Hacker News Reader

Comment by kuschku | Hacker News Reader

> Any submission of data requires the transmission of an IP address, which is personal data and necessitates appropriate protection.

And requires an opt-in under EU law, which makes this entire thing even more ridiculous.

View on HN

Then don't send the correct source IP address, with simple statistics gathering like this I hardly expect they require a response. It would mean there would be no personal data whatsoever.

How would you do that, though? The browser has to open a socket to something to do this, after all. And that already is a violation.

You'd just send a UDP packet with a spoofed source address and forget about it. There's no need to open any sort of 2-way connection for data that's only being transmitted in one direction (from browser to metrics server).

You could transmit the telemetry through Tor.

Tor is blocked in some places and viewed as very suspicious in others. If you're already in a place where you're trying not to draw attention to yourself, using Tor might not a good option.

Wouldn't spoofing IP addresses risk the data packets being filtered out by ISPs or other upstream network providers? IMO if keeping IP addresses hidden is a concern, it'd be better to use something like TOR.

This isnt how tcp/ip works

With udp/ip it would work, if none of the routers on the way to the destination filters spoofed IPs.

Most ISPs filter spoofed IP addresses nowadays[1]. Even if your ISP doesn't prevent it, NAT might. You wouldn't get a whole lot of responses this way, and there'd be a strong bias because of regional differences w.r.t. filtering.

[1]: https://spoofer.caida.org/summary.php

Does an IP address actually require an opt-in? And if it does, does it only apply if it is being stored?

Yes[1], no[2]. An IP address is "personal relationships" data and collecting, processing or using such data is prohibited unless allowed by law or the concerned person gives consent.

[1]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Types_...

[2]: https://en.wikipedia.org/wiki/Bundesdatenschutzgesetz#Overvi...

The way I interpret this, if you don't collect, process or use the IP address beyond it being incidentally involved in the transmission of anonymized data, it shouldn't require explicit consent.

Otherwise literally everything that connects to the internet in some way would have to treated in that way, and that's not how the law is currently enforced.

Reply on news.ycombinator.com