Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

391–400 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#391

Post by lmkg »

shafyy wrote: post #320
sfifs wrote: post #83

A lot of this seems to be coming due to US regulations that compel US registered companies to hand over data from subsidiaries in Europe markets if asked by US intelligence and law enforcement agencies. With these various data locality regulations, i wonder if a standard operating approach could be to split tech companies into 3 legal entities, a technology licensing company, a US registered operations company and a…

Exactly, the CLOUD act is the one of the main problems here: https://en.wikipedia.org/wiki/CLOUD_Act

I've read most of the EU rulings and court cases on this topic. The CLOUD Act is basically the only US law that any of them mention or refer to.

And let's be explicit here: The entire purpose of the CLOUD Act is to bypass EU data protection laws. The incident that led to the creation of this law is that Microsoft didn't hand data over to the FBI because the data was on a server in Ireland. This isn't an unintended consequence, this is what the law is supposed to do.

Re: Use of Google Analytics declared illegal by French data protection authority

#392

Post by VikingCoder »

If someone adds http://blah.us"> to their website, and that image is hosted in the United States, how does that not also violate French data protection?

The user's browser makes a request to a US server, including the user's IP address.

I legit do not understand how to make French people happy with these laws.

Re: Use of Google Analytics declared illegal by French data protection authority

#393

Post by nickpp »

tokai wrote: post #380
nickpp wrote: post #344

Earlier quoted context omitted.

I wonder who are people more afraid of exposing their private information to: the USA or their own government.

Definitely USA. My government doesn't drone strike people based on communication patterns or disappear them to black sites without ever being put in front of a judge.

Are you afraid USA would drone strike or disappear you if they get to your private data? Do you think that is a valid concern for most people?

Re: Use of Google Analytics declared illegal by French data protection authority

#395

Post by hedora »

phkahler wrote: post #267
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

>> Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [ This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.

The privacy shield is like a radiation shield or a wind shield.

Re: Use of Google Analytics declared illegal by French data protection authority

#396

Post by mschuster91 »

iam-TJ wrote: post #369
mschuster91 wrote: post #214

Earlier quoted context omitted.

> I've already offloaded Google Fonts due to the German ruling. I'm happy to self-host piwik if needed, but could that fall foul of regulators? Well... if you self-host Piwik or Matomo, you're relatively safe and you can avoid a lot of the bureaucracy bullshit that you'd have with external services. However, check with a lawyer before setting it up, and definitely get user consent for detailed tracking. There are bas…

Interesting that you mention localStorage. If the web-page's javascript ONLY stores and processes data stored in the client's localStorage to generate the local page, and sends nothing back to the server, so the web-site operator never sees that data, then is the web-site operator processing that data, or is it only the user-agent's operator ? The web-site operator certainly wouldn't be a "data controller" since it i…

Never thought about that scenario, I only mentioned localStorage or sessionStorage because it has been abused in the past to get around tracking blockers and to create "supercookies".

Re: Use of Google Analytics declared illegal by French data protection authority

#397

Post by abakker »

hdjjhhvvhga wrote: post #373
abakker wrote: post #364

Earlier quoted context omitted.

no - the analysis is done on receipts, not just total products sold. They don't care what you bought, they care to know that people who buy diapers also buy wipes, and people who buy soy milk don't buy butter, etc. The analysis of anonymous receipts still yields very interesting and actionable results in aggregate. Your privacy has nothing to do with how a company analyzes its sales data as long as they don't include…

Yes, I understand that they see patterns and trends and a lot of valuable data: my point is that they have no way of tracking shopping habits of any individual purchaser unless they trick them into some loyalty program, coupons etc.

I think we agree. If the average search advertiser gave me the same benefits that some loyalty programs do, I'd feel a lot better about them. I.e. if I got points for the data I provided in my browsing habits that translated into actual dollars, I'd be game to let them have it. If I wanted to "not swipe my loyalty card for this purchase" to leave it out of my history, I'd appreciate the granular control.

The issue with all the tracking is that most consumers have no choice, no functional UI to interact with the tracking systems, and no clear idea of who they are ultimately transacting with.

Re: Use of Google Analytics declared illegal by French data protection authority

#398

Post by mwint »

denton-scratch wrote: post #375
mwint wrote: post #335

Earlier quoted context omitted.

> any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

> we want to load JS from a CDN like literally everyone does Well, carry on and load it, it's your server. Oh, wait, you mean you want ME to load it, into MY browser? That's a problem - my browser only loads JS from the origin server, and only if I give it explicit permission. As a developer, I deplore the use of CDNs to serve javascript libraries; you don't know what the CDN is going to serve to your users, it could…

You’re just illustrating why this isn’t an issue requiring legislation - anyone can block requests to whatever origin they like. No need for heavy handed gov’t getting involved in technical matters.

Re: Use of Google Analytics declared illegal by French data protection authority

#399

Post by Griffinsauce »

simion314 wrote: post #362
germanier wrote: post #347

Earlier quoted context omitted.

On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)

>By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so…

Please note you made "numerous" into 100. Realistically the number is way lower.

Re: Use of Google Analytics declared illegal by French data protection authority

#400

Post by waffleiron »

judge2020 wrote: post #355
waffleiron wrote: post #318

Earlier quoted context omitted.

To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...

So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.

Schrems II (and the Privacy Shield invalidation) has been in response to the aggressive data collection by the US government, and the extra-territorial nature of legislation used to achieve this. The US is able regain access to the EU market by repealing/changing CLOUD act and similar legislation, so I personally don't think this is (primarily) done to block US companies. However I am not the one implementing these rulings, so the best I can is speculate.
Post reply on HN