Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

411–420 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#411

Post by germanier »

hdjjhhvvhga wrote: post #368
ComodoHacker wrote: post #345

Earlier quoted context omitted.

>as long as the data never leaves their servers This is kind of ridiculous in the cloud era, isn't it? The analogy with external accountant up this thread is a good one. It's not about where data are processed, it's about how it's used.

No, it's not. Using Matomo on my own servers has nothing to do with the way GA etc. operates - it's an equivalent of going through my own Nginx logs and parsing them to generate diagrams and so on. Of course if I share personally identifiable data with a third party, it's a completely different thing - in this case it does not matter if it comes from Matomo or web server logs. But I agree with your conclusion: what m…

In general, under the GDPR it doesn't matter much whether you process data yourself on your own server or contract that same task out to a third-party. Either that processing is legal or it isn't - ownership of the server doesn't play a role.

The problem with Google Analytics here is not that it's a third-party but that it's under US control.

Re: Use of Google Analytics declared illegal by French data protection authority

#412

Post by mediascreen »

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace.

It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs will just end up starting companies in the US instead.

There must be some reasonable middle ground before we fragment and destroy the entire Internet. Why not start by making a general exception for temporary storage of less sensitive data like IP-addresses for efficiently and cost effectively delivering a web service.

If there is one thing they could start looking in to it would be handling of personal information by governmental organisations. I work a little bit with a few municipalities, and the number of documents with deeply personal information that are just emailed around over unencrypted email is shocking.

Re: Use of Google Analytics declared illegal by French data protection authority

#413

Post by pimterry »

aftergibson wrote: post #11

Is anyone using an alternative that provides some basic analytics and isn't likely to get me in legal hot water in the future? I've already offloaded Google Fonts due to the German ruling. I'm happy to self-host piwik if needed, but could that fall foul of regulators?

It looks like self-hosting Posthog (https://posthog.com/) should work, and they look great.

They're a US company, so you can't use their cloud service, but it's designed to be self-hosted and they have a list of EU cloud providers so you can do 100% EU-based self-hosting if you want: https://posthog.com/docs/self-host/deploy/hosting-in-eu

Re: Use of Google Analytics declared illegal by French data protection authority

#414

Post by judge2020 »

kragen wrote: post #77

Note that Wikimedia has been not using Google Analytics since forever because they're concerned about precisely the same privacy problems as the regulators. This other post has more comments: https://news.ycombinator.com/item?id=30284820 I love that the plaintiff in this case is the "NOYB Association", as in None Of Your Fucking Business, Google.

It would seem Wikimedia is still violating the law as they keep Analytics data/data of users[0], but haven't yet pulled the Microsoft move of creating a separate EU company that the US-based entity has no control of.

0: https://meta.wikimedia.org/wiki/Data_retention_guidelines

Re: Use of Google Analytics declared illegal by French data protection authority

#415

Post by denton-scratch »

i_am_jl wrote: post #230
Xelbair wrote: post #199

Earlier quoted context omitted.

or USA could just.. stop having such ridiculous law in place.

But is "Wait for a possible but incredibly unlikely series of events to occur" really a solution?

Solution to what?

The only problem that I see is that it's hard(er) for US companies to collect data about EU customers. That's hardly a problem for the EU customers; they can just buy from EU importers (if there's no equivalent EU product) or rely on EU service providers.

I don't really see a problem.

Re: Use of Google Analytics declared illegal by French data protection authority

#416

Post by tyfon »

judge2020 wrote: post #355
waffleiron wrote: post #318

Earlier quoted context omitted.

To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...

So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.

No, EU had an agreement with the US called Privacy shield that allowed US companies to process EU data. However this was struck down by US courts and that is what leaves us with this mess.

Re: Use of Google Analytics declared illegal by French data protection authority

#417

Post by nickpp »

inetknght wrote: post #410
nickpp wrote: post #393

Earlier quoted context omitted.

Are you afraid USA would drone strike or disappear you if they get to your private data? Do you think that is a valid concern for most people?

I think it's a valid concern for everyone, yes.

Then you should get out more and talk to some real people.

Re: Use of Google Analytics declared illegal by French data protection authority

#418

Post by closewith »

judge2020 wrote: post #355
waffleiron wrote: post #318

Earlier quoted context omitted.

To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...

So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.

If anything, it was a move to push US legislators to respect foreign privacy laws.

Re: Use of Google Analytics declared illegal by French data protection authority

#419

Post by lucideer »

eps wrote: post #285
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service . And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

You may have a good/decent/important broad point in general, but it's somewhat off-topic here. EU privacy directives and legislation are not particularly concerned (yet) with banning the sharing of data with third-parties, the focus at the moment is purely on regulating that sharing of data and ensuring it's only being shared with compliant third parties via compliant means.

In this case, Google is non-compliant but the gp's service/tool does appear to be. I think you're underplaying the distinction here quite severely.

TL;DR this is about what's illegal, not what's "evil".

Re: Use of Google Analytics declared illegal by French data protection authority

#420

Post by afiori »

hdjjhhvvhga wrote: post #373
abakker wrote: post #364

Earlier quoted context omitted.

no - the analysis is done on receipts, not just total products sold. They don't care what you bought, they care to know that people who buy diapers also buy wipes, and people who buy soy milk don't buy butter, etc. The analysis of anonymous receipts still yields very interesting and actionable results in aggregate. Your privacy has nothing to do with how a company analyzes its sales data as long as they don't include…

Yes, I understand that they see patterns and trends and a lot of valuable data: my point is that they have no way of tracking shopping habits of any individual purchaser unless they trick them into some loyalty program, coupons etc.

As a nitpick: "unless they trick enough customers in a loyalty program or something".

With enough good data (so probably not in all sectors) you can also identify people out of the system.

There are not that many bits of entropy in (contextualized) human behavior.

Post reply on HN