Hacker News Reader

Comment by Hamuko | Hacker News Reader

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

View on HN

GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR.

GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.

You say "or" but then just give examples of what I said.

> law infringement implications

They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation".

Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.

yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches.

> You say "or" but then just give examples of what I said. > law infringement implications

No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.

> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal.

The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.

See: https://blog.cloudflare.com/privacy-first-web-analytics/

I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.

Found it*

> Should be GDPR compliant since they don't use cookies or local storage.

That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.

GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.

The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.

If data about EU citizen goes outside EU, it is illegal.

Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.

Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it.

One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.

As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data.

You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data.

As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA.

https://medium.com/@christhaefner/shopify-illegal-in-germany...

Reply on news.ycombinator.com