Use of Google Analytics declared illegal by French data protection authority • Hacker News Board

Re: Use of Google Analytics declared illegal by French data protection authority

#301

Post by AdriaanvRossum » Thu, Feb 10, 2022, 2:53 PM UTC

eps wrote: post #285

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2].

There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics.

[1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g...

[2] https://docs.simpleanalytics.com/what-we-collect

Re: Use of Google Analytics declared illegal by French data protection authority

#302

Post by the-dude » Thu, Feb 10, 2022, 2:53 PM UTC

phkahler wrote: post #267

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

>> Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [ This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.

Par for the course.

Peace mission.

Re: Use of Google Analytics declared illegal by French data protection authority

#303

Post by M2Ys4U » Thu, Feb 10, 2022, 2:53 PM UTC

Dave3of5 wrote: post #212

martin_a wrote: post #163

Earlier quoted context omitted.

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

Ok so what's the actual minimum you've said two weeks here but where is this actually defined ?

It's not defined, because it depends on why you're processing the data.

Different reasons would entail different retention times.

Re: Use of Google Analytics declared illegal by French data protection authority

#304

Post by marcosdumay » Thu, Feb 10, 2022, 2:53 PM UTC

pl0x wrote: post #98

What is the balance of privacy and analytics when even privacy friendly tools like Plausible are blocked.

You can't send the data of EU people to companies subject to spying states.

Re: Use of Google Analytics declared illegal by French data protection authority

#305

Post by AdriaanvRossum » Thu, Feb 10, 2022, 2:54 PM UTC

phkahler wrote: post #267

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

>> Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [ This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.

You are right, rewrote it as "invalidated"

Re: Use of Google Analytics declared illegal by French data protection authority

#306

Post by martin_a » Thu, Feb 10, 2022, 2:55 PM UTC

viro wrote: post #225

martin_a wrote: post #180

Earlier quoted context omitted.

> conventional wisdom You mean what the SEA people tell you? Yeah, we'll all probably be out of business tomorrow, if we don't run the whole Google stack.

Quoted post unavailable.

Well, in regards to what the OP said, this whole "we need to track our users" stuff is bullshit. I see those "highly optimized" campaigns too, when something goes wrong and the SEA people start to cry because somebody stepped in their sand castle.

You don't need any of that.

Re: Use of Google Analytics declared illegal by French data protection authority

#307

Post by cowl » Thu, Feb 10, 2022, 2:56 PM UTC

Dave3of5 wrote: post #209

iamacyborg wrote: post #140

Earlier quoted context omitted.

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Yes, because you're still passing personal data to the USA, which means US intelligence services can access it.

Is that the case for any data that is passed into the USA then rather than just GA? So if I hosted my servers in any of the AWS US regions that too would be illegal if they have any personal data in them. In this case personal data is a randomised unique id. So say I have a table of users and all I have is a username and a password and a unique id for the record that's personal data and the customer is not allowed to…

a randomised unique ID and username/password are not personal data if they can't be used to identify a person. IF you associate that uniqueID or username with something that can identify the user (like IP/ Personal name etc) than yes it's illegal for you to store that data in US even with the consent of the user.

Re: Use of Google Analytics declared illegal by French data protection authority

#308

Post by numpad0 » Thu, Feb 10, 2022, 2:56 PM UTC

Dave3of5 wrote: post #248

iamacyborg wrote: post #226

Earlier quoted context omitted.

Potentially, yes, though this hasn't been tested in court yet.

Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.

If enforced thoroughly and by the letters of law. But the authorities in EU has control over selective enforcement of laws(that there potentially won't be by 26th century) letting the law spun as an open negotiation.

Re: Use of Google Analytics declared illegal by French data protection authority

#309

Post by nickpp » Thu, Feb 10, 2022, 2:57 PM UTC

jen20 wrote: post #238

nickpp wrote: post #184

Earlier quoted context omitted.

Imagine there is another travel agent not doing all that, but it costs money while the first is free. Wouldn’t you like to have the right to choose which one to visit, or do you prefer that choice to me made for you by politicians instead?

I would absolutely like the ability to pay for services which do not track or advertise to me. But they don't exist for the most part, and the existence of those services does nothing to diminish the requirement of the ones engaging in poor practice to make their service "free" to obtain _consent_ for what they are doing.

> But they don't exist for the most part

And the current privacy laws in EU make the free services illegal. How is that any better than the scenario where paid services did not exist?

Re: Use of Google Analytics declared illegal by French data protection authority

#310

Post by Nextgrid » Thu, Feb 10, 2022, 2:57 PM UTC

true_religion wrote: post #138

MereInterest wrote: post #59

Earlier quoted context omitted.

If you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it. But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".

Well, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).

> you can totally contribute to a privacy violating network … so long as the data is located and processed in France.

While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.