Hacker News Reader

Comment by shawn | Hacker News Reader

And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done is no excuse. Nor is the monstrous sum of money made by it.

I use Piwik (https://github.com/matomo-org/matomo) and track visitors without their knowledge or consent, because I need analytics. Piwik is also configured to respect the "Do not track" header, so opting out is as easy as indicating that you don't wish to be tracked.

Is that wrong?

And I use Piwik precisely because it's self-hosted. I know for a fact your data doesn't get sold, because the data never hits any server except mine.

If this seems acceptable, it's also why legislation seems worrisome. There are a lot of corner cases that law tends to overlook. But hopefully the requirements won't be too onerous.

View on HN

I don't see how self-hosting has anything to do with it honestly. This is about tracking people without their consent. It's about preserving rights of individuals. Self hosting is no more or less acceptable than third party hosting. It's not a technical issue.

Are you also against access logs?

Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.)

Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

Cookies and other artifacts in the request headers or query parameters that can identify a unique user.

Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.

True! But some cookies are usually tied to a user account, with an email address, and/or other PII.

How careful are you with tacking cookies to requests? Be mindful, and keep documentation.

Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.

"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant."

https://eugdprcompliant.com/personal-data/

PII or not PII it is still covered by GDPR.

So is your position that website owners should have no visiblity at all on their visitors, and no way of knowing how many people are using it?

Website owners can have visibility on their visitors if those visitors explicitly consent to it.

Not sure what is so difficult to understand about this.

So if I don't think that Walmart should be able to record me with security cameras while I'm in the store I should have the right to demand that they ask me to sign a waiver before entering the store? Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

I'm not 100% sure, but I believe the cameras at Walmart are for security only. I don't believe Walmart is using facial-recognition technology to identify visitors, track their behaviors (which aisles they visit, how long they look at specific products, etc.) and then using it to other retailers for them to then target those visitors with ads.

OK, it's the petrol station part of the supermarket, but

"Tesco is set to install hi-tech screens that scan customers' faces in petrol stations so that advertisements can be tailored to suit them, it has been reported.

The retailer will introduce the OptimEyes screen, developed by Lord Sugar's Amscreen, to all 450 of its UK petrol stations, in a five-year deal, according to The Grocer.

The screen, positioned at the till, scans the eyes of customers to determine age and gender, and then runs tailored advertisements."

https://www.theguardian.com/business/2013/nov/03/privacy-tes...

Sometimes, guaranteeing freedom for one party requires taking away freedom/rights from another party. For example freedom from slavery means taking away the right to have slaves. Society has to make a choice: which one is more important? In case of GDPR, the EU has chosen: the privacy of citizen is more important than business concerns.

Why are people obsessed with companies rights? Do they not have enough already?

There's an asymmetry between what a company can do politically/legally given it's resources and what an individual can do. This is why countries generally have some kind of laws protecting consumers.

Security cameras recording footage and it not being used in 99.999% of the time when no crime occurs is fine. The tapes aren't kept forever. Just as having server logs to identify malicious actors i.e. hackers or scammers is fine. What's not fine is e.g. running facial recognition on the security camera footage, or figuring out who bought what (cough Amazon Go).

GDPR has exemptions for security. Your free to track information for the purposes of blocking vulnerability bots, but only the minimum data required for that purpose... and your visitor's data cannot be used for other applications without their consent.

> Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

No. Property "rights" are secondary to human rights. Like, Walmart can't knowingly sell poison as food just because it's their property...

In your example, Walmart is free to record you on security cameras for security / theft purposes. However, they can't record what you're looking at and reuse that information for targeted advertising without consent - profling is simply not required to do business, so your right not to be profiled wins.

> “they can't record what you're looking at and reuse that information for targeted advertising without consent”

What law prevents them from doing this?

The actual Walmart? Nothing. The previous poster used Walmart's security cameras as a strawman argument against GDPR, which I expanded on.

Consent isn't the only lawful basis for processing personal data.

They can know how many people, as long as they don't store personal information. Keeping a counter doesn't require consent.

Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.

Ok, so it’s hard. Nobody is entitled to that being easy in the way that they are to privacy.

What privacy? Knowing that user dhsidhujdjdowhdyyehheis is using my website is not an infringement on your privacy!

Why do you think you can control what I do with data you send to me? Don't send me data I'd you don't want me to have it.

Why do you think you can control what I do with data you send to me?

Are you really interested in rehashing this conversation? You got plenty of answers last time¹, I doubt you'll get new ones

¹ https://news.ycombinator.com/item?id=16957978

Obviously no one said anything convining. Sure, it's law under the gdpr and I'll comply. That doesn't mean I think it's a reasonable law.

I'm just saying there's no point starting over, you'll just get the same kind of responses. You should preempt them if you're hoping to get anything new. Though I doubt you'll get it anyway.

> Why do you think you can control what I do with data you send to me?

Legal protections, like the GDPR.

Why do you think I can’t photograph your face?

Don’t reflect light in my direction if you don’t want me having pictures of you!

I agree with this perspective. I haven't seen anyone present a compelling case as to why a person should own all data about themselves.

You would if you could see what the military does with data about people.

> Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.

It's hard if visitor numbers would directly translate into revenue or similar. The trouble you're running in then is discerning organic hits from clickfarming.

If all you care about is when, where what content is popular on your website, there's a pretty simple method: Tally 200 and 304 responses. 200 tells you how many visits you get. 304 tells you, how often people hit refresh, or re-visit your page within the expiration time of the URL that 304s.

Also there's little value in identifying individual visitors. Getting a coarse idea where visitors are located in the world might be nice (for a regional news outlet for example). So just slap some coarse grained. GeoIP on it.

And with application layer DDoS attacks and intrusions: surrender? Do not ban bad actors? Or outsource to Cloudflare that keeps an army of EU lawyers and is compliant?

Nah, that's a legitimate interest (the example given in Recital 47 is preventing fraud, which is similar). You can process it as long as you only use it for that purpose and delete it as soon as possible.

> It's about preserving rights of individuals.

I'm not sticking up for all the big data perverts, but what about an individuals right to speak freely and disclose information they have observed/recorded? The 'right to be forgotten' seems at odds with everyone else's right to remember and disclose occurances.

That is not the case. The "right to be forgotten" is not absolute. There are lawful bases for processing under which the right to be forgotten does not apply.

Go read GDPR article 17.3, it's easy to read. A few things for which the right to forgotten does not apply:

- exercising the right of freedom of expression and information

- for compliance with a legal obligation (e.g. keeping records for tax reporting)

- for public interest reasons related to health, science, historical research

Seriously, there is too much FUD about the GDPR.

Yes! The fud keeps increasing every time another gdpr related post pops up here.

I'm 60% sure it's people who read articles from Adtech Corporations about GDPR and not from people in the EU having to deal with it.

The only bad thing that I've noticed about GDPR is that some niche sites that rely on ad revenue are getting fucked over by Google (if you turn off personalized tracking for your visitors you still need the consent to track, there is no difference) so their income might break down.

That's quite sad but on the other hand they're exploring alternative methods of income and I'm certain adtech will adapt.

I doubt it's only that. I think it's also the tendency of people nowadays to only read titles and not to investigate further. I think some people are triggered by the phrase "right to be forgotten" and they jump to conclusions without finding out what it's really about.

The EU cookie law was almost the same issue, barely anyone implemented it and those who did did so poorly or incorrectly.

This time it bites back tho.

Thanks for the direction. I've read the GDPR a few times but it is (intentionally) non-specific on many implementation details. As I alluded to in comment, 17.3(a) seems like it would work as a global excemption in practice. I'm not familiar with how court rulings that provide legal precedent have impact or are respected across the diversity of legal systems across the EU. By May 25th 2020, after a multitude of GDPR related cases and verdicts, the answer may be more clearly defined. (Or increasingly nuanced with even greater uncertainty ;-)

GDPR also doesn't forbid individuals to do pretty much anything. Article 2c "This Regulation does not apply [...] for a natural person in the course of a purely personal or household activity;" - you can speak freely and disclose information you have observed/recorded, but the business you are running can not.

Piwik has several blog post about this very topic, for example: https://matomo.org/blog/2017/09/gdpr-potential-consequences-...

You can disable the tracking parts in Piwik, or you can assume a legal stance under one of the 6 exceptions like "Legitimate interests" (https://matomo.org/blog/2018/04/lawful-basis-for-processing-...).

Thanks, that's very interesting! I wasn't aware that IP address is considered personal data under GDPR... That seems exploitable...

In what way are you thinking IP address as PII is exploitable?

My first thought is that you could impersonate a person by spoofing their IP address. PII identifies a person but I don't think anyone is advocating for (solely) IP-address based bank logins.

What site you run and why you need to log my personal data(IP,browser,other identifying data) do you have good reasons to keep it forever or you purge it after you analyze it?

How is IP and browser personal data ? If you think it is, you should not be on the internet.

IP and browser fingerprinting is used to identify you around the internet, why would someone need to fingerprint me if it has good intentions. If you wnat some stats on who visits you like countries, what browsers and OSs they use , you can count them and discard the data after you would not need to keep it.

Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time. Personal data consists of things that identify individuals, but also things that can be used in conjunction with other information to identify individuals.

You might not like that, but the regulators are pretty clear on this point.

The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.

That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.

Yes. That's The ICO's position:

https://ico.org.uk/media/for-organisations/documents/1591/pe...

This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers.

Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort.

Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted:

- The tuple (bank account number, country) is enough to target an individual.

- The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß]

Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect.

Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers.

ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.

I have no idea what you mean. I was not talking about GDPR.

Currently, or in relation to GDPR? What's your source?

https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017):

> Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data

> What's your source?

The ICO. I've called them up, and they've confirmed their 2011 interpretation of personal data:

https://ico.org.uk/media/for-organisations/documents/1591/pe...

An IP address is "personal data" in the same way that "lifestyle information" or a "location" is. That someone can combine an IP address with other information to personally identify someone is important, but it doesn't prevent me from logging personal data.

That's their position at the moment. GDPR makes it a bit more explicit: if you can combine the IP address with other information to identify a natural person it becomes personal data.

Sure, but by itself, an IP address isn't personal data.

That's not true; I can only assume you're reading the 2011-era DPA guidance.

Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.

Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1])

[1]: https://news.ycombinator.com/item?id=17060280

The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.

Jurisprudence in this area disagrees with you:

"online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user"

http://curia.europa.eu/juris/document/document.jsf?text=&doc...

This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data).

So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.

I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example).

I understand that's not the outcome you're looking for.

I'm ignoring German opinions since Art 51-52 suggest only the ICO is going to be involved.

> if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.

Using IP addresses for audit and security is best practices; I can use the IP address to make sure that a user isn't logging in from two countries at the same time (and then require a call e.g. to whitelist).

Thinking of an IP address in binary, as you're suggesting is extremely dangerous: The GDPR is not supposed to prevent you from thinking about what you're doing.

> That's reflected in their site (I gave you a specific example).

Your example doesn't come out and say IP Addresses are always personal data. Try again.

They've previously said the opposite:

https://ico.org.uk/media/for-organisations/documents/1591/pe...

So, three things. First, the case reference I gave you. That "German opinion" is from the Court of Justice of the European Union. This is the highest court that applies, and the ICO must obey it (until Brexit - and even after then, it's highly unlikely that the UK will interpret the GDPR in a different manner, at least for some time).

Second, I've said before IP addresses might not always be personal data. But the issue is they sometimes are, and if you record them without discrimination then you're recording personal data. The old guidance says "An IP address is only likely to be personal data if relates to a PC or other device that has a single user" - ok, so are you able to not record IP addresses that do relate to a single-user device? No?

Third, the ICO do think IP addresses count. I've given you a GDPR reference already, even their DPA tool treats them as such:

https://ico.org.uk/for-organisations/making-data-protection-...

It genuinely doesn't matter what the ICO might have said in the past. Right now, they say IP addresses are personal data. The courts say that. The law says that. I've given you multiple references for all of this.

> the case reference I gave you.

Says:

a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

if you're not the Internet Service Provider, or more broadly, that you don't have "legal means which enable [you] to identify the data subject with additional data" then the ruling doesn't mean what you claim it says.

You're being intellectually dishonest by trying to tie irrelevant sources of information. That the high german court took a broader look than the European court is irrelevant.

> their DPA tool treats them as such

It says, as I've agreed, that an IP Address could be personal information. You've also agreed this position. The ICO does not consider IP addresses [by themselves] personal information.

What exactly are you still responding to?

> Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time.

That's actually the most frightening thing I've heard in a long time. Does the GDPR actually make that connection? If so, it literally links people to an IP address, rather than simply a connection.

If that line is accurate, I'm surprised it hasn't been mentioned before, associating an IP address to an specific person. I have to believe you are wrong, otherwise the legal implications are scary.

For those that don't understand: my concern is that in the US, for a long time, in copyright claims by the RIAA or MPAA, for example, was to go after someone because of an IP address, a common defense was basically: An IP Address is not a person. The above commenter made the claim that an IP address alone can be associate a specific person. So, I'm wondering if 1) that's accurate and 2) what are the ramifications of an IP address being a person in the world of law enforcement?

Yes, it explicitly mentions it, because it's actually very often true. Of course there are plenty of examples where it would be extremely difficult to link to an individual, but there are tonnes of examples where it's extremely easy. GDPR says that because it's sometimes easy, you have to consider it personal data.

Again, it's not always saying an IP address is a personal identify. It just is often enough.

> Again, it's not always saying an IP address is a personal identify. It just is often enough.

Well, that's not what you said or implied. I'm just thinking of all the cases in the US were the defense is you can't assume that an IP address ties to a specific person. Anyone could use the computer, or someone could attach to an open wifi.

Basically, if the legal argument is the IP address can be associated with a person, that raises legal concerns.

I said they can be used to identify an individual in a moment in time. That's correct.

Can it always identify an individual? No. Is the standard of identification good enough for a criminal case? Certainly not. But why are you comparing these? The GDPR is a standard about privacy and data protection; a UK postcode (like a zip code in the US) is considered personal data for exactly the same reason.

No, the GDPR does not actually link people to an IP address. The GDPR never even refers to an IP Address, and where it refers to an Internet address, it is clear it's referring to email addresses.

The ICO (furthermore) has given guidance that they don't think an IP address is uniquely identifying an individual, and have confirmed this to me on the phone.

Where you get into trouble is in transmitting your browser logs/activity to a third party who wants to keep them for their own purposes (e.g. Google). In this circumstance, you have to let people know that you've done this, and to transmit their preferences that you receive onward.

So your face is also not personal data, in your opinion?

The sensitivity of data can change based on context. My name isn't sensitive until it's attached to something like browser history or medical files.

The article we're in the comments for is about the GDPR - as defined in article 4 of the GDPR, IP addresses constitute personal data. In many cases, a specific IP address, even a dynamic one, can be used to uniquely identify a natural person.

https://gdpr-info.eu/art-4-gdpr/

Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected.

Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.

I actually think you need to do some homework if you honestly think so.

Anything and everything that’s about a person in any way is personal data.

IP and browser information are definitely PII, which is Personally Identifiable Information. Those are PII, because they can be used to personally identify an individual.

PII is not a GDPR term, by the way.

Correct. There is a similar concept, but it is not the same as PII in the US.

Recital 26:

To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

Since the concepts mentioned in the comment, IP and browser information, are already being used to single people out for tracking, those particular types of information can definitely be viewed as the equivalent concept under GDPR, as defined in Recital 26.

IP address alone on an anonymous web access log need not be. Start combining it with persistent cookies or a logged in user etc and it clearly becomes personal data as it is then enough to identify someone.

The clause in the regulation is quite clearly worded:

"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."

How can a SAAS defend chargeback claims without IP address? Stripe stores IP address and the proof that the user paid for the subscription using the same IP and created an account ties them together.

Have a timeout, that may be a valid reason to store it for the chargeback limitation (120 days IIRC) but definitely not a valid reason to store it forever, as the parent post was talking about.

Serious question: What are the odds of someone offical even noticing that you are in violation of GDPR? It's not like they'll enforce GDPR and collect $7.89 in fines from small businesses.

Why would you care about someone official? I'd care more about a bot that is set up to save the officials some work.

A good question. But that’s not how these things work. The law has to be self enforced or it’s useless - since as you say, how will small to medium businesses ever be caught violating?

Megacorps comply because of mega fines.

Small business comply because their owners or future buyers are a larger Corp who fears that their sub-subsidiary might be in violation, causing a future mega fine.

So small businesses who care about the value of their company follow these rules. It’s almost exactly the same reason small business buy software licenses. It’s not of fear of fines but because otherwise they don’t look like a serious company.

I question I have been wondering is how many companies will leave some violations such as data in backups - simply because removing it is too expensive so it’s a risk worth taking. I honestly haven’t understood how backup of data fits into the requirement to delete data of a certain age?

All it takes is one disgruntled employee

GDPR has the concept of backups and their expiration windows covered.

I'll pick an example from my work. Data can be deleted from the active set, at which point it takes extra effort to retrieve it. (If you can't SELECT it anymore from the warm slaves, it's gone.) But as long as you can make a point-in-time-recovery from your backups, the data is still present in the inactive set. Using the inactive set requires, by definition, extra effort.

So you need to state that fact in the data protection/retention policy, AND put reasonable technical enforcement mechanisms ("controls") in place to ensure that backups are expired and fully deleted after a given retention period. The older your unexpired backups get, the less valuable they should become.

Minimum fine is $20 million, isn’t it?

No. It's part of the calculation for the maximum fine.

The maximum fine is defined as €20,000,000 or 4% of your global anual turnover, whichever is largest.

Yep

> Up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher

https://www.gdpreu.org/compliance/fines-and-penalties/

What are the odds of someone offical even noticing that you are in violation of GDPR?

Plenty of ordinary people will be actively looking for opportunities to file GDPR complaints. I know I will. This is a crusade. Taking the Internet back from adtech.

Are you going after amazon or my neighbours small online flower business?

If they have Google ads they’re fair game.

It depends, for example a local restaurant mini-chain has been doing some spamming and refused to take me off their list, so if I get a single message from them after May 26th, I'll definitely file a complaint. From the consumers perspective, the main GDPR effect is that things that previously were scummy but legal have now become forbidden, and some of the things that have been forbidden but not enforced now have an enforcement mechanism with teeth to make it happen.

Why do you need analytics, aside from ads and ad-tech?

...to understand whether I'm reaching my target demographics e.g. for the sake of the success of my non-ad-related business?

And to see what devices you should support? If all your traffic mobile? Maybe the mobile version gets more love. Lots of old ie users? Guess you gotta use old school css.

Now that I think about t I’ve never used analytics for anything ad related.

If someone hits you from an iPhone 6 in turkey you can just incrementally your count of those two values without needing to store that IP 13.157.207.156 is in turkey and has an iPhone 6 and youve correlated that data through Facebook's ad network so that now they having a profile built around them despite not even having a Facebook account.

Everyone's been sucking up all the data they can just in case they need it, and actual people are being harmed by it through data breaches. I get why people are upset about these changes happening to their businesses, but what did everyone expect when the industry has failed to self regulate against their worst excesses? The rest of society isn't just going to let you hurt them so you can make more money

How can you tell what demographic am I in just from my IP and browser fingerprinting? Do you have more sites or correlate the data with third parties?

I think is fine if you just count the browser,OS, and country the user is from but I don't think is OK to keep more details then that

Security, such as analyzing how quickly a form is filled out, or whether the person is coming from a location that is known to be home to a lot of fraud, and other such checks, for example.

Using that data as well to improve learning so we do a better job of detecting fraud and not flagging legitimate customers appropriately.

Also, using analytics to determine if a user is having issues on the site. For example, are users having a difficult time filling out forms, or becoming confused, and being able to provide help in an appropriate manner.

These are just two things I immediately thought of. Security, and customer support. I'm sure there are many other users of analytics aside from ads and ad-tech.

Analytics is a broad term, and covers things like "how many of my users use this new section of my website" or "Let's A/B test a new navigation menu".

To provide data for UX decisions?

You shouldn't need to keep any personal information on your visitors to get meaningful data.

How can AB testing work without storing personally identifiable information?

AB testing doesn't require personally identifiable information.

How do you bucket users into a control and enabled group without having some way of identifying them? (usually ip address)

Why are you bucketing users? If you have some sort of current session for their presence on the site, flip a coin and assign them your A or B. Store nonpersonalized info about their experience on the site associated with the given A or B.

You could for example bucket them based on the last digit of their IP address.

So, everyone whose IP address ends in 0, 1, 2, 3 or 4 gets the new version, everyone else gets the old version.

You don't need to store the IP address for that, you just need a rule that decides which version to serve as the user requests it.

Generate stand-alone, opaque identifiers for whatever sessions you want to analyse. Make sure these tags are ephemeral and decoupled from anything else.

Then, store only the flow data, discard everything else. Or if you need to keep some data around for the test duration, delete all of it once your A/B test has concluded.

Sounds like you'll have some urgent reading to do when/if you receive your first GDPR access request.

Yes, that is wrong. You MUST tell your users that you are tracking them, and what the data you collect will be used for.

Reply on news.ycombinator.com