Avoiding legal/privacy problems with public hosted allsky website

[markusd112]

Here in Germany and the European Union, it is problematic when personal data is passed on to third parties when a website is accessed. This can happen, for example, through the use of Google Fonts, when the browser then passes the IP address of the website visitor to the Google servers without the user's consent.
The Allsky website seems to use Google Fonts, among other things, and also download scripts from other servers. It would be good if only local scripts and fonts were used.

https://www.cookieyes.com/documentation/google-fonts-and-gdpr/

[EricClaeys]

@markusd112 (Mark, I assume?),
Thanks for pointing this out. I was wondering if we needed to do anything with the general protection rule.
I will look at copying the 3 files we get from other servers onto the Pi. I wanted to avoid having to ask for concent if at all possible.

Is there anything else we need to do?

Thanks for all your posts, and keep them coming. We can't fix what we don't know is broken.

Eric

[markusd112]

@EricClaeys I am only a "volunteer website admin" and no lawyer/jurist. I have read about the problem with the google fonts and had checked my websites. I am not using any google fonts, only local ones to avoid any problems.
Another issue is if the website sets cookies that aren't really necessary to get the site working, e.g. some additional cookies for statistics, advertisements, etc. Then you have to ask the website user for consent. If the cookies are only technically necessary, it is sufficient to describe this in the privacy policy. As I see, the allsky software doesn't set cookies on the remote (public) website.

The GPDR (in germany it is called "DSGVO") requires that you have a privacy policy on your website that contains certain information, which data is processed, who the contact person is, etc.
Maybe you could simply insert a link on the AllSky-Website template to a privacy policy html-file, that could be edited by the user in the AllSky backend with the editor in the WebUI that is used for the other config files and is uploaded to the remote website if it has changed.

Here is some link to the european GPDR legal texts:

https://gdpr-info.eu/

[EricClaeys]

We plan to use only local files in v2024.12.06_01 which will be the first point release to the new v2024.12.06 release coming out next week.
I'll try to add a user-modifyable privacy notice in v2024.12.06_02.