Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

321–330 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#321

Post by bliteben »

tpxl wrote: post #54
paulcole wrote: post #35

Earlier quoted context omitted.

Nobody is going to get in “legal hot water” on account of Google Fonts or Google Analytics unless they’re Google themselves or a top 10 ecommerce company some politician wants to make an example of. There’s millions of sites relying on those things. Is the EU going to drag them all into court? This is like saying you never jay walk because you want to avoid the legal hot water. The water isn’t even lukewarm!

> Is the EU going to drag them all into court? Why would they need to? Just hand out fines, like you do with traffic tickets, no courts required.

I would venture most of the internet is not hosted in the EU. You expect US, Chinese, and Japanese citizens to respect an EU fine for a law they have no say in? Sure they are doing "business" in the EU, but many of them are not doing business at all.

Re: Use of Google Analytics declared illegal by French data protection authority

#322

Post by gspencley »

AdriaanvRossum wrote: post #301
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount."

I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with said business, not with Shopify, not with Google, not with Facebook or Twitter (I'm looking at those "sign in with" widgets that run social media code in my browser) or whatever 3rd party "SaaS" service the website is outsourcing my data to for ease of development or convenience. I don't consent to my data being shared with people I don't know about and did not consent to give a single shred of my information to.

Re: Use of Google Analytics declared illegal by French data protection authority

#323

Post by [deleted] »

augustl wrote: post #179
tyfon wrote: post #164

Earlier quoted context omitted.

The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. In fact this is how most of the companies operate already to cheat on taxes. The way microsoft did it for a while here in Norway was to license azure cloud stuff to a sub operator (EVRY) that is completely insulated except for the licensing agreement.

Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?

[deleted]

Re: Use of Google Analytics declared illegal by French data protection authority

#324

Post by lmkg »

AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data.

Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surprising.

Re: Use of Google Analytics declared illegal by French data protection authority

#325

Post by martin_a »

Dave3of5 wrote: post #284
martin_a wrote: post #274

Earlier quoted context omitted.

There's no hard limit here provided by the law or otherwise. Some of the local data protection offices say that they find something of "up to 30 days" reasonable, so I guess that's a good starting point. Cutting that time in half will show good faith and you'll still be able to analyze logs, I think.

Ok 30 days do you have a link for that?

Well, you'll for example find the 30 days in this document of the data protection office of Bavaria: https://www.lda.bayern.de/media/muster_1_verein_verzeichnis.... (It's a sample for sport clubs etc.) and it's also what our lawyer has recommended to our company as the upper limit.

Re: Use of Google Analytics declared illegal by French data protection authority

#326

Post by FredPret »

qiqitori wrote: post #37
AndrewDucker wrote: post #15

Earlier quoted context omitted.

People shouldnt need to be experts in data collection or computing in order to have their data treated fairly. If Google can't protect user's tracking data (and they can't - the US law won't let them) then they shouldn't be allowed to hold it.

People shouldn't have to be experts in this stuff either just to put up a website somewhere, or worse keep up with every new ruling.

So true.

I have a collection of small, US-focused websites.

I'm investigating low-effort ways to geo-fence the EU. At some point it just becomes easier to ban Europeans, rather than keep up with whatever they'll come up with next. I saw in this thread that the Google fonts on my website are now a problem as well!? That's the first I heard of it.

Re: Use of Google Analytics declared illegal by French data protection authority

#327

Post by simion314 »

someotherperson wrote: post #311
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper).

How, you don't enter your name when you pay with cash.

Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first.

Edit:typos

Re: Use of Google Analytics declared illegal by French data protection authority

#328

Post by shafyy »

Dave3of5 wrote: post #248
iamacyborg wrote: post #226

Earlier quoted context omitted.

Potentially, yes, though this hasn't been tested in court yet.

Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.

Yes, of course. It's possible that the they will sue every single big company, but quite possible. I think it's a good way for the EU to build pressure against the US to revise the CLOUD act.

Re: Use of Google Analytics declared illegal by French data protection authority

#329

Post by jraph »

eps wrote: post #285
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

it's not the privacy-first analytics tool neither. It's a tool.

Matomo is the privacy-friendly analytics tool that comes to my mind anyway.

(I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)

Re: Use of Google Analytics declared illegal by French data protection authority

#330

Post by chinathrow »

gspencley wrote: post #322
AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…

> I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers.

You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?

Post reply on HN