Hacker News Reader

Storing a cache header is not an issue, but if it is used as a unique identifier for user analytics purposes, it is almost certainly personally identifying information, at least after combining with other data. Since they are not disclosing that they store something they use to ID users, it is likely a GDPR violation, at least in spirit, and that spirit is exactly what GDPR seeks to control.

View on HN

> after combining with other data

The post says that they don't combine datapoints because that would negate privacy.

They don’t but anyone using their service could.

It is personal data regardless of how it is used. The only question is if that use of personal data is permissive.

Using it for user analytics, which is neither required to run the service, nor in the users interest, nor reasonably expected by the user, is almost definitly illegitimate use.

Reply on news.ycombinator.com