Use of Google Analytics declared illegal by French data protection authority • Hacker News Board

Re: Use of Google Analytics declared illegal by French data protection authority

#371

Post by lmkg » Thu, Feb 10, 2022, 3:21 PM UTC

throwhauser wrote: post #340

lmkg wrote: post #324

Earlier quoted context omitted.

There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data. Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surpr…

> The IP Address is NOT the only thing that makes this data into personal data. Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0] [0] https://news.ycombinator.com/item?id=30135264

The linked article. Relevant quote:

> In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States.

This is an accurate description of GA's pseudonymous identifier. It is not accurate as a description of an IP address. And if CNIL meant the IP Address, they would have said so, as they did in other rulings.

Re: Use of Google Analytics declared illegal by French data protection authority

#372

Post by [deleted] » Thu, Feb 10, 2022, 3:21 PM UTC

iqanq wrote: post #203

tantalor wrote: post #196

Earlier quoted context omitted.

Asking permission for something users don't understand is tantamount to not asking in the first place.

Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.

[deleted]

Re: Use of Google Analytics declared illegal by French data protection authority

#373

Post by hdjjhhvvhga » Thu, Feb 10, 2022, 3:21 PM UTC

abakker wrote: post #364

hdjjhhvvhga wrote: post #349

Earlier quoted context omitted.

> shopping habits I think you are wrong. What they receive is a set of purchases in a given period of time that allow them to make many important decisions (when people buy most, what purchases are more likely on a given date etc.) but there is no way of finding out my shopping habits.

no - the analysis is done on receipts, not just total products sold. They don't care what you bought, they care to know that people who buy diapers also buy wipes, and people who buy soy milk don't buy butter, etc. The analysis of anonymous receipts still yields very interesting and actionable results in aggregate. Your privacy has nothing to do with how a company analyzes its sales data as long as they don't include…

Yes, I understand that they see patterns and trends and a lot of valuable data: my point is that they have no way of tracking shopping habits of any individual purchaser unless they trick them into some loyalty program, coupons etc.

Re: Use of Google Analytics declared illegal by French data protection authority

#374

Post by b4st1en » Thu, Feb 10, 2022, 3:21 PM UTC

eps wrote: post #337

AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

Here you go again, being coy. It's not an "also" analytics service. It _is_ an analytics service. If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know…

> The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it.

How is that more respectful? I can fingerprint you pretty much the same with server logs (IP, user-agent, ...), don't I? I can even use cookies without any JS.

Re: Use of Google Analytics declared illegal by French data protection authority

#375

Post by denton-scratch » Thu, Feb 10, 2022, 3:22 PM UTC

mwint wrote: post #335

gspencley wrote: post #322

Earlier quoted context omitted.

You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with…

> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

> we want to load JS from a CDN like literally everyone does

Well, carry on and load it, it's your server.

Oh, wait, you mean you want ME to load it, into MY browser? That's a problem - my browser only loads JS from the origin server, and only if I give it explicit permission.

As a developer, I deplore the use of CDNs to serve javascript libraries; you don't know what the CDN is going to serve to your users, it could change without warning and break your site.

Re: Use of Google Analytics declared illegal by French data protection authority

#376

Post by jimmaswell » Thu, Feb 10, 2022, 3:22 PM UTC

martin_a wrote: post #163

Dave3of5 wrote: post #133

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Pl…

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

This whole set of laws is so absurd. I should have the right to retain my server logs as long as I want. I bet in the future in Europe people will have the right to have others' brains forcibly zapped to remove embarrassing memories.

Re: Use of Google Analytics declared illegal by French data protection authority

#377

Post by 1123581321 » Thu, Feb 10, 2022, 3:22 PM UTC

eps wrote: post #337

AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

Here you go again, being coy. It's not an "also" analytics service. It _is_ an analytics service. If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know…

Did you read their docs? They aren’t setting cookies or collecting IP addresses. There’s no question to me that EU authorities would approve this method.

Re: Use of Google Analytics declared illegal by French data protection authority

#378

Post by lmkg » Thu, Feb 10, 2022, 3:23 PM UTC

judge2020 wrote: post #343

axiosgunnar wrote: post #292

Earlier quoted context omitted.

Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.

Is that really the only reason behind GA being 'banned'? If google broke off Ireland ltd into its own company and that company simply 'licensed' Google products for $1, would they be in the clear?

What matters is the US CLOUD Act, because that's the thing that lets US Intelligence have access to data stored in EU servers. If legal arrangement is covered by the CLOUD Act, it's a GDPR violation.

Re: Use of Google Analytics declared illegal by French data protection authority

#379

Post by ukutaht » Thu, Feb 10, 2022, 3:23 PM UTC

NLMichel wrote: post #239

calyhre wrote: post #34

Earlier quoted context omitted.

I've been using [Plausible]( https://plausible.io ) in its self-hosted version for about a month, on a 7M+ page views per month. So far so good

The powerful thing about GA is the link with Google Ads, does that work nice for Plausible as well?

Plausible founder here. There's nothing automatic but you can track your campaigns with utm_campaigns manually.

Google has made sure that analytics for Google Ads works best within their own walled garden. Same with Facebook and Twitter with their Pixel products.

Instead of using the Referer header or utm parameters as intended, these large corps send obtuse random IDs (gclid, t.co/ links) which only they can correlate to an ad, search query or tweet using their internal database.

So until there is anti-trust action in this space towards more oppenness and competition, you're stuck with the ad provider if you want tight integration between ads and analytics.

Re: Use of Google Analytics declared illegal by French data protection authority

#380

Post by tokai » Thu, Feb 10, 2022, 3:23 PM UTC

nickpp wrote: post #344

einpoklum wrote: post #259

Earlier quoted context omitted.

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.

I wonder who are people more afraid of exposing their private information to: the USA or their own government.

Definitely USA. My government doesn't drone strike people based on communication patterns or disappear them to black sites without ever being put in front of a judge.