Hacker News new | ask | show | jobs
by mcguire 2953 days ago
I have a blog. No ads. No revenue.

1. I have been using Google analytics for their entertainment value. I assume that's verboten now.

2. I assume the IP addresses in my logs are PII. Should I shut off logging?

2 comments

(standard IANAL disclaimers)

1. yeah, probably.

2. There's a comment elsewhere in the thread to this effect, but short-term logging for the usual purposes of managing stability/security of a system almost certainly qualifies as legitimate interest. Don't keep the logs indefinitely, but I figure nginx's defaults with a week's retention period is quite reasonable.

The relevant authorities also have a track record of giving people warnings and time to fix things, so especially for something so trivial, I'd basically just make a good faith effort and not stress about it.

1. No, but you shouldn't need to store PII. Simply disable cookie usage and enable IP address anonymization in Google Analytics.

2. You can simply exclude IP addresses from logging.