Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

461–470 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#461

Post by elevader »

umvi wrote: post #365
simion314 wrote: post #327

Earlier quoted context omitted.

>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party un…

> How, you don't enter your name when you pay with cache. You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". "Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash"

And the GDPR forbids them from writing that information (e.g. "the privacy nut bought apple juice") down or passing it to a third party without your explicit consent.

Re: Use of Google Analytics declared illegal by French data protection authority

#462

Post by rahkiin »

jimmaswell wrote: post #376
martin_a wrote: post #163

Earlier quoted context omitted.

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

This whole set of laws is so absurd. I should have the right to retain my server logs as long as I want. I bet in the future in Europe people will have the right to have others' brains forcibly zapped to remove embarrassing memories.

You do, but not user’s ip addresses

Re: Use of Google Analytics declared illegal by French data protection authority

#463

Post by einpoklum »

nickpp wrote: post #344
einpoklum wrote: post #259

Earlier quoted context omitted.

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies. That is irrespective of any legislation or court rulings, it's just common sense.

I wonder who are people more afraid of exposing their private information to: the USA or their own government.

The french service should expose user information to the French government either. If the government has a public warrant for that information, then opinions might differ about whether or not it is legitimate for the website operators to oblige.

Re: Use of Google Analytics declared illegal by French data protection authority

#464

Post by dgudkov »

iamacyborg wrote: post #262
dgudkov wrote: post #123

How can French websites track conversions from Google Adwords without Google Analytics?

Send your ad traffic to a specific landing page - monitor anonymised hits to that page. Send you ad traffic to a unique form per campaign so you know what campaign is generating leads. This isn't rocket science.

That would count clicks, not conversions such as downloads or signups that can require going on another page or doing some other action. Not everything can be put on one page.

Also, Google Adwords counts conversions for visits for 30 days. Which means on the 1st visit from the ad campaign, there can be no immediate conversion (and that's OK). But if the same person returns to the website (not from the ad) and downloads/signs up that would be counted as conversion attributed to the ad.

Re: Use of Google Analytics declared illegal by French data protection authority

#465

Post by newaccount74 »

weissed wrote: post #431
AdriaanvRossum wrote: post #233

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are person…

> The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. Why are anonymised IP addresses still considered "Personal Data"? Is it because Google is doing the anonymisation?

I guess it depends what "anonymised IP address" means. If it's still possible to correlate data from visitors across different websites, they might as well log IP addresses directly.

Re: Use of Google Analytics declared illegal by French data protection authority

#466

Post by eps »

sbarre wrote: post #405
eps wrote: post #337

Earlier quoted context omitted.

Here you go again, being coy. It's not an "also" analytics service. It _is_ an analytics service. If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know…

> The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it. This is an argument taken to a naive extreme. You can't expect every business to also be in the business of analytics, it's not realistic. There's a reason companies have business partners who specialize in certain services. It's why you have accountants, lawyers, marketers, etc.. Not…

You are missing the context.

Privacy-respecting analytics should be self-hosted. No one's arguing against an average business using an analytics service, but that shouldn't be bundled with any "privacy" monickers.

If Simple Analytics were pitched as "not a Google Analytics", this would've been perfectly fine. But they insist on the privacy angle and it just demonstrates they don't grok what tracking concerns are about.

Re: Use of Google Analytics declared illegal by French data protection authority

#467

Post by o_m »

VikingCoder wrote: post #392

If someone adds http://blah.us "> to their website, and that image is hosted in the United States, how does that not also violate French data protection? The user's browser makes a request to a US server, including the user's IP address. I legit do not understand how to make French people happy with these laws.

That easily be fixed by using CSP: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Re: Use of Google Analytics declared illegal by French data protection authority

#468

Post by silvercove »

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

No post body was provided.

Re: Use of Google Analytics declared illegal by French data protection authority

#469

Post by germanier »

elevader wrote: post #457
someotherperson wrote: post #311

Earlier quoted context omitted.

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

GDPR also applies to the real world. That store is definitely not allowed to share data about your shopping habits with some third party without your explicit consent. For example government departments in Germany have to aks for your explicit permission beforehand if they need to request/share data with a different department.

This is in general not true and German government departments share data with different departments all the time without explicit consent of the affected citizen. This is also not a good example as there are additional legal restrictions for government departments which businesses don't need to obey.

Re: Use of Google Analytics declared illegal by French data protection authority

#470

Post by orangepurple »

simion314 wrote: post #362
germanier wrote: post #347

Earlier quoted context omitted.

On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)

>By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so…

"Why is it legal" is the wrong question. There is nothing wrong with freedom. You already know this. The problem is the lack of competition. You should be asking why is the competition so small for this particular service with bad terms that you can't find a better place around you that provides a better service.
Post reply on HN