Use of Google Analytics declared illegal by French data protection authority • Hacker News Board

Re: Use of Google Analytics declared illegal by French data protection authority

#611

Post by RIMR » Thu, Feb 10, 2022, 5:03 PM UTC

Dave3of5 wrote: post #209

iamacyborg wrote: post #140

Earlier quoted context omitted.

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Yes, because you're still passing personal data to the USA, which means US intelligence services can access it.

Is that the case for any data that is passed into the USA then rather than just GA? So if I hosted my servers in any of the AWS US regions that too would be illegal if they have any personal data in them. In this case personal data is a randomised unique id. So say I have a table of users and all I have is a username and a password and a unique id for the record that's personal data and the customer is not allowed to…

Yes, that's exactly right. Makes perfect sense to me.

Re: Use of Google Analytics declared illegal by French data protection authority

#612

Post by spullara » Thu, Feb 10, 2022, 5:04 PM UTC

isbvhodnvemrwvn wrote: post #610

spullara wrote: post #478

Do they somehow count the users browsers making a request to a US server as the website transferring data to the US? It is pretty clear that the users browser did that and not the website or Google.

And technically if you hit someone in the head with a hammer than it's the hammer that's hitting the head, and not you. It's a meaningless distinction made in bad faith.

No, this is like blaming the manufacturer of the hammer.

Re: Use of Google Analytics declared illegal by French data protection authority

#613

Post by zeeZ » Thu, Feb 10, 2022, 5:04 PM UTC

mekkkkkk wrote: post #537

iofiiiiiiiii wrote: post #504

Earlier quoted context omitted.

Microsoft will be storing EU users' data in the EU: https://blogs.microsoft.com/eupolicy/2021/05/06/eu-data-boun... Will this enable them to comply with the requirements?

Microsoft has done the leg work for this already. They currently have a completely contained Azure environment in Germany. I think it was deployed to ensure compliance with german/EU health data protocols. I have first hand experience of this, migrating between their global PaaS and the contained German one. The bulkheads are quite air-tight (much to my personal detriment).

They also had a completely separate o365 offering called Microsoft Cloud Germany that failed due to lack of interest (and the fact that it was years behind the global platform, I say), which was finally shut down last year, with everyone who renewed their contract automatically being migrated off.

They're working on it, but still not everything is entirely regional.

Re: Use of Google Analytics declared illegal by French data protection authority

#614

Post by parasense » Thu, Feb 10, 2022, 5:06 PM UTC

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

> It will take forever to build up a similar ecosystem in Europe

And even then it seems risky the EU will deem the business model entirely in violation of privacy laws. It's very chilling

When the EU finally completes their utopian/dystopian ideas of privacy from foreign Internet services, the great firewall of Europe, perhaps then EU regulators will look inward and do the same things?

But for now it all has the appearance of disfavoring International Internet services, as if to encourage regional tech companies to advance.

Which seems reasonable, Europe seems to have lost most of it's Tech companies, and that's a problem that needs to be fixed. It's just weird to go about the problem by claiming International companies are in violation.

Re: Use of Google Analytics declared illegal by French data protection authority

#615

Post by cycomanic » Thu, Feb 10, 2022, 5:06 PM UTC

eulenteufel wrote: post #597

einpoklum wrote: post #479

Earlier quoted context omitted.

> The USA government is (largely) democratic Well, if I may nitpick, it's a federal republic rather than a democracy... More to the point though, there was this study at Princeton U about the correlation between US government policy and popular opinion on a variety of subjects which found that public opinion correlates very poorly with government policy / legislation passed, but opinions among the very-rich correlate…

> it's a federal republic rather than a democracy... Germany is both a federal republic and a democracy and I would argue the the USA are too. Both countries ultimatively derive their legislation from the general populace and are representative democracies. I've seen the claim you made several times, but every time I try to look it up I fail to understand it. What is your reason to think a federal republic would excl…

Yes this seems to be a common distinction made in the US, which I also don't understand. What I learned in politics at school (and studying it for a short time) was that republic and democracy are orthogonal concepts (leds leave out the federal which seems to be even another dimension).

A republic essentially means, the state doesn't have a king (head of state by inheritancel, but some sort of president which gets elected in some way (not necessary by the population). A democracy is a category of how decisions get made, i.e. by some vote of the people (demos).

Is there some subtlety I'm missing or is this thing about "federal Republic not democracy" something just always repeated, without properly understanding it. .

Re: Use of Google Analytics declared illegal by French data protection authority

#616

Post by zeeZ » Thu, Feb 10, 2022, 5:07 PM UTC

zeeZ wrote: post #613

mekkkkkk wrote: post #537

Earlier quoted context omitted.

Microsoft has done the leg work for this already. They currently have a completely contained Azure environment in Germany. I think it was deployed to ensure compliance with german/EU health data protocols. I have first hand experience of this, migrating between their global PaaS and the contained German one. The bulkheads are quite air-tight (much to my personal detriment).

They also had a completely separate o365 offering called Microsoft Cloud Germany that failed due to lack of interest (and the fact that it was years behind the global platform, I say), which was finally shut down last year, with everyone who renewed their contract automatically being migrated off. They're working on it, but still not everything is entirely regional.

https://docs.microsoft.com/en-us/microsoft-365/enterprise/o3...

Re: Use of Google Analytics declared illegal by French data protection authority

#617

Post by RIMR » Thu, Feb 10, 2022, 5:07 PM UTC

seiferteric wrote: post #593

Random thought, maybe totally off base. This is Europe, so not equivalent but there seems to be a lot of people in the US as well who want private companies to be compelled to respect your privacy (4th amendment) but also many people who don't think websites should or could be compelled to respect your freedom of speech (1st amendment), I wonder if there is an overlap in these groups...

I don't think these concepts are comparable. My First Amendment rights cannot be violated by a private website, because I can always go to another website, or start my own. Being deplatformed isn't the same as being silenced, because nobody is preventing you from speaking, or punishing you legally for what you have said.

My Fourth Amendment rights could absolutely be violated by a private website, as they could hand my potentially incriminating private data over to the US authorities, without a warrant and without my consent, and there's literally no opt-out or recourse for me if that data is then used against me by the government.

Re: Use of Google Analytics declared illegal by French data protection authority

#618

Post by martin-adams » Thu, Feb 10, 2022, 5:08 PM UTC

wongarsu wrote: post #534

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

> like AWS, Azure, Mailchimp, PayPal etc [...] No cloud services, no Office 365 or Google Workspace. Maybe an unpopular opinion, but imho AWS, GCP and Azure are popular with startups because of their generous free credits, not because they are good tools for startups. As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Grids…

I would say that looks at the state of things as they are today, which may not be the case as technology advances. If there's a service that provides a real competitive advantage that is only available outside of Europe, then this might exclude businesses in Europe to innovate and compete.

Re: Use of Google Analytics declared illegal by French data protection authority

#619

Post by YetAnotherNick » Thu, Feb 10, 2022, 5:09 PM UTC

i5heu wrote: post #433

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

That’s okay. The EU can build it itself when the US player are not able to not send data to their US data centres.

Why would EU building it themselves going to happen? Either it could be profitable for company to operate in EU or it is not. Assuming current US companies are efficient enough and if they couldn't be profitable, why could be a same thing built by EU is profitable there. In fact it is opposite as they couldn't track as much as American companies even outside EU.

Re: Use of Google Analytics declared illegal by French data protection authority

#620

Post by isbvhodnvemrwvn » Thu, Feb 10, 2022, 5:10 PM UTC

spullara wrote: post #612

isbvhodnvemrwvn wrote: post #610

Earlier quoted context omitted.

And technically if you hit someone in the head with a hammer than it's the hammer that's hitting the head, and not you. It's a meaningless distinction made in bad faith.

No, this is like blaming the manufacturer of the hammer.

The law is clearly meant to protect an average citizen. It's unreasonable to expect them to know how the web and browsers work. When you instruct the browser to display something, you should take full legal responsibility for what you are instructing the browser to do, because from users point of view it's the website owner who is displaying all of that.