Post #2315768

2026-05-09 10:12 UTC

@malwareminigun@infosec.exchange @nik@toot.teckids.org Typical article 8 German GDPR problem. You need explicit parental permission to handle (note the “handle”, not just “save”) PII of ppl under 16 (and the IP address hitting Apache/NGINX counts as a PII, therefore every website is technically 16+ until someone wants to fight this in court).

Replies (4)

@nik@toot.teckids.org 2026-05-09 11:05

@fuchsiii@oxytodon.com @malwareminigun@infosec.exchange This assessment is almost entirely wrong.

Open ##2315769
@argv_minus_one@mastodon.sdf.org 2026-05-09 21:05

@fuchsiii@oxytodon.com And the EU Commission recently had the audacity to claim that, and I quote, “In the EU, you have the space to speak your mind without having to shrink who you are.” Apparently that flowery little speech doesn't apply to young, eager programmers. 🤦‍♂️ https://ec.social-network.europa.eu/@EUCommission/116437170867569557 @malwareminigun@infosec.exchange @nik@toot.teckids.org

Open ##2315773
@kleisli@mastodon.social 2026-05-10 11:01

@fuchsiii@oxytodon.com if this was true, I'm sure there would be a truck load of lawyers trying to make some money out of it. Maybe there are, but I never heard of it. @malwareminigun@infosec.exchange @nik@toot.teckids.org

Open ##2345153
@fionasboots@tech.lgbt 2026-05-10 13:20

@fuchsiii@oxytodon.com @malwareminigun@infosec.exchange @nik@toot.teckids.org is an IP address PII if it's NAT'ed? Surely not since numerous individuals could have that IP:port pair over a period of time. Would IPv6 count if not-NAT'ed? While it certainly can be used to get to a specific machine an IP with MAC address embedded (from SLAAC) hardly identifies the person on it's own. IANAL so I'm trying to be sensible, I accept that legal garbage might not be!

Open ##2345159