[MonkeyMalarky]

Instead of a nasty console message or popup, modify the script to ping back more detailed and useful information about where its being used. Then contact the developers.

Edit: you don't even need to write anything dynamic to receive the ping back, just have the script load an image from yoursite.com/specialprefix/the useresencodedbrowserurl/anythingelseinteresting/1.png then look in your server logs for any 404 errors with the prefix?

[tantalor]

And you are now in violation of GDPR

[toast0]

Isn't the site owner in charge of GDPR for the site? Aren't they already non-compliant by hotlinking a resource from someone where there's no agreement about personal data? Wouldn't it still be the site owner's responsibility not to let a 3rd party send even more personal data over?

[tantalor]

The code is fetched from your domain, you are responsible for what it does and what you are collecting.

[MonkeyMalarky]

I'm not an expert on GDPR at all so forgive me if these are dumb questions but how? I thought GDPR pertained to a user's personal info? Sending back info about the webpage the script is used on isn't the same. Also who would be in violation, the leachers or the OP? Does GDPR even apply if OP is just a random person on the internet and not a company operating in the EU?

[Macha]

The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.

[rpeden]

If OP has server logs, that is already happening anyway since the initial request to load the script is coming from the users' browsers, not from the site linking to it. That might be a reason in favor of disallowing the linking entirely even though it would negatively impact the users of the sites doing the hotlinking.

[MonkeyMalarky]

IP addresses in your http server log are a violation? Well then you may as well fine every hardware owner and ISP middleman between me and the user!

[tantalor]

Now you are starting to catch on.

[interroboink]

And just to be clear, a legal basis can be established even without user consent via Article 6.1(f) — "legitimate interests" [1]. Though it is a grey area and not well-tested in courts (AFAIK) how to balance those interests against the data subject's rights, in any particular specific context, such as the one currently being discussed.

For instance, I've seen plenty of claims that storing IPs in logs is fine for "security purposes", though I don't know of any court cases specifically affirming that.

[1] https://gdpr.eu/article-6-how-to-process-personal-data-legal...

[pessimizer]

I might be missing something, but people who hotlink your scripts aren't your customers or users, and you shouldn't have any obligations towards them. Can people hacking your site sue for GDPR violations to get you to delete the logs of their hack?

[dylan604]

if that's true, how is every single tracking pixel on the web not in violation of the GDPR?

[Macha]

I mean, every single tracking pixel on the web is a GDPR violation, unless they've established a legal basis to do so. As basically all of noyb's complaints being upheld by DPAs shows, most fail to do so, clinging on to legitimate interest when they fail the balancing test, or consent when the consent form is too deceptive or tipping the scale to count as freely given