Hacker News Reader

Comment by logifail | Hacker News Reader

(Sorry for sounding like a stuck record but)

This site appears to use affiliate links/cookies/Google Analytics, so is surely collecting personal data in the GDPR sense?

If so, why is there no opt-in/opt-out screen?

The whole "ask for forgiveness not permission" thing is getting pretty old, why is it still apparently OK to build a shiny thing, make it live, and then think about compliance with the law?

View on HN

Developed by people outside the enforcement of the EU? The law may technically apply, but how enforceable is it against a foreign national with no EU assets?

> The law may technically apply, but how enforceable is it against a foreign national with no EU assets?

Q: Shouldn't we all aim a little higher than "this law may well apply but isn't enforceable due to X"?

The site actually doesn't use cookies internally only session and local storage to hold variables through visits. I'm not based in Europe so I'm not entirely familiar with GDPR and how it relates to affiliate linking and google analytics. Thanks for pointing this out, I'll be sure to do some research and fix up the site to accommodate it.

I'm never holding PII at all except when you sign up to email updates

My $0.02 is that:

If you're using Google Analytics to track visitors, you need their permission beforehand.

If you're tracking visitors uniquely so that click-throughs to merchants earn you revenue via affiliate schemes, you need their permission for that, too.

See https://law.stackexchange.com/questions/82133/are-auto-gener...

Reply on news.ycombinator.com