Use of Google Analytics declared illegal by French data protection authority • Hacker News Board

Re: Use of Google Analytics declared illegal by French data protection authority

#631

Post by mnw21cam » Thu, Feb 10, 2022, 5:17 PM UTC

neuronflux wrote: post #555

mnw21cam wrote: post #357

Earlier quoted context omitted.

Microsoft has seen this one - they have a subsidiary in the EU that holds the EU data. Yes, the US-based parent company is legally bound to provide the data at the request of the US gov agencies. However, the only way that they can get hold of that data is to ask the EU subsidiary nicely. The EU subsidiary is legally bound to not hand that data over.

Do you know if Microsoft setup this EU shell after the whole thing with the FBI wanting emails stored in Ireland? https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat... (2016) and https://en.wikipedia.org/wiki/CLOUD_Act (2018). If so, it might end up in court again, and we'll have to see how that precedent gets set out. Will be curious to see how this plays out.

I think it was set up beforehand. Also, I think nobody really wanted to go as far as setting any precedents, in case they ended up being precedents that they didn't want.

Re: Use of Google Analytics declared illegal by French data protection authority

#632

Post by chaostheory » Thu, Feb 10, 2022, 5:18 PM UTC

foxfluff wrote: post #624

chaostheory wrote: post #525

Earlier quoted context omitted.

I feel that the whole point of this is to mimic China’s achievement of driving out foreign competition through legislation. It’s similar to the UK’s pornography laws being more about surveillance and censorship rather than protecting children.

If you flip the scenario around in your mind.. how would you feel if virtually every site or service you visit scoops up your data and sends it to [China|Russia|...] and hosts all your private data on servers operated by the [Chinese|Russians|...] and are subject to [Chinese|Russian|...] rule and disregard whatever laws your country has enacted? How would you feel if you couldn't opt out without virtually opting out…

Simple. If you have a free market, I would just use competing services instead of the "Chinese" ones. No one is forced to use TikTok. If people really wanted a privacy focused service, a new one will arrive. DuckDuckGo's success is an example of that.

imo it's just a thinly veiled protectionist law that will fracture the internet all for the sake of propping up EU incumbents who can't innovate.

Re: Use of Google Analytics declared illegal by French data protection authority

#633

Post by shkkmo » Thu, Feb 10, 2022, 5:19 PM UTC

rdiddly wrote: post #533

croes wrote: post #503

Earlier quoted context omitted.

Nope, the external company bookkeeper doesn't know which of the hundreds or thousands transactions are done by me. He doesn't even know how often I bought something. And even if, that knowledge is nothing compared to the millions of data points of services like google analytics.

If it were true as AdriaanvRossum said above that Simple Analytics data has "no identifiers" (taking that at face value for now) then that seems exactly analogous to those cash transactions someotherperson describes.

Simple Analytics absolutely does receive identifies (namely IP address). They claim they do not store these address, but that depends entirely on trusting them and their closed source software.

This is very unlike the accounting firm, which never receives any identifying for cash transactions and thus couldn't store it even if they wanted to.

Re: Use of Google Analytics declared illegal by French data protection authority

#634

Post by RIMR » Thu, Feb 10, 2022, 5:19 PM UTC

rebelde wrote: post #210

Taking this to the logical extreme: A French website can not use any American service, right? Because any American services "are not sufficient to exclude the accessibility of this data for US intelligence services".

Taking this to the logical conclusion: This is the fault of US Intelligence Services for overreaching to the point where it impacts general trust in US companies, and should be solidly blamed on them for being legitimately untrustworthy and exploitive.

Re: Use of Google Analytics declared illegal by French data protection authority

#635

Post by xdennis » Thu, Feb 10, 2022, 5:20 PM UTC

jimmaswell wrote: post #384

Quoted post unavailable.

Why are Europeans the bad guys here? It wouldn't be an issue at all of the US respected the privacy rights of Europeans.

It's the same with cookies. Instead of blaming sites which spy on you, some blame the EU for protecting its citizens.

Re: Use of Google Analytics declared illegal by French data protection authority

#636

Post by seabrookmx » Thu, Feb 10, 2022, 5:20 PM UTC

brianwawok wrote: post #599

wongarsu wrote: post #534

Earlier quoted context omitted.

> like AWS, Azure, Mailchimp, PayPal etc [...] No cloud services, no Office 365 or Google Workspace. Maybe an unpopular opinion, but imho AWS, GCP and Azure are popular with startups because of their generous free credits, not because they are good tools for startups. As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Grids…

> As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Gridscale, OVH, etc) As an actual startup founder who started as a 1 man startup, strongly disagree. Spent maybe $200 a month on Google Cloud, got an actual production ready cluster. Scaled up to Millions in revenue, never had to deal with any Linux Server admin BS. More…

100%. The hidden part here is "DigitalOcean-level of complexity" is actually "DigitalOcean-level of features."

The big cloud providers have a variety of offerings of different complexity. Using GCP as an example: want k8s with all it's flexibility and complexity? You have GKE. Want to still run containers, but abstract away all the cluster resource management? CloudRun. Abstract away the container itself? CloudFunctions. AWS has EKS, ElasticBeanstalk, etc.

I understand people get overwhelmed the first time they're dropped into the console of these cloud providers but really it just takes a bit of reading to figure out what you should/shouldn't care about. And the benefit of doing so is enormous.

Re: Use of Google Analytics declared illegal by French data protection authority

#637

Post by tempnow987 » Thu, Feb 10, 2022, 5:20 PM UTC

dbrgn wrote: post #352

Dave3of5 wrote: post #133

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Pl…

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. From what I can tell: If you ask your users for permisssion ("informed consent"), then no, it is not illegal. The way I understood the court case in Austria, the disputed point was whether or not the use of GA f…

I think this is basically a fat EU lie - that if you pop up a cookie popup most users say no to cookie banners.

I've heard that if you do a non-modal cookie banner, 75% of people just ignore it rather than go into it to deny cookies. About 12% (half of remaining) click accept all cookies. The rest close it again without taking action if they can.

I realize there are folks who go into things and customize everything on every website - most users I think don't care enough.

What's funny -> your ISP might be selling your browsing history. Your TV is selling your watching history and no one cares. But cookie pop-ups everywhere is all these privacy idiots can think about. It's performative privacy, that annoys the heck out of a lot of users and wastes a ton of time.

Re: Use of Google Analytics declared illegal by French data protection authority

#638

Post by kyboren » Thu, Feb 10, 2022, 5:21 PM UTC

germanier wrote: post #492

iicc wrote: post #474

Earlier quoted context omitted.

>your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). GDPR requires data sharing to be done for a defined purpose. The purpose of sharing data with an external company bookkeeper for bookkeeping is not remotely connected to any purpose an analytics service fulfills. So while the shared data is capable of the same insights, it's explicitly illegal for i…

It's still legal to ask your bookkeeper to go through the books and give you a list of your 10 best selling products broken down by season (given you have all the right paperwork in place with them etc. but no consent of the customers needed).

Well, it's not necessary to process any personal data in order to calculate that.

Can you ask your bookkeeper to tell you the top 3 best selling products for your top 5 customers without declaring that the purpose of the data transfer to the external bookkeeper is also to run sales analytics?

Re: Use of Google Analytics declared illegal by French data protection authority

#639

Post by jkaptur » Thu, Feb 10, 2022, 5:21 PM UTC

aftergibson wrote: post #11

Is anyone using an alternative that provides some basic analytics and isn't likely to get me in legal hot water in the future? I've already offloaded Google Fonts due to the German ruling. I'm happy to self-host piwik if needed, but could that fall foul of regulators?

The cnil.fr page hosting this article seems to use self-hosted piwik, which is a good sign that the regulators think it's ok.

(I wonder why they need to collect analytics information for this page at all.)

Re: Use of Google Analytics declared illegal by French data protection authority

#640

Post by gxs » Thu, Feb 10, 2022, 5:22 PM UTC

xdennis wrote: post #581

mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their priv…

This is a great response to OPs comment.

At the end of the day we should be doing what is good for the People and somehow its always assumed that they will/should be the ones impacted when policies like these are enacted.

But Europe has leverage here - I don't think Amazon would want to miss out on a giant market base out of some moral principle and there are probably other levers to be pulled here to encourage that.

Anyway, not adding much to your comment other than kudos.