Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

281–290 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#281

Post by judge2020 »

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?

Re: Use of Google Analytics declared illegal by French data protection authority

#282

Post by wizzwizz4 »

Semaphor wrote: post #154
wizzwizz4 wrote: post #118

Earlier quoted context omitted.

Filtering out bot traffic is easy enough with server logs. A self-hosted JavaScript analytics tool gives you more data, but Google Analytics filters out Firefox users too; contrary to ReCAPTCHA's apparent beliefs, Firefox users are mostly not bots.

> but Google Analytics filters out Firefox users too; contrary to ReCAPTCHA's apparent beliefs, Firefox users are mostly not bots. Isn’t it the other way around? FF by default blocks GA.

It is. From the perspective of the person choosing an analytics system, it doesn't matter exactly what the reason is, though.

Re: Use of Google Analytics declared illegal by French data protection authority

#283

Post by bradly »

sfifs wrote: post #83

A lot of this seems to be coming due to US regulations that compel US registered companies to hand over data from subsidiaries in Europe markets if asked by US intelligence and law enforcement agencies. With these various data locality regulations, i wonder if a standard operating approach could be to split tech companies into 3 legal entities, a technology licensing company, a US registered operations company and a…

Google is already doing this in countries like China and South Korea.

Re: Use of Google Analytics declared illegal by French data protection authority

#284

Post by Dave3of5 »

martin_a wrote: post #274
Dave3of5 wrote: post #212

Earlier quoted context omitted.

Ok so what's the actual minimum you've said two weeks here but where is this actually defined ?

There's no hard limit here provided by the law or otherwise. Some of the local data protection offices say that they find something of "up to 30 days" reasonable, so I guess that's a good starting point. Cutting that time in half will show good faith and you'll still be able to analyze logs, I think.

Ok 30 days do you have a link for that?

Re: Use of Google Analytics declared illegal by French data protection authority

#285

Post by eps »

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> the privacy-first analytics tool

Don't be coy. Call it what it is - an analytics service.

And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

Re: Use of Google Analytics declared illegal by French data protection authority

#286

Post by verdverm »

einpoklum wrote: post #259
rebelde wrote: post #210

Taking this to the logical extreme: A French website can not use any American service, right? Because any American services "are not sufficient to exclude the accessibility of this data for US intelligence services".

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.

Since everyone is spying on everyone, what's the ethical or moral issue here?

Re: Use of Google Analytics declared illegal by French data protection authority

#287

Post by Grollicus »

i_am_jl wrote: post #230
Xelbair wrote: post #199

Earlier quoted context omitted.

or USA could just.. stop having such ridiculous law in place.

But is "Wait for a possible but incredibly unlikely series of events to occur" really a solution?

There is no different solution. The EU tried twice to build this kind of solution and EU courts have shot it down twice with the argument that in the face of no legal representation of EU citizens in the US it is not possible.

So the US needs to move here or it can not happen.

Re: Use of Google Analytics declared illegal by French data protection authority

#288

Post by pgeorgi »

true_religion wrote: post #138
MereInterest wrote: post #59

Earlier quoted context omitted.

If you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it. But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".

Well, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).

> so long as the data is located and processed in France.

... you also have to ask for permission first.

The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.

Re: Use of Google Analytics declared illegal by French data protection authority

#289

Post by AdriaanvRossum »

kiallmacinnes wrote: post #278
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> 1. Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [2] Minor nit - "PII" really isn't the right term to use, because it suggests the info itself must be personally identifiable to an individual. The GDPR covers much more than this, and uses the term "Personal Data".

Thanks, updated the comment.

Re: Use of Google Analytics declared illegal by French data protection authority

#290

Post by ClumsyPilot »

paulcole wrote: post #62
fhars wrote: post #47

Earlier quoted context omitted.

Some courts beg to disagree with your position: https://www.theregister.com/2022/01/31/website_fine_google_f...

Oh, wow, didn’t realize 1 website had been fined $100. The legal water is boiling!

This is basically a 'we are watching you' warning, second time the fine will be different
Post reply on HN