GDPR - Can I store domain names?
<p>I create the code that everybody can download for free and use on their website (MIT licensed).</p>

<p>In that code, I want to put the additional code sending requests to my server if the domain name is different than the one used by web browsers when developing locally (<code>window.location.host</code>)</p>

<p>It would not store any additional code (no cookies, no local storage) in page visitors' web browsers.</p>

<p>To download the package, you do not need to register to the service. There are many download methods, including </p>

<ul>
<li>direct download from my website or Sourceforge</li>
<li>download from 6 public third-party code repositories (GitHub, GitLab, BitBucket, Beanstalk, Sourceforge, Launchpad)</li>
<li>download from package managers: Composer, NPM, NuGet and RubyGems (and Yarn and Bower in the result of NPM)</li>
</ul>

<p>And it is very important to me that my package stays that widely available.</p>

<hr>

<p><strong>Question:</strong> How can I approach this to be GDPR compliant? </p>

<p><strong>It already is compliant</strong></p>

<p>GDPR stands for General Data Protection Regulation, and it related to how personal data is stored and processed. By tracking how many users are using your service or which countries most often use your service is not classed as personal data. For example, you may be aware that 23 users are actively using your service right now - that's not personal data. Even if you have a list of IPs that are currently connected &amp; actively using your service, it's still okay. As long as you keep this data to yourself and only access it when you need to. Storing a list of IPs or domains that are currently using your service is not personal data.</p>

<p>Domains themselves fall under GDPR as personal data.</p>

<p>Here is why. Regardless if you have the information or not, someone does know who that domain belongs to, IE a natural person. Thus the same logic which makes IP addresses personal data applies.</p>

<p>For that downvote: article 4.1:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>

<p>Keyword there “online identifier”. So even a username falls under personal data.</p>

gdpr