Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

351–360 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#351

Post by iLoveOncall »

im3w1l wrote: post #221
iamacyborg wrote: post #140

Earlier quoted context omitted.

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Yes, because you're still passing personal data to the USA, which means US intelligence services can access it.

If my website is hosted on a server located in the US, then is this illegal? Serious question. Assume it's a static site and that I don't collect any data myself whatsoever. But who knows what the server operator could be doing covertly? If this doesn't cut the internet in two, I don't get where the line goes.

A static site still logs the visitor's IP address in the logs of your webserver for example.

Re: Use of Google Analytics declared illegal by French data protection authority

#352

Post by dbrgn »

Dave3of5 wrote: post #133

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Pl…

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal.

From what I can tell: If you ask your users for permisssion ("informed consent"), then no, it is not illegal. The way I understood the court case in Austria, the disputed point was whether or not the use of GA falls under the GDPR. If it does fall under it, then you are obliged to ask your users for consent ("opt-in"). If it does not, you can use it freely without consent.

Because analytics data isn't worth that much if you collect only part of the data, most collectors of data do not want to ask users for their consent, because most users would reject this.

But IANAL. In any case, please stop using Google Analytics, and self-host your analytics using Matomo, Plausible, or something similar. Matomo can also be configured to use server-side analytics, in which case your analytics become both less invasive (no client-side JS needed) and more complete (can't be blocked by ad-blockers).

Re: Use of Google Analytics declared illegal by French data protection authority

#353

Post by cowl »

einpoklum wrote: post #227

Finally, a little dent in Google's mass surveillance project. Now if they could only declare GMail to be another kind of a racket we would really get somewhere :-)

Now this is just being negative about nothing. Gmail can not be used without the user knowing like analytics or linking to google fonts can. If you don't want gmail is as simple as not using it. Other sites can not call gmail for you in a hidden way.

Re: Use of Google Analytics declared illegal by French data protection authority

#354

Post by yobbo »

buf wrote: post #312
eps wrote: post #285

Earlier quoted context omitted.

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

You raise an interesting point. Who's data is it? If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal? What if the cameras block out your face and all identifying features. Is that legal? Do you own a blob of a person walking down an aisle? Does the grocery store?

> If you walk into a grocery store, and cameras record

In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.

Re: Use of Google Analytics declared illegal by French data protection authority

#355

Post by judge2020 »

waffleiron wrote: post #318
augustl wrote: post #179

Earlier quoted context omitted.

Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?

To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...

So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.

Re: Use of Google Analytics declared illegal by French data protection authority

#356

Post by nickpp »

criddell wrote: post #22
can16358p wrote: post #8

I don't like Google but seriously this whole GDPR thing is getting out of hand. Anyone who's concerned about their data being collected can just block Google-or-like-related domains. Rest is just making life of web developers/admins/tech company owners harder. Especially with these European intentions I frankly believe this is more of a political war against US and US-based companies. (No, I'm not from US as well)

I have somewhat of the opposite opinion. I use Google search and Gmail and think they are good products. When GPDR was first being rolled out I was convinced that it was going to destroy the web and ruin a lot of what I like about it. I was wrong and now I’d like to see the US provide similar protections for consumers.

They to use the web from inside the EU. It is ruined.

Re: Use of Google Analytics declared illegal by French data protection authority

#357

Post by mnw21cam »

axiosgunnar wrote: post #292
judge2020 wrote: post #281

Earlier quoted context omitted.

If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?

Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.

Microsoft has seen this one - they have a subsidiary in the EU that holds the EU data. Yes, the US-based parent company is legally bound to provide the data at the request of the US gov agencies. However, the only way that they can get hold of that data is to ask the EU subsidiary nicely. The EU subsidiary is legally bound to not hand that data over.

Re: Use of Google Analytics declared illegal by French data protection authority

#358

Post by scoutt »

mwint wrote: post #335
gspencley wrote: post #322

Earlier quoted context omitted.

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…

> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

As long as Personal Data isn't being trasferred, there is no need to ask.

Re: Use of Google Analytics declared illegal by French data protection authority

#359

Post by jeffbee »

rolisz wrote: post #334
ClumsyPilot wrote: post #268

Earlier quoted context omitted.

"I can imagine it would add at least 20% to their operating costs." Why is everybody working on the assumption that all this data has to sit in the US? Keep it in a country with the strict-est possible privacy laws, say Switzerland, and noone would complain.

Hah, it's a myth that Switzerland is so privacy oriented. They have laws saying that the Swiss intelligence services can access all data, so it wouldn't help. And Switzerland is not part of the EU.

Both Swiss and German people seem completely deluded about the activities of their own governments and intelligence agencies.

Re: Use of Google Analytics declared illegal by French data protection authority

#360

Post by rewq4321 »

gspencley wrote: post #322
AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…

This seems very impractical given the way the internet currently works. Most startups use dozens of SaaS products, let alone more basic/foundational things like global CDNs. You're being logged at every step of the process if only to prevent spam/DDoS/etc.

What you're asking for would require a fundamental restructuring of the internet, and of software business models, and a lot of other stuff. I can't see that happening any time soon.

In the meantime you can try using Tor, but good luck not getting blocked on half the websites you want to visit - and you can't blame the website for that (they need DDoS/spam defence).

Post reply on HN