so if i visiting xy.com and they trigger a cloudfalre challenge before showing me the data privacy rules and allow me to opt out they are violating the GDPR
the hoster of the website is allwoed to store the ip adress if: - the owner of the site has a "avv" (dont find the english term, data protection agreement)
but most privacy statements include a condition to allow free use of the ip adress. BUT if i want to do this i have to show the privacy statement BEFORE i collect the data. Same with 3-Party calls like challenges.cloudflare.com
Yeah, I'm just wondering how that works for a firewall for example. If I am not allowed to use your IP address(blocking via Firewall) before showing you a Privacy Statement, then all anyone would need to take down my website would be to DDoS my Privacy Statement
as far as i understand that is no problem because the processing of the ip trough the firewall is technicaly neccessary. If you use a blacklist on your firewall the content of the blacklist is not affected by the dpr because it is technically neccessary to save this ip adresses for a longer time. the ip adress of the visitor has to be deleted after a given limit (7 days i think, maybe 30) if there is no problem with it. (it is allowed to keep the address longer if the visitor seems to "attack" the page)
So if I were to build a service that used IP, along with other signals from the browser, to prevent more sophisticated kinds of attacks before showing the user a privacy agreement, would that be ok, assuming that the privacy agreement would be available after they pass those checks?