Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

451–460 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#451

Post by martin_a »

antris wrote: post #408
martin_a wrote: post #163

Earlier quoted context omitted.

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

Depends on what the logs contain. If they contain no personal information at all, EU data protection laws do not apply.

IP addresses are considered to be PII so you need to either truncate them before saving or have a deletion routine in place.

Re: Use of Google Analytics declared illegal by French data protection authority

#452

Post by karambahh »

qualudeheart wrote: post #406
Dave3of5 wrote: post #248

Earlier quoted context omitted.

Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.

That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.

A lot of the actors you're listing actually have datacenters and/or cages at french DCs and/or racks at french ISP PoP

Re: Use of Google Analytics declared illegal by French data protection authority

#453

Post by martin_a »

jimmaswell wrote: post #376
martin_a wrote: post #163

Earlier quoted context omitted.

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

This whole set of laws is so absurd. I should have the right to retain my server logs as long as I want. I bet in the future in Europe people will have the right to have others' brains forcibly zapped to remove embarrassing memories.

I should have a right that you should not save my personal information longer than needed. Now what?

Re: Use of Google Analytics declared illegal by French data protection authority

#454

Post by robin_reala »

arvindrajnaidu wrote: post #430
yobbo wrote: post #354

Earlier quoted context omitted.

> If you walk into a grocery store, and cameras record In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.

Say they don’t do it secretly. They put up signs that they are doing it. Do they have to get explicit consent from each customer and save that info for audits?

No, they claim it under legitimate interest for fraud prevention and have a data deletion schedule.

Re: Use of Google Analytics declared illegal by French data protection authority

#455

Post by bsedlm »

jraph wrote: post #329
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

it's not the privacy-first analytics tool neither. It's a tool. Matomo is the privacy-friendly analytics tool that comes to my mind anyway. (I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)

there's a difference between a service and a tool. do not blur out this distinction. thanks.

Re: Use of Google Analytics declared illegal by French data protection authority

#456

Post by lucideer »

VikingCoder wrote: post #392

If someone adds http://blah.us "> to their website, and that image is hosted in the United States, how does that not also violate French data protection? The user's browser makes a request to a US server, including the user's IP address. I legit do not understand how to make French people happy with these laws.

> how does that not also violate French data protection?

The regulations don't ban collecting IPs (nor any PII). They just regulate it to the point that it must be deemed necessary according to certain criteria. I would imagine linking an image may be fine in 95% of cases, but what it would mainly depend on is the logging practices of the image hosting company. Their business would be bound by EU regulation if they are choosing to sell service to an EU-based website, and it's likely that image host that would be liable for compliance.

It's worth adding quite a lot of the regulation here is tied to company size, revenue and scale of data sharing in general, so if you are for example a small business/non-profit you're very likely to be fine either way.

Re: Use of Google Analytics declared illegal by French data protection authority

#457

Post by elevader »

someotherperson wrote: post #311
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

GDPR also applies to the real world. That store is definitely not allowed to share data about your shopping habits with some third party without your explicit consent. For example government departments in Germany have to aks for your explicit permission beforehand if they need to request/share data with a different department.

Re: Use of Google Analytics declared illegal by French data protection authority

#459

Post by AdriaanvRossum »

weissed wrote: post #431
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. Why are anonymised IP addresses still considered "Personal Data"? Is it because Google is doing the anonymisation?

I think it's personal data because you can track a visitor across multiple visits. Based on that identifier you can connect all the other data points from a visitor. I think that's not privacy-friendly at all.

Re: Use of Google Analytics declared illegal by French data protection authority

#460

Post by hutzlibu »

simion314 wrote: post #426
umvi wrote: post #365

Earlier quoted context omitted.

> How, you don't enter your name when you pay with cache. You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". "Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash"

>"Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash" And the store person will then what? Open excel wnd write "a dude with glasses was ehre at 12:51"? and then send the file to 100+ partners? >You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". So the physical stores have some shady…

Sorry to nitpick, but since you wrote it 2 times wrong:

it is cash, not cache.

Post reply on HN