Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

331–340 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#331

Post by krageon »

iqanq wrote: post #203
tantalor wrote: post #196

Earlier quoted context omitted.

Asking permission for something users don't understand is tantamount to not asking in the first place.

Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.

No, this is not how consent works. Consent has to be informed and well-judged: If you don't understand what you're agreeing with, you have not given it (even if you say yes the other party cannot proceed as if they have gotten it).

Re: Use of Google Analytics declared illegal by French data protection authority

#332

Post by foxfluff »

tantalor wrote: post #279
iqanq wrote: post #203

Earlier quoted context omitted.

Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.

An agreement requires a meeting of the minds. Blindly clicking "yes, accept cookies" in popups does not rise to that level. People just want to read the article, they do not understand or care about the data retention policy. So it is very hard to claim they consented.

And reading the data retention policy is not enough if it doesn't explain the extent to which the authorities in their country can wipe butt with said policy.

But anyway, I think even that is beside the point. I think the point is that there are things Europe considers fundamental rights. And the concept of a "right" doesn't.. really.. make much sense if someone can go "btw we'll just violate it, click to agree."

Re: Use of Google Analytics declared illegal by French data protection authority

#333

Post by viro »

martin_a wrote: post #306
viro wrote: post #225

Earlier quoted context omitted.

Quoted post unavailable.

Well, in regards to what the OP said, this whole "we need to track our users" stuff is bullshit. I see those "highly optimized" campaigns too, when something goes wrong and the SEA people start to cry because somebody stepped in their sand castle. You don't need any of that.

Then why did Facebook lose 10b dollars from losing that tracking data on iOS?

Re: Use of Google Analytics declared illegal by French data protection authority

#334

Post by rolisz »

ClumsyPilot wrote: post #268
londons_explore wrote: post #121

Earlier quoted context omitted.

I think a lot of the big tech companies are very reluctant to split their operations inside/outside europe. They gain big benefits by having a single pool of datacenters able to serve users from anywhere in the world. If they needed to guarantee that an EU user would always be served with a machine in the EU, I can imagine it would add at least 20% to their operating costs. They'd need more equipment both inside and…

"I can imagine it would add at least 20% to their operating costs." Why is everybody working on the assumption that all this data has to sit in the US? Keep it in a country with the strict-est possible privacy laws, say Switzerland, and noone would complain.

Hah, it's a myth that Switzerland is so privacy oriented. They have laws saying that the Swiss intelligence services can access all data, so it wouldn't help.

And Switzerland is not part of the EU.

Re: Use of Google Analytics declared illegal by French data protection authority

#335

Post by mwint »

gspencley wrote: post #322
AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…

> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much

So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

Re: Use of Google Analytics declared illegal by French data protection authority

#337

Post by eps »

AdriaanvRossum wrote: post #301
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

Here you go again, being coy.

It's not an "also" analytics service. It _is_ an analytics service.

If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know they don't want to be tracked IF it's actually mentioned.

So what you offer is a GA alternative that makes website operators feel better about themselves for not using the GA. The situation with the visitors remains exactly the same - the still getting shafted with something that none of them wants.

The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it.

Re: Use of Google Analytics declared illegal by French data protection authority

#338

Post by shafyy »

aftergibson wrote: post #11

Is anyone using an alternative that provides some basic analytics and isn't likely to get me in legal hot water in the future? I've already offloaded Google Fonts due to the German ruling. I'm happy to self-host piwik if needed, but could that fall foul of regulators?

I'm the creator of Fugu (https://github.com/shafy/fugu), if you're looking for an event-based analytics solution that is open-source, free and self-hostable. Fugu doesn't track unique users, just anonymous events. I also offer hosted version if you don't want to deal with hosting (currently using Digital Ocean with their Frankfurt data center, but will switch to an EU company soon).

Re: Use of Google Analytics declared illegal by French data protection authority

#339

Post by ceejayoz »

can16358p wrote: post #174
ceejayoz wrote: post #10

Earlier quoted context omitted.

> Anyone who's concerned about their data being collected can just block Google-or-like-related domains. What percentage of the general population do you estimate a) will know enough to want to do this and b) will know how to do it?

They don't need to browse the free web as well, but they choose to do.

That's like blaming the people in Flint, Michigan for drinking the lead-tainted water.

Re: Use of Google Analytics declared illegal by French data protection authority

#340

Post by throwhauser »

lmkg wrote: post #324
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data. Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surpr…

> The IP Address is NOT the only thing that makes this data into personal data.

Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0]

[0] https://news.ycombinator.com/item?id=30135264

Post reply on HN