Hacker News new | past | comments | ask | show | jobs | submit login

Personal information about yourself which you have to include on your website, and how to register it, depends on the laws of the country you reside in (e.g. Germany has strict requirements on this), so I can't say anything about that in general, but I believe most countries have pretty lax rules here, which should make it totally fine to run your a personal website.

I can say something more sensible wrt your GDPR and "cookie" questions:

The GDPR has one overarching principle: "data minimalisation".

There are no requirements to preserve things like access logs, but rather the opposite: you should only retain personal information for as long as you _need_ it - and then once you no longer need it, you should remove it. And while you have the information, you should take meaningful steps to secure it, where the definition of that changes based on best practices over time.

The important thing here is that you think about what information you need, for what purpose (so something specific like "prevent abuse" rather than "it could come in handy at some point"), and then consider the tradeoff between privacy of your users and your own need for the information (and document this thinking in some way, so that you can later prove that you've done so).

So for those access logs, write down that you log e.g. ip address, timestamp, UA string, referer, visited page (possibly including querystring with search terms), that you retain this information for 2 weeks, maybe that you then aggregate it in some ways, and that you'll delete the information after this time. Your purposes for doing this are probably insight into usage patterns and detecting and fighting abuse. You're explicitly not connecting these logs to other data sources to identify specific visitors, nor sharing this information with any third party, so you believe the privacy impact for your visitors is minimal.

On your website, have a page (accessible from anywhere, so e.g. linked in the footer) that says the same. Specific wording effectively doesn't matter, but what does matter is that it's understandable by your average visitor.

As for cookies: "Functional cookies" (shopping cart, "remember me" function etc) you can set without any permission. "Tracking cookies" (advertising, analytics, etc), you can only set based on explicit and voluntary permission (visitors need to be able to say "no" as easily as you say "yes", without negative consequences, and if they say give permission, they need to be able to withdraw it just as easily at a later date, so one-click in the footer or somesuch - they also need complete and understandable information what they give permission for, so put that in the question, and link to a similar page as above for the GDPR).




I am in Germany, so the requirements definitely apply to me.

I appreciate the effort. Clearly there is quite a bit of effort involved to comply with just EU law. To me the legal aspect is the largest hurdle, it turns a fun weekend project into wading through unbearable legal requirements and in the end I still will not know if I am actually in compliance.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: