@sam yes, the EU’s hypocrisy on this is quite amusing!
Given the punitive fines, I imagine many small forums will be nervous about the GDPR - not because those forums are doing anything unethical with personal data, but because there is a danger of their competitors using the poorly-defined law to raise spurious cases against them.
I, for one, have suffered multiple attempts at disrupting my (harmless local community) forum. Attempts which probably originated from my erstwhile competitors or people who personally disagree with my views. There are a lot of vindictive cowards out there - and when running a forum, you become a target to them.
Regarding steps to take to protect Discourse forum operators from fines and harassment under this new law, I think the following might be worthwhile:
- No cookies stored at all for non-signed in visitors
- Google analytics disabled for non-signed in users
- A consent checkbox (default unchecked) on the sign up screen, with a brief summary of which personally identifying information will be stored and which will be transmitted to Google Analytics (if enabled for the forum)
- Consent form shown to all existing members, with consent required to continue using the forum - in fact we may have to go further here - removing any personally identifying data on members who have not logged in, seen and given this consent before May 25th.
- Send partial IPs to Google Analytics to avoid unnecessary transmission of personally identifying data
- No IP addresses stored in the Discourse DB - all should be hashed in an irreversible way and this data stored only temporarily, for the purposes of sock puppet detection.