Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

401–410 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#401

Post by sqrt2 »

throwhauser wrote: post #340
lmkg wrote: post #324

Earlier quoted context omitted.

There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data. Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surpr…

> The IP Address is NOT the only thing that makes this data into personal data. Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0] [0] https://news.ycombinator.com/item?id=30135264

The Google Fonts case was decided based on the transmission of the full IP address in a jurisdiction (Germany) where there are ways to identify a user by means of that address. CNIL's press release follows a decision by the Austrian data protection authority where the Google Analytics cookies were at issue.

If you can read German, you can look at the Austrian decision directly, the complainant has uploaded it at [1] and the relevant section is D.2 b) starting at page 27.

[1] https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...

Re: Use of Google Analytics declared illegal by French data protection authority

#402

Post by PoignardAzur »

southerntofu wrote: post #86

Is the CNIL actually starting to do its job? Since the early 2000's they were doing literally nothing against the many crimes against users committed by big tech. In the past few years though they started to distribute fines when the law was obviously and willingly broken (eg. Google)... did they suddenly start to care for users? or do they care that they can fill the pockets of the government (who doesn't dare to ta…

> I mean CNIL does not exactly have a reputation of helping/protecting users... they more have a reputation of being a watchdog who sees no problem with government surveillance programs and does not react when you send them reports of illegal activities surrounding personal data

We have a very different view of the CNIL.

Every time I hear about them, they're either giving GDPR fines or signalling illegal government activity, eg: https://www.vie-publique.fr/en-bref/278140-drones-de-surveil...

They don't have political power in itself, but they do use what power they have enthusiastically.

Re: Use of Google Analytics declared illegal by French data protection authority

#403

Post by Vespasian »

V__ wrote: post #161
Vespasian wrote: post #124

Earlier quoted context omitted.

Reasons: 1. Legal: It's the site owners integrating GA and therefore taking on the liabilities just like they do with every other supplier. When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). 2. Practical: A website 100% located in France and catering to 100% french customers is much more likely to fix the…

> When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). And the manufacturer can go after Bosch, who is responsible in the end. > than the international anonymous machine that is Google. Except the law applies to Europe as a whole, and it's really not that much to ask one of the biggest technology companies…

Very true.

I think we will see a two pronged approach to the Problem.

On the EU level, the commission and the states will engage Google directly while on a national level individual companies will be "encouraged" to find alternatives.

Re: Use of Google Analytics declared illegal by French data protection authority

#404

Post by V__ »

Vespasian wrote: post #403
V__ wrote: post #161

Earlier quoted context omitted.

> When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). And the manufacturer can go after Bosch, who is responsible in the end. > than the international anonymous machine that is Google. Except the law applies to Europe as a whole, and it's really not that much to ask one of the biggest technology companies…

Very true. I think we will see a two pronged approach to the Problem. On the EU level, the commission and the states will engage Google directly while on a national level individual companies will be "encouraged" to find alternatives.

Yeah, that would be my prediction as well.

Re: Use of Google Analytics declared illegal by French data protection authority

#405

Post by sbarre »

eps wrote: post #337
AdriaanvRossum wrote: post #301

Earlier quoted context omitted.

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect

Here you go again, being coy. It's not an "also" analytics service. It _is_ an analytics service. If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know…

> The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it.

This is an argument taken to a naive extreme. You can't expect every business to also be in the business of analytics, it's not realistic. There's a reason companies have business partners who specialize in certain services.

It's why you have accountants, lawyers, marketers, etc.. Not every company can afford to have all these specialists on payroll, so you work with a service provider that lets you afford the services in a fractional way. You give them access to your data, including customer data sometimes, and in return they provide you with insights and information from that data.

Analytics is just another service provider like that.

You should of course work with a reliable and trusted partner that treats your customer data appropriately and has strong privacy guarantees.

The problem with GA is not "third party", it's "third party that uses my data for its own purposes" because that's the actual cost of using a free service.

Saying "no third parties at all" is not how businesses have operated since forever.

Re: Use of Google Analytics declared illegal by French data protection authority

#406

Post by qualudeheart »

Dave3of5 wrote: post #248
iamacyborg wrote: post #226

Earlier quoted context omitted.

Potentially, yes, though this hasn't been tested in court yet.

Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.

That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.

Re: Use of Google Analytics declared illegal by French data protection authority

#407

Post by [deleted] »

yobbo wrote: post #354
buf wrote: post #312

Earlier quoted context omitted.

You raise an interesting point. Who's data is it? If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal? What if the cameras block out your face and all identifying features. Is that legal? Do you own a blob of a person walking down an aisle? Does the grocery store?

> If you walk into a grocery store, and cameras record In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.

[deleted]

Re: Use of Google Analytics declared illegal by French data protection authority

#408

Post by antris »

martin_a wrote: post #163
Dave3of5 wrote: post #133

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Pl…

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

Depends on what the logs contain. If they contain no personal information at all, EU data protection laws do not apply.

Re: Use of Google Analytics declared illegal by French data protection authority

#409

Post by zelphirkalt »

verdverm wrote: post #286
einpoklum wrote: post #259

Earlier quoted context omitted.

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.

Since everyone is spying on everyone, what's the ethical or moral issue here?

The issue would be, that the website developers / their management contributes to the issue, by enabling partier to do that spying. If no data was send to another party, then spying on that data is much harder and probably unattractive for most use-cases. GA data becomes valuable through collecting from many many senders.

While the people doing the spying are already doing something ethically very questionable, the person deciding what data is collected on a webservice can still make the decision to contribute to the problem, or be vigilant about data protection.

Re: Use of Google Analytics declared illegal by French data protection authority

#410

Post by inetknght »

nickpp wrote: post #393
tokai wrote: post #380

Earlier quoted context omitted.

Definitely USA. My government doesn't drone strike people based on communication patterns or disappear them to black sites without ever being put in front of a judge.

Are you afraid USA would drone strike or disappear you if they get to your private data? Do you think that is a valid concern for most people?

I think it's a valid concern for everyone, yes.
Post reply on HN