Hacker News Reader

Comment by Nextgrid | Hacker News Reader

The GDPR for example, which enforces opt-in for anything not strictly necessary for the provision of the service (and no, telemetry doesn't count as "strictly necessary"), enforces the concept of data minimization (which means you must collect & process as little personal data as possible to fullfil your objective) and considers IP addresses as personal data.

View on HN

I reviewed the source-code before adding them to the site. I can’t say for sure IP addresses aren’t stored server-side, so we have to trust them that they don’t, but most tools do find creative ways to get some kind of unique and persistent IDs. For example, Astro computes a hash for the git repository remote URL, and Storybook computes an ID by hashing the first commit hash in the repo.

The intent of the GDPR is to prevent the act of non-consensual tracking and not some specific technical method of achieving that, so even a deterministic ID generation method that doesn't rely on any client-side storage would still be in scope, as would a hypothetical crystal ball if it worked better than random chance at reidentifying a unique user.

> (and no, telemetry doesn't count as "strictly necessary")

I'll start with the caveat that I'm not a lawyer, but I wouldn't be so sure. For example, knowing when your tool breaks for a user so you can fix it sounds like something that you could argue is necessary to make sure the tool works for the user.

I think the standard for "strictly necessary" is whether that piece of data is necessary to provide the requested functionality.

Does submitting an order form for some goods in any way depend on the telemetry requests you sent before/after? Would the order still go through if those requests were missing or fed fake data?

If the answer to the above is true then "strictly necessary" would be difficult to apply. Of course the point is moot because so far GDPR enforcement is not only lacking to begin with but the cases that are investigated aren't given the right technical expertise to adequately determine those answers.

Reply on news.ycombinator.com