Can someone tell me if this is even true? Plausible doesn't save any GDPR related data as far as I know?
https://plausible.io/privacy-focused-web-analytics#no-person...
And the backend is hosted @ Hetzner in Germany
https://plausible.io/privacy-focused-web-analytics#no-person...
And the backend is hosted @ Hetzner in Germany
Personal data is "any information relating to an identifiable individual" (see GDPR art 4(1).
Your IP address, browser and OS (via user agent), the website you visited, the pages you visited, time of visit, the site you came from (via referrer) are all personal data.
If Plausible have put a US owned cloud provider in-front of their Hetzner infrastructure, even if for a legitimate purpose (CDN, DDoS prevention) then that is likely an unlawful transfer of personal data to the USA.
No. These are all not considered PII. Only the IP address in this list definitely is.
All other information with a wholly anonymized user would be considered by most interpretations to be ok. Often it depends on the context and presence of other meta-data on whether something is PII or not.
It certainly includes the items I listed; particularly when linked to an identifier like an IP address.