2

The General Data Protection Regulation (GDPR) (EU) is a regulation in EU law on data protection and privacy for all individuals within the European Union.

-- Wikipedia

I have a low-traffic, personal blog hosted on GitHub Pages. It uses Google Analytics, AdSense, and Disqus. I don't currently have a contact form, but I may add one. I have visitors from the EU / EEA, but not because I target anyone who lives there.

In terms of Google Analytics, I don't track user IDs, demographic information, or use "remarketing" functions outside of the default configuration. (See "Granular opt-ins" at "How to make your static website GDPR compliant in examples".)

What action(s) do I need to take for GDPR before May 25th, 2018?

For example:

  • "Prior consent on other than strictly necessary cookies"
  • "Prior consent on personal data"
1

Do you need to? No, of course not.

But you'll be out of compliance if you don't.

Whether you target EU visitors or not is immaterial. If they arrive at your site, you need to get consent. You need to disclose in plain language what personal data you collect, how you collect it, under what legal basis (there are only a few valid legal bases), and who else sees these data (Google and Disqus at least, probably much more).

There's a technical part of it, too. You can't serve anything except strictly necessary cookies before getting consent. If they arrive at the site, and your site puts the GA cookie on their computer before you've gotten consent, you're in violation.

I'm in the middle of doing this for my site, and it's work. I suggest you investigate very soon.

  • Thanks for the response. I may be misunderstanding, but it seems like part of this answer doesn't match up with this writeup. See "Granular opt-ins" here: getpublii.com/blog/website-gdpr-compliant.html – Benjamin Oakes May 19 '18 at 13:01
  • Your questions seemed to be more of the flavor "do I need to do anything" vs. "do I need to do X." I was saying, "Yes, you do need to be concerned about GDPR." But responding to your comment: Granular consent is still consent. – John May 19 '18 at 16:47
  • "the basic configuration of Google Analytics which most people will use does not collect any identifying information and doesn't conflict with the GDPR, so no consent is required from the user" – Benjamin Oakes May 19 '18 at 18:13
  • @BenjaminOakes how do you say that? – Marian Paździoch May 21 '18 at 11:21
  • It's a quote from getpublii.com/blog/website-gdpr-compliant.html – Benjamin Oakes May 21 '18 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.