Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

771–780 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#771

Post by shadowgovt »

MereInterest wrote: post #749
shadowgovt wrote: post #204

Earlier quoted context omitted.

At this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.

I'd be interested to hear exactly what default configuration violates GDPR, as that wasn't something I'd heard before. However, even if that is the case, that would imply that the defaults should be changed. Imagine that you run a workplace where floor space is relatively expensive. To avoid increasing the floor space, you determine exactly how wide each hallway must be, exactly how much space is required, and build…

> I'd be interested to hear exactly what default configuration violates GDPR

https://law.stackexchange.com/questions/42438/do-default-apa...

It would appear public IP addresses are PII. Apache (and most web servers) log those by default.

A case can be made, on a site-by-site basis, that those are necessary for providing the functionality of the site. But that's a hard case to make if the logs are never actually read, and then if they're collected for that purpose, timely deletion is important (and unless your host also configures log rotation and disposal, timely deletion isn't happening).

I'm pretty sure all of this has to be declared in a privacy declaration anyway, even if they are collected for site operations purposes and deleted in a timely fashion. With all these constraints, probably safer to run in a privacy-configured Docker in one of the big Cloud hosts than to stand up one's own apache install.

Re: Use of Google Analytics declared illegal by French data protection authority

#772

Post by javajosh »

VikingCoder wrote: post #756
javajosh wrote: post #744

Earlier quoted context omitted.

There is so much I want to say about this comment! First of all, it sounds like you had a terrible experience because you picked a bad ISP. I sympathize. But then you generalize from that and imply that anyone wanting an EU host will experience the same. Obviously that's not true - or do you believe no good ISPs exist in France? Second of all, why did you fork your code? Did you write your service to use proprietary…

We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort. We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our serve…

>I'm sorry, do you have any idea of the cost of doing these things?

Oh indeed yes, which is why for years now I've been warning people to not write to proprietary APIs in the first place. It's a faustian bargain and sooner or later the bill is going to come due! If not because of legal requirements, then because MS or Amazon saturates the market, and has to increase revenue somehow. This is an example of where an ounce of prevention is worth a pound of cure. The upshot is that ignoring the warnings of people like me was a mistake.

(It's funny how people have moaned for years about "vendor lock-in" WRT Oracle. "They charge for every core!" But the cloud providers charge for every invocation, which is infinitely worse. And yet no-one seems to worry about it. It's really odd.)

Re: Use of Google Analytics declared illegal by French data protection authority

#773

Post by bee_rider »

mediascreen wrote: post #509
brahadeesh wrote: post #491

Earlier quoted context omitted.

Exactly. If this make European startups build their own ecosystem and provides me with an alternative for the services I use but don't track me, I'm going to switch - simple as. I see this as a win for the internet.

Why limit it to the EU? Shouldn't every country have their own AWS, Azure and Google Cloud? I think we underestimate just how difficult it is just to replicate existing services, let alone keep up with the innovation. It's like the Argentinian effort to stimulate its own computer manufacturing by banning Apple products.

The EU as a block is pretty comparable to the US, so it wouldn't be that surprising if they came up with their own information infrastructure. I think you've answered your own question: why limit it to the EU? No moral reason, but it is a difficult project, you need a US/EU/China sized economy to have a good chance to pull it off.

Re: Use of Google Analytics declared illegal by French data protection authority

#774

Post by sweetbitter »

nickpp wrote: post #178
estaseuropano wrote: post #85

Earlier quoted context omitted.

I don't like the meat industry, but seriously all these food safety laws are getting out of hand. Anyone who's concerned about salmonella, hormone levels or animal welfare, can just not buy any products that could potentially contain animal products from countries with weak animal welfare or sanitary laws. The rest is just making life of farmers/shops/wholesalers harder. Especially with these European intentions, I f…

Eating tainted meat can kill you. What’s the worst corporations can do by tracking you? Better ads?!

"We kill people based on metadata." - Former NSA Head Michael Hayden.

Re: Use of Google Analytics declared illegal by French data protection authority

#775

Post by mdavis6890 »

RustyConsul wrote: post #647
mmastrac wrote: post #609

Earlier quoted context omitted.

Protecting the privacy of citizens is not akin to society-wide censorship, a la China. This is a disingenuous argument.

Kind of. I'm still losing my ability to choose. I've often found the slippery slope 'Fallacy' to not be so much of a fallacy in reality when it comes to power.

Yep, next to be banned is fake news articles, then entire sites that contain some fake news articles, then sites that contain links to other sites that have fake news....

[Edit] for clarity

Re: Use of Google Analytics declared illegal by French data protection authority

#776

Post by [deleted] »

VikingCoder wrote: post #667
xdennis wrote: post #581

Earlier quoted context omitted.

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their priv…

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

[deleted]

Re: Use of Google Analytics declared illegal by French data protection authority

#777

Post by titzer »

VikingCoder wrote: post #667
xdennis wrote: post #581

Earlier quoted context omitted.

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their priv…

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

> You are absolutely fragmenting the internet.

It's not fragmenting the internet; fragmentation is the whole point of the internet. It's (re-)decentralizing something that has been decentralized the whole time, until these gluttonous whales decided try to eat the whole pie.

Re: Use of Google Analytics declared illegal by French data protection authority

#778

Post by tick_tock_tick »

Vespasian wrote: post #717
CodeBytes wrote: post #659

Earlier quoted context omitted.

That doesn't seem to be true though. There are multiple countries outside the EU that have an adequacy decisions regarding their privacy laws like: Japan, South Korea, Canada, UK, Isreal, etc. They can host EU data without issues. The only reason the privacy shield agreement was thrown out was due to lack of safe guards from US intelligence. Even without the privacy shield, US companies would still be able to store E…

Critically, they want access for for free. The US does not have to give anything in return to get all the private data from EU they want. The EU in return gets...nothing. If you are a politician this is not a great position, you get no money, no jobs and no data. If they equalize data access, "data sharing" (on an intelligence and on a commerical level) could be a valuable component of future negotiations.

> The EU in return gets...nothing.

The EU gets the services they use....

Re: Use of Google Analytics declared illegal by French data protection authority

#779

Post by kergonath »

nickpp wrote: post #698
kergonath wrote: post #530

Earlier quoted context omitted.

I think you’re right. Microsoft is perfectly able to split its operations. They’re doing it now in China in a much more drastic fashion, and they seem to have been preparing to do it in Europe for a few years now.

The fact that US companies may need to treat Europe like China speaks volumes about the road the EU is headed on.

It says quite a lot about American imperialism, actually. These developments were basically guaranteed the moment the CLOUD act passed, and after the adventures Microsoft had with the DoE.

Re: Use of Google Analytics declared illegal by French data protection authority

#780

Post by VikingCoder »

javajosh wrote: post #772
VikingCoder wrote: post #756

Earlier quoted context omitted.

We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort. We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our serve…

>I'm sorry, do you have any idea of the cost of doing these things? Oh indeed yes, which is why for years now I've been warning people to not write to proprietary APIs in the first place. It's a faustian bargain and sooner or later the bill is going to come due! If not because of legal requirements, then because MS or Amazon saturates the market, and has to increase revenue somehow . This is an example of where an ou…

So yeah, using HTTP to connect to a server that happened to be in the US... That's the thing that prevented us from selling in France.

But thanks for lecturing me that "vendor lock in" was what killed our 6-developer team that was developing hardware, and computer vision, and 3D computer graphics, while developing a health care product under the tons of regulation that comes with that.

Your arrogance is just stunning.

Post reply on HN