Hacker News Reader

Comment by landryraccoon | Hacker News Reader

IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.

View on HN

Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.

So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?

Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.

Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318

The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.

You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address.

I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration.

Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.

Reply on news.ycombinator.com