Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

441–450 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#441

Post by lucideer »

judge2020 wrote: post #281
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?

I don't think this judgement is about Google Analytics (or any implicit sharing of EU citizen/resident data with Google) being inherently illegal, but rather the current functioning of the Google Analytics service being specifically non-compliant.

e.g. Google could make Google Analytics compliant (likely by, as you say, housing EU data in Ireland), but it seems that currently they are not.

Also, beyond the physical colocation of data, there are ancillary issues around data being readily accessible (either by internal engineers/agents or external authorities) from outside the EU to consider as well.

Re: Use of Google Analytics declared illegal by French data protection authority

#443

Post by ballenf »

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

> we fragment and destroy the entire Internet

I would call fragmenting these things rebuilding the internet. Not sure how consolidating everyone on a few Mailchimp type services is in anyone's interest.

Re: Use of Google Analytics declared illegal by French data protection authority

#444

Post by BeFlatXIII »

nickpp wrote: post #344
einpoklum wrote: post #259

Earlier quoted context omitted.

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.

I wonder who are people more afraid of exposing their private information to: the USA or their own government.

As a US analog, I'm more concerned with my own government collecting data on me than I am about the Chinese. One of those has an entire ocean to cross to cause me IRL problems.

Re: Use of Google Analytics declared illegal by French data protection authority

#445

Post by ukutaht »

nickjj wrote: post #120
calyhre wrote: post #34

Earlier quoted context omitted.

I've been using [Plausible]( https://plausible.io ) in its self-hosted version for about a month, on a 7M+ page views per month. So far so good

What type of server specs (memory, CPU, disk size, etc.) do you use to self host it? Based on an open issue[0], it's suggested to run a server with 32GB+ of memory to handle hosting Clickhouse but that would mean self hosting Plausible would end up being $160 / month on DigitalOcean which would make it 10x more expensive than hosting my custom app that I want to see analytics for. I know you can use less memory but i…

Clickhouse has got a lot better in limited memory environments. They now recommend 4GB minimum.

The production environment that crashed due to Clickhouse OOM was our hosted product a while ago :) After that, we haven't had any downtime on our Clickhouse DB for over a year.

The issue with disk space stems from a bad default configuration. Clickhouse used to have EXTREMELY noisy debug level logging enabled by default with no rotation. This has been fixed in our hosting repo[1] so you get sensible defaults.

If you don't want to worry about downtime, planning disk space or compute capacity, then that's exactly what we offer at https://plausible.io. We process and keep the visitor data on our Hetzner servers in Germany.

1. https://github.com/plausible/hosting

Re: Use of Google Analytics declared illegal by French data protection authority

#446

Post by jdrc »

i5heu wrote: post #433
mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

That’s okay. The EU can build it itself when the US player are not able to not send data to their US data centres.

I don't think it can. Maybe they can buy yandex, but i think europe has drained its talent tothe US. And even if they build it, how will they monetize it?

Re: Use of Google Analytics declared illegal by French data protection authority

#447

Post by hamilyon2 »

VikingCoder wrote: post #392

If someone adds http://blah.us "> to their website, and that image is hosted in the United States, how does that not also violate French data protection? The user's browser makes a request to a US server, including the user's IP address. I legit do not understand how to make French people happy with these laws.

I suppose GA effectively tracks you across IP addresses and maybe even across private sessions on one very popular browser.

Re: Use of Google Analytics declared illegal by French data protection authority

#448

Post by lucideer »

stdgy wrote: post #346
axiosgunnar wrote: post #292

Earlier quoted context omitted.

Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.

Could they house their data in a separate company that was founded in Ireland and is not an Alphabet subsidiary to get around this?

IANAL but I don't believe this commenter is correct. If they were, this would essentially prohibit any non-EU company from doing any online business with anyone within the EU.

I suspect the issue is rather that Google Ireland are not in fact exclusively housing EU data within Ireland (or the EU in general).

Re: Use of Google Analytics declared illegal by French data protection authority

#449

Post by fprct »

lmkg wrote: post #313
cnorthwood wrote: post #265

Earlier quoted context omitted.

Point 1 isn't true. You've been able to send personal data (PII being the specific US legal term) to the US no problem - as long as you had "standard contractual clauses" (SCCs) as part of your contract with them that the company meets GDPR requirements. This is the same agreement to send data to any country outside the EU where there isn't a pre-existing agreement. I believe this ruling is saying that it's not possi…

The original ruling was nuanced, and this ruling is clarifying some gray area inside of it. The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient. The "additional safeguards" must include a risk a…

Wait, wouldn't that imply that EU startups can't host their infra on GCP, AWS or Azure? I'm not even talking about analytics - just about simple user email required to login would be problematic now.

Re: Use of Google Analytics declared illegal by French data protection authority

#450

Post by nerbert »

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

These tools have EU versions of their services with servers in Ireland or other places so that the data does not leave the territory. There will be absolutely no consequence to these regulations.
Post reply on HN