical means to find out what information companies have collected about you. You cannot use technical means to compel companies to delete information they have already collected. THAT is why we have new laws.

Hell yeah. The banners are the fault of the website owner. They don't have to display them.

But they do, and it's terrible.

I feel for my European brothers and sisters these days. As an American, I hardly ever see these banners. Went to an EU country for work and... Holy cow. Y'all get these banners every site. How do you tolerate it?

Searching for "Allow All" becomes a reflex after a while. I don't know anybody rejecting anything anymore, it's even worse.

Honestly, I've never felt the urge to reject. I'm a guest in their data house, soaking their bandwidth for free. Track away.

This is weird. I'm neither in US or Europe but still see all those cookie banners everywhere on every site.

Thanks to GDPR, we have a much more private web. /s

Do you really think GDPR and cookie banners are related? Most are non-compliant in the first place, and were around for years beforehand.

Yes, I think we're in a vastly better place, where there is a cost to doing bad things.

Unfortunately the cost in borne by us, regular EU internet users through a much degraded Internet browsing experience.

You know those "cookie banners" are illegal under GDPR too, and done specifically to annoy people into agreeing?

This is so funny. Under GDPR everything is illegal, the only legal website is no website.

Good for Europe, they are just going to law themselves out of the internet. Up to the point were your ISP doing hops to send your TCP packet will be illegal unless you approve them sharing that info with all the shops.

What about clicking or typing in a site? Is your webserver processing those? That means you’re gratuitously using user data to run your for-profit business! That should be illegal!

/s

100%.

(Also, the GDPR is not responsible for cookie banners)

Good law understands consequences.

The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging.

>The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging.

And now the regulators are responding to it.[0]

[0] https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...

That ruling declares that a centralized solution is no good.

The predictable outcome from that ruling is a decentralized solution: a few libraries attempting to build frameworks that are compliant, everyone implementing their own one-off versions of permission-granting and cookie consent using those frmeworks as a basis, and the Authority chasing mom-and-pop sites that are out of compliance until the sun goes cold.

In a sense, that may satisfy the goals: the data will be decentralized, stored widely, and harder to aggregate. On the other hand, what we learned from the virus era and the Windows OS monoculture is thousands of nodes running the same software (but not centrally maintained; maintained by people who have a job other than maintaining a website and are therefore slow to patch security holes) will be vulnerable to scripted attacks against frameworks.

My prediction is a net increase in stolen PII and, while individual site-runners will get screwed, the number of sites collecting the data won't go down. It's just too valuable, and the odds you will get hit by a hacker are too low.

In any case, it'll be a hell of a ride.

Cookie banners were already a thing before GDPR.

This! GDPR is a big block towards technological improvement.

Do virtually any business that involves user registration at some point, and now you need to be sure that you're compliant with all those rules, spending limited resources on that to avoid ridiculous fines.

It benefits only the big players who has lawyers to know exactly what to do and not, and a nightmare for anyone who tries to grow a small business or have a small website.

> GDPR is a big block towards technological improvement.

It's exactly the opposite.

It forces technology to be developed in a way that protects human rights (specifically the right to privacy).

Innovation is not automatically good if you're innovating in the wrong direction. Think of it as a vector, not a scalar.

I was anti-Brexit when it happened, but am beginning to see the wisdom of it.

It was already non-invasive. I, as a conscious human being browse a website, use their (potentially free) services. The website can of course put a cookie and track me. If I'm really paranoid I could block cookies etc but regardless, no one forces me to use their website.

If someone pointed a gun and forced me to go to a website, enter my personal data and give my data to trackers that would be something else (still not website's fault but anyway).

Who is deciding what is the wrong and good direction to innovate in for everybody else?

Apparently some politicians in EU who has a grudge against US-based tech companies.

"Hey Google and Facebook is doing so well let's make harder for everyone using their services."

I neither have sympathy for those companies and never been to US, but adter all these GDPR regulations I actually started to sympathize.