Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Italian watchdog bans use of Google Analytics

gpdp.it

Post reply on HN
Print view View original

11–20 of 614 posts

Re: Italian watchdog bans use of Google Analytics

#11

Post by humanistbot »

V__ wrote: post #9
lmkg wrote: post #6

This is consistent with decisions from the Austrian and French data protection authorities (DPAs). Note that Google is a Processor (for this product), meaning that Google itself does not violate GDPR, but only the websites that use it. Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any proc…

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

Re: Italian watchdog bans use of Google Analytics

#14

Post by shadowgovt »

humanistbot wrote: post #11
V__ wrote: post #9

Earlier quoted context omitted.

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

Building out the infrastructure necessary for Cloud to be compliant with region-stored data was a multi-year project.

Huge swathes of Google's architecture (especially its legacy architecture) have deeply-ingrained location-agnosticism assumptions. It turns out to be extremely complex and expensive to remove those assumptions given the way Google handles data once it hits their datacenter fabric.

(Not impossible, mind, just that this assertion that it wouldn't be that hard to do is in "I could build Twitter in a weekend" territory).

Re: Italian watchdog bans use of Google Analytics

#15

Post by tin7in »

V__ wrote: post #13
tin7in wrote: post #12

We are based in Europe and self-host our analytics exactly for this reason. I feel this is just the beginning.

Are you using a custom sotware or something like plausible.io?

I've heard about Plausible but haven't tried it yet. We are using Posthog which is a suite for product analytics.

Re: Italian watchdog bans use of Google Analytics

#17

Post by MrQuimico »

humanistbot wrote: post #11
V__ wrote: post #9

Earlier quoted context omitted.

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

The problem is not only the geo location of the datacenters. As long as these subsidiaries are under the control of a USA corporation, this is illegal, since the USA corporation can be requested by the USA gov to share any data they may have not matter where it's stored. Only options are a 100% GDPR compliant solution (European or from a country with similar laws) or self-host. Hopefully another Privacy Shield like agreement will be in place soon.

Re: Italian watchdog bans use of Google Analytics

#18

Post by corywatilo »

Italy is the 4th in a string of recent decisions across the EU.

(We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.)

Note that it's not illegal to use GA entirely, just illegal to use in its default state which transmits PII to the US.

Re: Italian watchdog bans use of Google Analytics

#19

Post by dylan604 »

humanistbot wrote: post #11
V__ wrote: post #9

Earlier quoted context omitted.

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

It wouldn't be hard for Googs to do this on their own so that they comply with the rules/laws in the markets they are operating vs giving it to the end user as an option in the configs. Most people using GA probably wouldn't know what any of that meant anyways. They just want the numbers so their marketing people can tell them what to do next. I'm talking the people running sites on Wix type sites vs having an actual dev team that can push back against a marketing department

Re: Italian watchdog bans use of Google Analytics

#20

Post by gostsamo »

humanistbot wrote: post #11
V__ wrote: post #9

Earlier quoted context omitted.

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

No, they can't as far as I get it. The american cloud act entitles US law enforcement to serve orders to US companies and their foreign branches. So, if you are american with a company in the EU, the important part is that you are an american, not that the company is in a foreign jurisdiction.
Post reply on HN