You must have missed this part: > The ruling directs the website to stop providing IP addresses to Google and threatens the site operator with a fine of €250,000 for each violation, or up to six months in prison, for continued improper use of Google Fonts. So, if you feel brave you can challenge some courts on this.
No, I didn't miss that part. "Next time, I'll really punish you" rarely works until there's actual consequences.
I think a lot of the big tech companies are very reluctant to split their operations inside/outside europe. They gain big benefits by having a single pool of datacenters able to serve users from anywhere in the world. If they needed to guarantee that an EU user would always be served with a machine in the EU, I can imagine it would add at least 20% to their operating costs. They'd need more equipment both inside and…
"I can imagine it would add at least 20% to their operating costs." Why is everybody working on the assumption that all this data has to sit in the US? Keep it in a country with the strict-est possible privacy laws, say Switzerland, and noone would complain.
Plenty of US organisations couldn't use a cloud service that loudly proclaimed to store the data outside the USA.
If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?
Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.
Is that really the only reason behind GA being 'banned'? If google broke off Ireland ltd into its own company and that company simply 'licensed' Google products for $1, would they be in the clear?
Taking this to the logical extreme: A French website can not use any American service, right? Because any American services "are not sufficient to exclude the accessibility of this data for US intelligence services".
Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.
I wonder who are people more afraid of exposing their private information to: the USA or their own government.
I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect
You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…
>as long as the data never leaves their servers
This is kind of ridiculous in the cloud era, isn't it?
The analogy with external accountant up this thread is a good one. It's not about where data are processed, it's about how it's used.
If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?
Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.
Could they house their data in a separate company that was founded in Ireland and is not an Alphabet subsidiary to get around this?
Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.
>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party un…
On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door.
(By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)
> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.
You raise an interesting point. Who's data is it? If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal? What if the cameras block out your face and all identifying features. Is that legal? Do you own a blob of a person walking down an aisle? Does the grocery store?
If you walk into a shop and the cameras record what you do, then there has to be a mechanism in place to ensure that the data is only able to be used for the purpose it was collected for (that is, crime prevention and law enforcement), and that it is destroyed after a defined time-frame. That satisfies the GDPR, as you're collecting the data for a legitimate purpose (for which you don't need to seek consent) and preventing its use for any other purpose (which would need separate informed consent). The destruction time-limit also helps prevent its use for other purposes by reducing the opportunity for unauthorised access. You'd probably (IANAL) still have to have a "Smile, you're on camera" notice up though.
> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.
Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.
> shopping habits
I think you are wrong. What they receive is a set of purchases in a given period of time that allow them to make many important decisions (when people buy most, what purchases are more likely on a given date etc.) but there is no way of finding out my shopping habits.
I don't like Google but seriously this whole GDPR thing is getting out of hand. Anyone who's concerned about their data being collected can just block Google-or-like-related domains. Rest is just making life of web developers/admins/tech company owners harder. Especially with these European intentions I frankly believe this is more of a political war against US and US-based companies. (No, I'm not from US as well)
>Anyone who's concerned about their data being collected can just block Google-or-like-related domains. Rest is just making life of web developers/admins/tech company owners harder.
The GDPR is not limited to the internet. So say you go to make a blood test to check your health, GDPR will apply there too, you don't need to go with a fake ID and with a mark on your face, the law protects you from greedy companies so you and your family don't have to use weird workarounds to protect yourself.