← Reference notes

License: CC BY 2.0 Belgium. Source: https://archive.fosdem.org/2025/schedule/event/fosdem-2025-4233-privacy-first-architecture-alternatives-to-gdpr-popup-and-local-first/

Summary

Andrey Sitnik (PostCSS), speaking at FOSDEM on 2 February 2025, argues that the reliable way to protect personal data is not to store it. He treats broker resale and later leaks as the reason a "we will be careful" promise fails, and he says fields that look harmless become identifying once they are joined with other sets. Cross-site analytics that carry a global user id are his main example of collection that outruns any one site's need. Consent popups, in his account, stayed because the industry kept tracking instead of stopping, and a yes/no split makes the remaining sample untrustworthy. Cookieless analytics can still show campaigns, sources, and events. They cannot build a cross-site id or a remarketing list. His test for a team is simple: what decision did this personal data change in the last year? If none, stop collecting it. Later steps are fewer vendors (serve your own fonts and scripts, prefer one host, self-host when you can) and, for a new app, local-first storage. Data stays on the device. A small server only syncs. He contrasts a cloud notebook the host can read with a folder of files the user can sync through any provider. The implementation sketch is a real database in the browser (SQLite or Postgres compiled to WebAssembly), an operation log so tabs and the server apply the same actions, CRDTs when there is no single source of truth, and a second secret so the server cannot read the log. He lists business reasons as well as political ones: a smaller server, a prototype with no backend, cost that does not grow with every user, no personal data sitting in the GDPR pile, and a faster interface. The last section says privacy risks are not only American platform risks. In some countries the dangerous observer is the local network or a street check of an unlocked phone, so the private design can flip. Captions mishear several product names. The claims about particular leaks, companies, and countries are his, not facts this note re-checked.

Why it is here

Askers want to know how to put personal data somewhere safe. This talk answers with a design rule: collect less, keep the rest on the machine, and do not treat a consent banner as the protection.

@misc{iil_note_hgq1b4fs,
  author = {{iinventedlight Library}},
  title = {{Privacy-First Architecture: Alternatives to the GDPR Popup and Local-First}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-10-18},
  url = {https://iinventedlight.com/library/reference/talks/fosdem-2025-privacy-first-architecture/},
  note = {Permanent ID iil:note:hgq1b4fs. License: CC-BY-2.0. Summary of https://archive.fosdem.org/2025/schedule/event/fosdem-2025-4233-privacy-first-architecture-alternatives-to-gdpr-popup-and-local-first/.},
}

For language models and agents: start at /llms.txt. This page in Markdown: /library/reference/talks/fosdem-2025-privacy-first-architecture.md.