fmaury/seirdy.one
1
0
Fork 0
mirror of https://git.sr.ht/~seirdy/seirdy.one synced 2024-09-19 20:02:10 +00:00
Code Issues Projects Releases Wiki Activity

New note: limited tracking and consent

Browse source
This commit is contained in:
Rohan Kumar 2022-09-24 11:31:34 -07:00
parent 8fb4fa17a4
commit 5cff141cb3
No known key found for this signature in database
GPG key ID: 1E892DB2A5F84479
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
content/notes/limited-tracking-consent.md Normal file
View file

@ -0,0 +1,17 @@
---
title: "Limited tracking and consent"
date: 2022-09-24T11:28:34-07:00
replyURI: "https://indieweb.social/@Chronotope/109054613809239268"
replyTitle: "if the initial collection is very limited it doesn't run afoul of the issues that should require consent"
replyType: "SocialMediaPosting"
replyAuthor: "Aram Zucker-Scharff"
replyAuthorURI: "https://aramzs.github.io/aramzs/"
---
Assuming data is a liability, how limited should data collection be to not require consent?
I think temporary storage (a week or less) of access logs combined with low-entropy binary information (dark mode, is viewport narrower than what I test with, etc) is reasonable for a small operation. This holds if the data collection is clearly documented in a privacy policy, is Tor-friendly, and obeys signals like GPC. These access logs should exclude high-entropy headers like client hints.
Larger operations should store even less since they have the means to correlate information from many sources. [ipscrub](https://github.com/masonicboom/ipscrub) comes to mind.
The only long-term storage that should happen without consent is of bot traffic.