Not 100% true, you can often trace back users by IP using leaked databases and through companies that sell user data. Might not be legal, but you definitely don't need cooperation from a ISP.
https://commission.europa.eu/law/law-topic/data-protection/r...
and Person B has a document saying an 80 year old male living at 1600 Pennsylvania Avenue has Chlamydia
do you think only Person A holds private information?
Is the password personal data?
You have to draw the line of correlation difficultly somewhere.
Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then?
I don’t think it’s insane because the more common use is just to pattern match to identify the individuals. While lots of people may share, many do not (eg, everyone in my home shared an external IP but that is frequently just one person).
Google can use this IP and browser traffic to separate out individuals (eg, I don’t watch YouTube and my kid never checks vanguard) to the level they convince advertisers that they know the individual. I expect this is why my kindergartner sees ads for car insurance.
ISP knows exactly who used IP at that point in time (they are even obliged by law to log them). Therefore IP from which a request was sent can be used to uniquely identify the device, with 100% certainty. Therefore it is (usually) a personal information.
Is based on a wrong assumption.
There are six lawful grounds for processing personal data under GDPR; only one of those grounds is consent. Consent is not always necessary, nor is it always sufficient.
An IP address is potentially personal data, because it could relate to a natural living person. There are all sorts of legitimate reasons to use that data without consent, the most obvious being to fulfil a request by the user. You will run into issues if you're using that data in ways that aren't strictly necessary - keeping logs indefinitely, using that data for marketing purposes, sharing that data with third parties without good reason and without adequate safeguards etc.
As they did in the judgement I linked to.
A judge can always claim you could have used a local version of whatever external resource you used.
YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care.
I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...)
The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created.
But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...
Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
reCAPTCHA, in this case can be consider as "fraud detection".
Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result.
Does this fit the "necessary" provision of GDPR? This depends on which court you ask.
reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
No, just websites which include components hosted by third parties. This is not the whole internet (e.g. HN doesn't include third party components).
HN is also hosted by a different company. They get your IP too.
HN doesn't communicate my IP to this service.
> HN is also hosted by a different company. They get your IP too.
If they store my IP, they should treat it as PII to be compliant
All European providers as well as major international provider like AWS [1] have compliance statements. The EU companies are more likely to take it seriously, e.g. Hetzner only logs the first three segments of your IP (i.e 24bit IPv4 or 48bit IPv6). Every other EU-based provider I've used at least offers it as an option. If you run your own server, there are nginx and apache modules [2] that anonymize your logs.
It's real. We're 100% serious.
[1] https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf [2] https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
By this argument, isn't the same true of a physical home address?
> I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses.
Except that isn't strictly "the common case". DHCP leases are often for long-ish periods of time on fixed line broadband services. The IP for my home router, for example, has been the same for weeks or months at a time.
If you can look up a user account by IP address, then the IP address is personal data.
There's nothing wrong with receiving IP addresses on your website, though. You can log IP addresses and use them for detecting fraud and other kinds of abuse without requiring consent. Third parties can do the same, as long as they follow the law and as long as you clearly document what information you're sharing/making users share in your privacy policy.
You can't use personal information for tracking and ad purposes without consent, though, and you can't partner up with other companies that do it for you. It doesn't matter if you're tracking IP addresses, cookies, passive fingerprints, or some kind of supercookie; you need a legitimate reason or explicit consent to process that kind of information.
This is based on some very faulty knowledge of GDPR and the law.
You are allowed to process data without the consent of the user for various things. This would include their IP address. You're allowed to have third party data processors process data on your behalf without user consent for various things.
The Google Font ruling was partially due to who Google is. Google data mines, they're famous for it. So giving Google data they can use to map to your internet persona which may even be linked to your name directly is obviously something many people want to do only when they consent. The fact Google Fonts could be self hosted was another part of the reason for the ruling. That is, sharing the information wasn't required to be able to perform what the actions they wanted to perform, use a font.
Data processing done by US companies is not currently GDPR compliant. However, no one is enforcing that. It would be a complete mess and there are far too many. In reality, everyone is ignoring it waiting for the new laws to be created to make it legal. The reason the US companies are an issue is a US court can issue a judgement to a US company and they are forced to comply no matter where the data is.
> This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider.
This is also not true. If you visit a website that sells B2B accounting software and your IP is identifiable to a company. You could phone up the company and ask to talk to the person who is responsible for finance. If there is only one person, boom easily identifed. There are also various other ways.
> So in Europe, the whole internet is made illegal based on a wrong assumption.
Really, your comment is wrong based on multiple wrong assumptions.
> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
This is not out of step with reality nor a wrong assumption, it is simply a definition. It is motivated somewhat in the considerations of the GDPR.
> (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
> (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
It’s not a direct identifier but with geo-ip or other data, it can identify an individual (eg, have 100 possibilities and geoip narrows it down to only 1 in that region based on IP).
The PII aspect isn’t based on getting a link from the provider. The PII aspect is based on the IP itself standing out in data and allowing reidentification. It’s not 100% accurate, but accurate enough to make money off advertising.
Except when it is. I have a semi-permanent home IP (it only changes when the MAC address on my router changes and I get assigned a new lease) and only one user in my home. My IP address pretty uniquely identifies me.
I don't understand the point keyboard warriors who insist IP doesn't identify a person and IP isn't PII are trying to make.
Are they just being pedantic? Because yes, often an IP is shared. Yes, obviously the legal system shouldn't assume a IP equals a person. That would be very problematic.
But when it comes to mere tracking, an IP can absolutely identify directly a person. So why not just treat it as such all the time? What's the downside of considering IP to be PII?
Good.
There's very few legitimate uses for third party hosted proprietary components.
Why it became standard to load simple things like scripts or fonts from third parties, that can be trivially hosted locally, is beyond me.
(I'm not a lawyer.)
That's a very extreme take. They're how many services actually exist.
Also, consent to an embedded video? My brother in Christ, your browser requested the video.
This kind of attitude is why I block JS and cross-origin requests by default. Unfortunately this is not a reasonable option for the less technically inclined who deserve protection too.
Hell, even a small startup with a few thousand euros can start to track and trace user behaviour on a massive scale that in reality you wouldn't or shouldn't be able to do.
The tooling (free, cheap and not) at our disposal nowadays makes everything so easy that even something that in theory should not serve as identifier can be used to identify you - so let's start with the most common ones: IP, email, etc.
The Internet in Europe is not illegal - it's just pure BS that a simple page like reuters.com contains references to 14 external scripts when loaded, when actually all you need is 2 maybe 3 scripts (the CDN to load images and videos + the page itself) - the rest is crap used explicitly to identify and market people - that's it: Ads, Ads and probably uglier things to do just to profile people online.
Instead of finding an innovative solution (how about mandating ISPs to make IP addresses unmappable to a user?) they only know one solution: Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.
I can't see how this would work in practice: you'd still have the same IP when visiting site A where your real identity is known, and site B where you didn't give them consent to access your information. The only reasonable course of action is to classify your IP as an identifying info, as site A and B exchanging info would result in your exposure (or site A and B being the same site, but you logged as different users...)
Perhaps your point was on giving user different IPs for every site, potentially for every request, but then the consequences would have to be handled worldwide.
Not true. Google is used so widely that they can track and profile me all over the internet, because they can easily combine on which page I've requested fonts from them. And once I log into YouTube, they can link all those information about medical conditions I googled directly to me personally.
- on the benign intent and accidental violation: is it natural to go load fonts from a third party service in the first place ? I get why we arrived at this point, but hosting yourself the base resources you're using for your site shouldn't feel like some huge burden or leap from the norm.
If we really see a shared benefit to having fonts on some common platform, I'd also wish it wasn't Google. Perhaps Cloudflare or Fastly ?
- on IP being worthless to Google: is the "unless they get any link to your identity" even hypothetical ? I am a paying Google customer and extensively use their service. And we all do to some extent; trying the "let me live my daily life but block and avoid anything that touches Google" game would still be as critically punishing today as it was 4 or 5 years ago.
Ironically, even in the USA with the CCPA they are trying to regulate this somehow. This is just not something you can leave untouched. Without even mentioning other non-EU countries (China/Russia/India, etc.) that have even stricter data regulations.
> Making things illegal, even if in almost all cases the use is benign or even makes a lot of sense.
What is there benign about sending your IP address to 10-15 external services that have nothing to do with providing you the service in the first place? Try to install the NoScript extension and you'll see that 90% of the websites only require the main domain to be unblocked to be used. A few more websites require allowing 1-2 additional more scripts (CDN or ... payment systems/redirects, etc..). The rest is just your data being treated like toilet paper for marketing purposes. And I wouldn't even mind if they stopped there (marketing website A buys the data, and they target you with some crappy ads you won't even click on): no, they sell, and the buyer resells, etc.
Is this really what makes a country innovative? Advertisements? I thought that innovation was self-driving cars, electro cars, new ways to fight diseases, digitalizing bureaucracy (which can be done without giving away your personal data to random online companies), etc.
But if you are a small company in Europe that for example is producing a better and lighter cardboard box, you will have to hire a data privace specialist because you may get sued by some random idiot if you accidentially link to Google Fonts as a convenient way to display fonts, this certainly binds a lot of valuable mindshare and resources and therefore is bad for innovation. You cannot believe how much startups here have to think about GDPR even if they do not collect any data at all. Read the other answers in this thread. There are others who say that linking to Google Fonts is equal to selling your customers' data to Google. What a joke!
Of course startups here - and everywhere else! - have to think about applicable law. Just like if you want to start a transportation company you'll have to think about applicable law. If a company does not collect any data at all then the GDPR is a complete no-brainer.
Try this and see if you can make it work for you: to identify an individual you need ~33 bits. An IP address, even though it doesn't quite get you there gives you a very large fraction of the number of bits required. Adding a few more makes the individual identified. So therefore it is a very good idea not to allow access to the IP address to unrelated parties from a privacy point of view.
<quote> If you don't understand why including third party resources for developer convenience is a bad idea then you probably shouldn't be building commercial websites.
An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
> An IP address can be trivially combined with the ISPs data and provide the exact user of an IP during any point in time.
Not even then.
Sounds good to me, that's the way it should be. I shouldn't have to use third party extensions to stop my browser from automatically loading facebook crap every time I visit websites that aren't facebook. Companies should only include 3rd party components in their websites if there is a very good reason for it, and only then after the user has explicitly consented to it.
That is simply not true, please do not spread misinformation like this.
Using/Embedding third-party resources is allowed IF it is e.g. technically necessary to provide the service or core functionality at all.
Collecting personal information and using a third-party service to do so in a shop checkout? That's okay.
Collecting personal information and shoving everything into Google Analytics because you want to know how many people visited your site? Not so okay, there are less intrusive ways to do that.
https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-g...
This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal.
This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider.
So in Europe, the whole internet is made illegal based on a wrong assumption.