No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph):

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

What is "the identity" supposed to be, exactly? What forms of identity are allowed by the GDPR?

For example, I wonder if the domain name of a website can be considered an acceptable form of identification, allowing you to say that the data controller is "yourwebsite.com", for example. And the contact details could just be an email address on that domain, for example. Because if this was not possible, and if it was always necessary to specify the controller's name or a company name, then it would not be possible anymore to own an "anonymous website". Somebody might want to start an anonymous blog called "controversialstuff.com" and have a right to remain anonymous. How does the GDPR deals with this?


1 Answer 1


The controller of the data is not (necessarily) the author of the website - only the controller must be revealed, the author can remain anonymous.

  • But the controller is often the website owner, and if the forum is meant to be "anonymous" the controller will not want to be explicitly associated with the website in any way, whoever they are. To me this means a website can't be completely anonymous. Unless it collects no personal data at all, maybe. But if IP addresses should be considered personal data, then there are virtually no websites on the internet that don't collect any personal data.
    – reed
    Oct 29, 2018 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .