因GDPR合规需求，寻求PHP免费方案或欧盟访客屏蔽方法

Hey there, I feel your pain—GDPR’s vague rules and hefty fines are no joke for small, non-profit personal sites. Let’s walk through two practical, free PHP-based solutions to either collect the data you need compliantly or block EU visitors effectively (since language-based blocking doesn’t cut it):

First, let’s cover the legal basics to keep you in the clear:

• You’ll rely on the legitimate interest legal basis (since you’re a non-profit collecting data to understand your audience without monetizing it). But you must balance this with visitor rights—meaning clear transparency and an easy opt-out.
• Practice data minimization: only collect exactly what you need (browser, OS, org info) and anonymize any personal data like IP addresses.

Here’s a complete, free PHP implementation:

Step 1: Add a Consent Banner & Opt-Out #

Visitors need to know you’re collecting data and can opt out. This code adds a simple fixed banner and stores consent in a non-identifying cookie:

<?php
// Check if consent is already given
if (!isset($_COOKIE['data_consent'])) {
    echo '<div style="position: fixed; bottom: 0; width: 100%; background: #f0f0f0; padding: 15px; text-align: center;">
            This site collects basic browser/OS/organization info to better understand our audience. You can opt out at any time.
            <button onclick="document.cookie=\'data_consent=yes; expires='.date('r', time()+365*24*60*60).'; path=/\'; this.parentElement.remove();">Got it</button>
            <a href="/opt-out.php" style="margin-left: 10px;">Opt Out</a>
          </div>';
}
?>

Step 2: Collect & Store Data Safely #

Only collect data if the visitor has consented. Anonymize IP addresses to reduce GDPR risk, and store data in a local text file (no database needed for simplicity):

<?php
if (isset($_COOKIE['data_consent']) && $_COOKIE['data_consent'] === 'yes') {
    // Anonymize IP (remove last octet to avoid identifying individuals)
    $anonymized_ip = preg_replace('/\.\d+$/', '.xxx', $_SERVER['REMOTE_ADDR']);

    // Get browser & OS info using PHP's built-in get_browser()
    $browser_data = get_browser(null, true);
    $browser = $browser_data['browser'] . ' ' . $browser_data['version'];
    $os = $browser_data['platform'];

    // Get organization via reverse DNS lookup (note: this may not return data for all IPs)
    $org = gethostbyaddr($anonymized_ip);
    // Clean up org name to focus on domain
    $org = preg_replace('/^.*\.(.*\..*)$/', '$1', $org);

    // Log data to a local file (lock to prevent race conditions)
    $log_entry = date('Y-m-d H:i:s') . " | Browser: $browser | OS: $os | Organization: $org | Anonymized IP: $anonymized_ip\n";
    file_put_contents('visitor_logs.txt', $log_entry, FILE_APPEND | LOCK_EX);
}
?>

Step 3: Opt-Out Page (opt-out.php) #

Give visitors an easy way to stop data collection:

<?php
// Set consent cookie to "no" and redirect home
setcookie('data_consent', 'no', time() - 3600, '/');
header('Location: /');
exit;
?>

Key notes for compliance:

• Clear your visitor_logs.txt regularly (e.g., monthly) to avoid storing data longer than needed.
• Never share or sell this data—GDPR prohibits that without explicit consent.

If collecting data feels too risky, blocking EU visitors is a simpler alternative. Language-based blocking fails because many EU users speak non-EU languages, so we’ll use IP geolocation with a free database:

Step 1: Get the Free GeoLite2 Country Database #

Download MaxMind’s free GeoLite2 Country database (you’ll need a free account on their site). Extract the GeoLite2-Country.mmdb file to your server.

Step 2: PHP Code to Block EU Visitors #

Use the PHP MaxMind DB reader (install via Composer with composer require maxmind-db/reader or use the pure PHP version) to check if a visitor’s IP is from an EU country:

<?php
require_once 'vendor/autoload.php';
use MaxMind\Db\Reader;

try {
    // Load the GeoLite2 database (update the path to match your server)
    $reader = new Reader('GeoLite2-Country.mmdb');
    $visitor_ip = $_SERVER['REMOTE_ADDR'];
    $geo_data = $reader->get($visitor_ip);

    // List of EU country ISO codes
    $eu_countries = ['AT', 'BE', 'BG', 'CY', 'CZ', 'DE', 'DK', 'EE', 'ES', 'FI', 'FR', 'GR', 'HR', 'HU', 'IE', 'IT', 'LT', 'LU', 'LV', 'MT', 'NL', 'PL', 'PT', 'RO', 'SE', 'SI', 'SK'];

    // Check if visitor is in the EU
    if (isset($geo_data['country']['iso_code']) && in_array($geo_data['country']['iso_code'], $eu_countries)) {
        header('HTTP/1.1 403 Forbidden');
        echo '<h1>Access Restricted</h1>
              <p>This site does not serve visitors from the European Union due to GDPR compliance requirements.</p>';
        exit;
    }

    $reader->close();
} catch (Exception $e) {
    // If geolocation fails, default to allowing access (avoid blocking non-EU users by mistake)
    error_log('GeoIP Error: ' . $e->getMessage());
}
?>

Key notes:

• Update the GeoLite2 database monthly to keep IP data accurate.
• The free database is 98-99% accurate for country-level geolocation—more than enough for personal sites.

If neither option works for you, stopping all visitor data collection is the safest (though less informative) choice.

内容的提问来源于stack exchange，提问作者ndk