undefined | Better HN

0 pointslucideer4y ago0 comments

> how does that not also violate French data protection?

The regulations don't ban collecting IPs (nor any PII). They just regulate it to the point that it must be deemed necessary according to certain criteria. I would imagine linking an image may be fine in 95% of cases, but what it would mainly depend on is the logging practices of the image hosting company. Their business would be bound by EU regulation if they are choosing to sell service to an EU-based website, and it's likely that image host that would be liable for compliance.

It's worth adding quite a lot of the regulation here is tied to company size, revenue and scale of data sharing in general, so if you are for example a small business/non-profit you're very likely to be fine either way.

0 comments

tyfon4y ago

It would probably depend on the purpose. If the purpose is the show the image and all logging is done to an access file and not processed into advertising models I'd think it would be ok.

if the purpose is to collect PII and build advertising models like it was with the google fonts or the 1 pixel images then it is not ok.

drusepth4y ago

>Their business would be bound by EU regulation if they are choosing to sell service to an EU-based website, and it's likely that image host that would be liable for compliance.

Is the image hosting company really _choosing_ to sell service to an EU-based website if someone adds <img src="http://blah.us"> to their (French) website? It seems like it'd be an unreasonable expectation upon a company (especially one in a completely different country/jurisdiction) to e.g. ensure their existing logging practices _also_ comply with French, Austrian, etc laws.

Surely the user who adds/posts the image on a French site would/should be liable here, not the host of the US-based image (service?), no?

lucideerOP4y ago

This largely depends on whether the French website is a paying customer hosting their own images in a deliberate fashion (e.g. Amazon being responsible for facilitating GDPR compliance of S3 logs), or if it's a randomly hotlinked non-owned image.

In the latter (hotlinking) case the French website would almost certainly be entirely responsible if they operate at scale (excepting user generated content). In the former, it's obviously less clear cut (and also as mentioned revenue & scale are going to be very relevant).

Practical example: a private individual posts a hotlinked image on a French forum. Relevant questions:

- is that user profiting at large scale from data logged on the image server? No.

- is the forum website owner? No.

- is the image host deriving revenue directly from proactively collecting, analysing and profiling user data from readers of that forum post who are based in the EU? Possibly.

- is the image host doing so at large scale? Maybe.

3 & 4 are definitely true of Google Analytics, but broadly won't be true of many image hosts, so your image linking example won't be an issue most of the time.

j / k navigate · click thread line to collapse