Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR and Google Analytics

adactio.com

Post reply on HN
Print view View original

11–20 of 130 posts

Re: GDPR and Google Analytics

#11

Post by x0x0 »

TomasEkeli wrote: post #9
zuppy wrote: post #8

Earlier quoted context omitted.

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.

Probably... not really? Maybe?

For starters, if you don't take payment and aren't in the EU, EU enforcement power is going to be extraordinarily limited. And even if you do require payment, if you don't have a physical nexus in the EU, it's unclear what exactly the EU can do?

I think the GDPR was basically aimed at some of the scummier adtech practices and businesses like Facebook, and for those, it will be very enforceable.

Re: GDPR and Google Analytics

#12

Post by yetanother1980 »

TomasEkeli wrote: post #9
zuppy wrote: post #8

Earlier quoted context omitted.

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.

Why are you storing and processing their data if not for profit?

Re: GDPR and Google Analytics

#13

Post by x0x0 »

yetanother1980 wrote: post #12
TomasEkeli wrote: post #9

Earlier quoted context omitted.

It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.

Why are you storing and processing their data if not for profit?

personal data in the GDPR has a very expansive definition, and definitely includes things like IP. Processing likewise has an expansive definition, including collection and recording. Lots of sites will be processing and storing this data for internal analytics.

Re: GDPR and Google Analytics

#14

Post by guitarbill »

sb8244 wrote: post #4

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. On top of that, developing business software becomes incredibly complex when navigating all of the potential ramifications of these policies. I thought it wa…

For sure it's a bit of a blunt tool, but we've seen companies can't be relied on to do it themselves.

And yes, as devs it does force us to ask hard questions that we've been conveniently ignoring, usually at the request of management or marketing. Does this need detailed analytics? Do we need to store this information? How do we need to store this information? How do we design UX to withdraw consent? How do we handle the absence of consent? Etc. More difficult, but more ethical, too.

One nice thing (maybe) is that it's so much effort to get consent to run pervasive analytics on EU users, that many people might just stop running pervasive analytics on EU users at all. Maybe all users? At least I can dream...

Re: GDPR and Google Analytics

#15

Post by xxs »

TomasEkeli wrote: post #9
zuppy wrote: post #8

Earlier quoted context omitted.

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.

You don't need any personal data to conduct most of the business.

I work in a place that would be beyond heavily affected by GDPR and I find the legislation a good change as companies should not hoard data they don't need - just in case... or just to sell.

Re: GDPR and Google Analytics

#16

Post by ysv2 »

zuppy wrote: post #8
ysv2 wrote: post #6

> This regulation is not limited to companies based in the EU—it applies to any service anywhere in the world that can be used by citizens of the EU. That's fundamentally incorrect. As a non-EU citizen, I reject the notion that a foreign government has the right to impose their own laws on me, be it the EU or China or anyone else. If the EU thinks it's a problem that I'm offering a service to EU citizens that doesn't…

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

It isn't my responsibility to block them, or to take any action whatsoever to comply with another country's laws.

Re: GDPR and Google Analytics

#17

Post by ysv2 »

michael_storm wrote: post #7
ysv2 wrote: post #6

> This regulation is not limited to companies based in the EU—it applies to any service anywhere in the world that can be used by citizens of the EU. That's fundamentally incorrect. As a non-EU citizen, I reject the notion that a foreign government has the right to impose their own laws on me, be it the EU or China or anyone else. If the EU thinks it's a problem that I'm offering a service to EU citizens that doesn't…

It being fundamentally incorrect and you not liking it are two very different things.

Yet it is fundamentally incorrect. I'm not an EU citizen, so I have zero reason to care about their laws. I will simply ignore them, and the EU has no recourse, other than possibly mandating that their ISPs block me or something. Which I also do not care about.

Re: GDPR and Google Analytics

#18

Post by microtonal »

sb8244 wrote: post #4

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries. On top of that, developing business software becomes incredibly complex when navigating all of the potential ramifications of these policies. I thought it wa…

It might be an unpopular opinion here, but I'm not entirely sure that the GDPR is going to be a good thing. It seems strange to me to have this enforcement of policies from countries that are not my own just because my website is accessible from those countries.

I see your point, but a large majority of web sites are extremely misbehaving, since they allow Google (any typically a bunch of other analytics firms) to track users around the web without any consent (through Google Analytics). I find this terribly frustrating. I decided to opt out of the Google ecosystem completely, but data about me is still vacuumed through Google analytics and Google-hosted JavaScript/CSS. I use uMatrix, but blocking Google-hosted assets is out of reach for most non-technical users.

We would not be here in the first place if companies and website owners treated the user's privacy with respect. I don't feel pity for them that they jump through hoops now.

If you host a small personal site, just consider axing Google analytics. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company. Respect your user's privacy.

Re: GDPR and Google Analytics

#19

Post by guitarbill »

x0x0 wrote: post #10

My problem with the GDPR is the EU can't even be bothered to tell us what it is before the effective date. And the GDPR itself is quite vague; lots of balancing tests and blah blah with very little guidelines on what those mean in practice. So where do the guidelines come from? Funny you should ask. Consider the ICO -- the UK privacy commission -- has been promising final GDPR guidance for perhaps half a year now, an…

To be fair, it isn't really ICO's fault - the government has never wanted the ICO to be really effective, judging by the UK laws the ICO was given to work with, and the laughably tiny fines they can impose. Wouldn't surprise me if they're underfunded and stuck in the Brexit mess, never mind that the GDPR will come into effect soon.

Re: GDPR and Google Analytics

#20

Post by athrun »

ysv2 wrote: post #16
zuppy wrote: post #8

Earlier quoted context omitted.

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

It isn't my responsibility to block them, or to take any action whatsoever to comply with another country's laws.

Well, the point of the GDPR is to make you aware that collecting personal data of EU citizens requires their explicit consent. Just ask me for it, that's not a big deal, is it?

If you don't, you're effectively stealing from me and I shall expect my government to go after you to the full extent of the law.

Post reply on HN