Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

731–740 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#731

Earlier quoted context omitted.

> As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Gridscale, OVH, etc) As an actual startup founder who started as a 1 man startup, strongly disagree. Spent maybe $200 a month on Google Cloud, got an actual production ready cluster. Scaled up to Millions in revenue, never had to deal with any Linux Server admin BS. More…

OVH gave us home. Enrolled us to Startup Program. Gave us support and hefty credit. Managed K8s. Openstack. When we started paying for it, it was still cheaper than AWS. Just because AWS is the default, does not mean you should use it.

Was that before their datacenter caught fire and their customer servers were lost or after?

Re: Use of Google Analytics declared illegal by French data protection authority

#732

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Pl…

You can likely still do analytics if you don't collect an identifier that persists through multiple sessions. That's a big hit for ad-tech, but plenty other use cases don't really care for that property.

You can also collect that identifier if 1) you have a legitimate reasons to do so and 2) don't share it with third parties.

Re: Use of Google Analytics declared illegal by French data protection authority

#733
post #699

Earlier quoted context omitted.

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

This completely misses the point, the laws shouldn't be written to accommodate businesses, its the other way around. If fragmenting is a consequence of better privacy laws, so be it.

Businesses exists for consumers. Fragmenting hurts people - European users - in the first place.

I see very little advantages from these privacy laws but I use and appreciate US businesses every day.

Re: Use of Google Analytics declared illegal by French data protection authority

#734

Earlier quoted context omitted.

OVH gave us home. Enrolled us to Startup Program. Gave us support and hefty credit. Managed K8s. Openstack. When we started paying for it, it was still cheaper than AWS. Just because AWS is the default, does not mean you should use it.

When I started, no other providers had the K8s features I needed. Still prefer Google, as they are the OG for k8s.

And power to you. You did what you though was best in your circumstances.

Today circumstances have changed. You need hassle free scalable DB, then AWS RDS might you best choice. Maybe.

You need open standard IaaS, well, there is ton of options.

Even before K8S, you had and option of Openstack with Ansible. Yes, very different beast, but still much _simpler_ and _cheaper_ than stocking on large number of IT professionals.

Re: Use of Google Analytics declared illegal by French data protection authority

#735
post #334

Earlier quoted context omitted.

Hah, it's a myth that Switzerland is so privacy oriented. They have laws saying that the Swiss intelligence services can access all data, so it wouldn't help. And Switzerland is not part of the EU.

Both Swiss and German people seem completely deluded about the activities of their own governments and intelligence agencies.

You gonna have to be a bit more specific than that.

When I think "Swiss", "Germany" and "government intelligence agencies" then the things that come to my mind are Crypto AG [0], how the BND started out as a CIA OP [1] and how the very same BND seems to be more interested in pleasing American interests than protecting Germans [2].

Which is btw the same BND who cooperates with the NSA [3] to help them tap directly into one of the world's largest IXP De-CIX, completely legal in Germany [4].

The US made sure of that by pressuring the West German government into watering down the G-10 law [5] during the cold war.

So whatever "delusions" you are referring there to, you have to be a bit more concrete about them.

[0] https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-ci...

[1] https://en.wikipedia.org/wiki/Gehlen_Organization

[2] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...

[3] https://en.wikipedia.org/wiki/Operation_Eikonal

[4] https://www.spiegel.de/netzwelt/netzpolitik/de-cix-betreiber...

[5] https://www.europarl.europa.eu/document/activities/cont/2014...

Re: Use of Google Analytics declared illegal by French data protection authority

#736
post #391
post #320

Earlier quoted context omitted.

Exactly, the CLOUD act is the one of the main problems here: https://en.wikipedia.org/wiki/CLOUD_Act

I've read most of the EU rulings and court cases on this topic. The CLOUD Act is basically the only US law that any of them mention or refer to. And let's be explicit here: The entire purpose of the CLOUD Act is to bypass EU data protection laws. The incident that led to the creation of this law is that Microsoft didn't hand data over to the FBI because the data was on a server in Ireland. This isn't an unintended co…

The point of the CLOUD Act was to say that if you are a company in the US you can't ignore an order to turn over a copy of data you control just because you happen to have stored that data with a third party storage provider that is not in the US.

It doesn't matter that the third party storage provider is not under US jurisdiction because the US government isn't trying to compel the third party storage provider to do anything. They are trying to compel the US company to access its own documents that it stored with that third party, using the same mechanisms the US company normally uses when it wants to access its data.

From the third party storage provider point of view there is no difference between the US company retrieving the data because it wants to do something with it itself or the US company retrieving the data because they are being compelled to by law enforcement.

This is really just clarifying that the rules for electronic documents are not very different from the rules for physical documents. If I am in the US and own a document that a US court orders me to produce a copy of I'm not going to be able to get out of that by telling them that the document is in a filing cabinet in a storage unit I rent in Canada or Mexico. No, they are going to order me to either go get that document or have someone go get it for me and give it to the court.

If it didn't work this way every US company that has any documents they think might get them in trouble if they are ever investigated would rent some storage space outside the US, physical space if the documents are on paper and cloud storage space if they are electronic, and store everything there. Boeing for instance would have all its information about the 737 MAX outside of the US. Tesla would have everything related to full self-driving outside the US. Everyone would keep HR records outside the US to make it harder for plaintiffs if the company is ever sued over alleged discrimination.

Re: Use of Google Analytics declared illegal by French data protection authority

#737

Earlier quoted context omitted.

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

The fragmentation is acceptable since the alternative for non-US citizens is to be treated as "free game"?

No post body was provided.

Re: Use of Google Analytics declared illegal by French data protection authority

#738

Earlier quoted context omitted.

OVH gave us home. Enrolled us to Startup Program. Gave us support and hefty credit. Managed K8s. Openstack. When we started paying for it, it was still cheaper than AWS. Just because AWS is the default, does not mean you should use it.

Was that before their datacenter caught fire and their customer servers were lost or after?

Yes, OVH experienced force majeure episode. I didn't follow exactly how the compensation was rolled out. I know it was messy. I am not going to defend their actions, I am sure they could always handle this better.

Disaster recovery planning is practice we should all adhere to. Hindsight is 20/20. Not trying to be a smartass. I know it was painful for a lot of folks.

At the same time, unless you paid for managed service with clear SLAs, then responsibility is yours.

Cloud is just someone else's computer.

FYI: we started with OVH before the fire

Re: Use of Google Analytics declared illegal by French data protection authority

#739

Earlier quoted context omitted.

Did you read their docs? They aren’t setting cookies or collecting IP addresses. There’s no question to me that EU authorities would approve this method.

Visitors' IP addresses are provided to Simple Analytics in the course of loading their script and reporting back the results. That's all it took to get web sites using public Google Fonts resources in trouble—note that this didn't involve any actual analytics scripts or overt data collection, just some embedded CSS and font resources. The only real advantage Simple Analytics has here is that they aren't Google, so th…

The regional Google Fonts ruling was an odd one. It had to do with Google processing the IP address, not whether the website was loading from any external domain at all. It did appear to be based on the court's misunderstanding of an IP address contacting a server to be data processing, and perhaps we're going in that direction, and won't be able to use even an extremely privacy-focused CDN without a formal data processing agreement, but that is not currently the intent of GDPR.

The advantage of a service like Simple Analytics remains; it does not store or process any user data.

Re: Use of Google Analytics declared illegal by French data protection authority

#740

Earlier quoted context omitted.

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

> would take weeks of vacation with zero support for us Heh. Somethings tells me a devops engineer in France has way better work-life balance.

You'd think a _team_ of them could provide 8/5 (8 hours a day, 5 days a week) service...
Post reply on HN