News for hackers. Stuff that matters.

A comment on Use of Google Analytics declared illegal by French data protection authority. Parent comment

Re:Use of Google Analytics declared illegal by French data p... by nickpp on Thursday February 10, 2022 @08:56AM (#30286014)
Source? AFAIK web-server logs logging IPs are not allowed under GDPR.
[ Parent | on HN ]
Re:Use of Google Analytics declared illegal by French data p... by AndrewStephens on Thursday February 10, 2022 @09:18AM (#30286289)
I looked into this at back when the GDPR came into effect [0]. I am not a lawyer but in summary:

Web sites are allowed to log data (including visitor requests and IPs) required for the smooth running of the site. It could be argued that keeping logs allows for trouble-shooting so web server logging is probably OK in most circumstances.

However, there is no reason to keep months/years of logs around. Having this data is actually a liability under the GDPR and you should be aggressively deleting logs after a few days.

[0] https://sheep.horse/2018/6/the_eu_general_data_protection_re...

[ Parent | on HN ]
Re:Use of Google Analytics declared illegal by French data p... by nickpp on Thursday February 10, 2022 @09:27AM (#30286407)
>It could be argued

I, for one, would not like to argue this in court. I heard many lawyers advising against storing IP addresses.

And yes, long-term analytics are a no-no. So good luck comparing your website performance year to year or even detecting seasonality.

[ Parent | on HN ]
Re:Use of Google Analytics declared illegal by French data p... by rascul on Thursday February 10, 2022 @09:17AM (#30286266)
That would be interesting. They all log IPs by default. Here's an example from nginx:

192.168.1.122 - - [10/Feb/2022:11:32:35 +0000] "GET /audio/pop.wav HTTP/1.1" 206 28366 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"

[ Parent | on HN ]