fenier
Joined 13 years ago
Karma
205
Submissions
119
Member since
Jun 30
Personalization, AB Testing, Web Analytics, Privacy, Security
View on Hacker NewsRecent submissions
Comment · 2 years ago
Even if you do not have to comply with GDPR, 12 States have passed data privacy regulations to date. You may still need to comply with data protection law regardless if you qualify for various State laws.
Even if State law doesn't apply - you have have HIPAA, GLBA, SOX etc.
Comment · 2 years ago
The U.S. and the EU signed the Data Privacy Framework over this past summer. https://www.dataprivacyframework.gov/s/ This offers methods for EU residents to exercise claims against U.S. businesses.
Among other requirements, a participating organization must provide you:
Information on the types of personal data collected
Information on the purposes of collection and use
Information on the type or identity of third parties to which your personal data is disclosed
Choices for limiting use and disclosure of your personal data
Access to your personal data
Notification of the organization’s liability if it transfers your personal data
Notification of the requirement to disclose your personal data in response to lawful requests by public authorities
Reasonable and appropriate security for your personal data
A response to your complaint within 45 days
Cost-free independent dispute resolution to address your data protection concerns
The ability to invoke binding arbitration to address any complaint that the organization has violated its obligations under the DPF Principles to you and that has not been resolved by other means
Comment · 2 years ago
While you asked about GDPR, the banners are actually required for many use cases by the EU ePrivacy Directive[1]. This use case is both more broad, and different than those afford by GDPR. However it's possible both can overlap and you can be sanctioned for both items at once.
Not every website is subject to GDPR - applicability is determined by GDPR Article 3[2]. When a site is subject to GDPR - you need a legal basis to process personal data[3] subject to Article 6[4]. Sites which use the 'consent' legal basis, thus get consent with a banner.
If you do not have a valid legal basis (such as consent) to process data, but are found to be - complaints with the relevant Data Protection Authority may be lodged and investigations may be carried out subject to Article 77[5]. In the event of an adverse decision corrective action, including fines may be levied. There are two fine structures in the GDPR, and those can be found in Article 83.[6]
Now, a site can use geofencing, to determine if you are in the EU (or other relevant location) and selectively show you a banner or not based on your believed location as is determined by a reverse IP Address lookup.
You may be re-prompted between visits depending on if the persistence mechanic you select is maintained. Some browsers delete cookies aggressively[7], and if the preference cookie is removed by the browser you will likely be issued a banner on the next visit to re-establish your preferences.
[1]https://gdpr.eu/cookies/ [2]https://gdpr-info.eu/art-3-gdpr/ [3]https://gdpr-info.eu/art-4-gdpr/ [4]https://gdpr-info.eu/art-6-gdpr/ [5]https://gdpr-info.eu/art-77-gdpr/ [6]https://gdpr-info.eu/art-83-gdpr/ [7]https://webkit.org/tracking-prevention/
Comment · 3 years ago
Data Privacy efforts are heavily slated to impact Analytics quality / volume in the next several years.
On the technical side we have things like Apple's Intelligent Tracking Prevention, App Tracking Transparency, Mail Tracking Transparency and Link Tracking Protection, Chrome is finally about to phase out 3rd party cookies and browsers like Firefox and Edge lock down or block common web tracking technologies. - just to name a few. All of this combines to add noise, or a reduction in volume which impacts analysis efforts.
On the regulation side, we have global laws such as Europe's GDPR, 4 US States with current data privacy laws in effect, and a total of 12 US slated to take effect before 2026 - all of which are slightly different in impact scope. This results in scenarios that even if you technically can collect data, you may not be legally allowed to, or, alternatively prevented from using it in specific ways.
This will force companies to switch back to Media Mix Models for attribution and adopt new privacy focused solutions for existing use cases to some extent.
Data analytics is getting more complex, not less. However that results in a massive amount of needed learning on a continued basis - which may not be for everyone.
Comment · 3 years ago
Write a blog (history is valuable here, speak on Podcasts, Present at Conferences, be active on social media.
This can lead to people offering you positions that aren't publicly posted, because via your engagement they feel they understand you enough that you should be able to fill the role they have in mind.
For example - I write 20 blog posts going in depth on some topic - there's a decent chance I may actually know that topic. When that skill set becomes critical to someone - the odds are higher they'll contact me for that skill set because chances are, I'll be top of mind through sheer volume or quality of information I have written about that skill.