Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.)

^ some services may ban you for proxying in this manner without a contract

^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider



> or any other identifying details in the request you transmit

You can definitely still use GA if you really wanted to, just not in any way that uses PII (the default).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: