Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

851–860 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#851

Post by VikingCoder »

zelphirkalt wrote: post #845
VikingCoder wrote: post #786

Earlier quoted context omitted.

So a computer in France can not legally talk to a computer in the United States, but if I instead put that computer in France, I'm legally okay. And you're convinced that embodies "the whole point of the internet"?

You are building up a whole strawman here. This is all about sending personal data to a machine in the US, owned by a company, which falls under US law. You don't have to send that personal data to the US, do you? Why would you do such a thing in the first place? Surely informed people would not simply consent to such a practice. And I mean informed. Not just clicking "OK OK next OK" without knowing what actually goe…

It's not a strawman, it was the company I worked for.

We helped manufacture medical devices. We sold a device that took medical images, and then sent the images to a server. The server would do tons of processing on the images, and help manufacture a medical device custom to the patient.

We ran our servers in the United States.

We could not sell our product in France, until we stood up servers in France to store and process the data.

Why would we do such a thing? To provide excellent healthcare to people. Even ungrateful French people. Our product was lower cost and higher quality than our competitors, with better patient outcomes.

What monsters we were for running our servers in the U.S., right?

Re: Use of Google Analytics declared illegal by French data protection authority

#852

Post by themanmaran »

judge2020 wrote: post #654
cowl wrote: post #579

Earlier quoted context omitted.

Yes that is my interpretation of it. The whole point being that any data stored in US can not be guaranteed to respect GDPR because the US government can request access to that data and the EU citizens don't have a recourse to that. any US buisness that want to have EU citizens PI needs to have a host in EU.

Not just a host, but the corporation in control of the data can't be controlled by a US corporation at all, lest the US corporation be able to pressure the EU subsidiary into handing over that data.

So every US company needs to have a separate, non-controlled, entity in the EU? Seems pretty unrealistic to me.

In this scenario, I feel like the US company would be better off blocking traffic from the EU.

Re: Use of Google Analytics declared illegal by French data protection authority

#853

Post by intrasight »

ATsch wrote: post #687
intrasight wrote: post #424

"The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to Google Analytics. " https://support.google.com/analytics/answer/2763052 I don't understand how this can be construed as tracking users.

This is a totally different question, in this case what matters is that Google can be compelled to release the full IP address by US intelligence agencies.

So it's an easy fix for Google - change GA to only save those anonymized IPs

Re: Use of Google Analytics declared illegal by French data protection authority

#855

Post by jbkiv »

Wait, I don't get it.

Big tech companies don't park servers in the EU. Is it THAT difficult? Of course it is not, and they just don't want to do it.

On the other hand, big tech companies are happy to park their IP in Ireland (a EU country) in a phony company, simply to avoid paying taxes.

What's the logic?

Re: Use of Google Analytics declared illegal by French data protection authority

#856

Post by kilburn »

aksss wrote: post #818
lhorie wrote: post #722

Earlier quoted context omitted.

I think fragmentation and looking after one's interests aren't even opposites. Analytics in particular seem like a very lopsided value prop: the american entity (Google) stands to gain from collecting analytics but doesn't really provide a perceivable equivalent value through the analytics service to the affected parties (EU consumers) in return, as you'd normally expect in a fair trade policy between two countries.…

> lopsided value prop But that's not what CNIL is basing their decision on: "The CNIL concludes that transfers to the United States are currently not sufficiently regulated...Indeed, although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services." I probably…

> because the request headers of the client are being logged and used to identify a session

No need to dig so deep: IP addresses are considered private information under the current EU law, meaning that just opening a client-side connection somewhere leaks that data to that somewhere.

> I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence).

There is none. The difference is that the website studied in the ruling was not including resources hosted at Google Docs, and hence no mention of it. If the site embedded or directly linked to a google docs document the same reasoning would have been applied.

> CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly?

Almost. They don't want any calls prior to explicit user acceptance.

> What's the solution?

For fonts/images required to load the page, use EU-based hosting facilities. If you want to link to a google docs document, a youtube video or something like that, ask the user before following that link.

> That seems... sweeping, profound, surprising, impactful. Have fun with that.

It is, I don't think anyone is denying that. There are several things that may happen here:

1. US tech companies take it as common practice to spin-off EU-based companies that are not subject to US law and store everything in EU soil. When they don't, EU competitors pop up and EU companies use those.

2. The US passes laws that offer EU-level protections to both their own citizens/companies and (at least) EU-based citizens/companies.

3. The EU backtracks on this by adjusting their current laws.

Re: Use of Google Analytics declared illegal by French data protection authority

#857

Post by nomercy400 »

Dave3of5 wrote: post #209
iamacyborg wrote: post #140

Earlier quoted context omitted.

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Yes, because you're still passing personal data to the USA, which means US intelligence services can access it.

Is that the case for any data that is passed into the USA then rather than just GA? So if I hosted my servers in any of the AWS US regions that too would be illegal if they have any personal data in them. In this case personal data is a randomised unique id. So say I have a table of users and all I have is a username and a password and a unique id for the record that's personal data and the customer is not allowed to…

It will likely become even worse: it is not just AWS US regions, but any region. AWS is a US based company falling under US legislation, and (as far as I know) also owns its EU regions. So basically you cannot use AWS to store content of EU citizens.

You know any other US based companies? They have to follow the same reasoning.

It might even be if you are a US based company, you have to follow the same reasoning.

As a US company, you are not allowed to store or transfer data considered personal by GDPR of EU citizens, as your company can be compelled by the US government to hand over that data through an opaque/secret order where the EU citizen is not notified nor has the option to challenge this.

Re: Use of Google Analytics declared illegal by French data protection authority

#858

Post by RadixDLT »

jonny_eh wrote: post #758
javajosh wrote: post #744

Earlier quoted context omitted.

There is so much I want to say about this comment! First of all, it sounds like you had a terrible experience because you picked a bad ISP. I sympathize. But then you generalize from that and imply that anyone wanting an EU host will experience the same. Obviously that's not true - or do you believe no good ISPs exist in France? Second of all, why did you fork your code? Did you write your service to use proprietary…

> do you believe no good ISPs exist in France Nothing comparable to AWS/GCP/Azure.

have you tried Linode?

Re: Use of Google Analytics declared illegal by French data protection authority

#859

Post by lawik »

jbkiv wrote: post #855

Wait, I don't get it. Big tech companies don't park servers in the EU. Is it THAT difficult? Of course it is not, and they just don't want to do it. On the other hand, big tech companies are happy to park their IP in Ireland (a EU country) in a phony company, simply to avoid paying taxes. What's the logic?

So far they haven't solved something that resolves the problem of having US ownership as far as I can tell.

The issue isn't where the servers are. The issue is what parties can compell them to hand over information. As far as I've read on it at least. And if there is US ownership you have US courts that can demand information they aren't legally allowed to hand over according to EU law.

Re: Use of Google Analytics declared illegal by French data protection authority

#860

Post by boc »

nomercy400 wrote: post #847
mediascreen wrote: post #412

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace. It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs…

> most successful European entrepreneurs will just end up starting companies in the US instead. And then they will not be able to serve the european market, nor profit off the european economy. Good luck competing with each other for that US market.

More like they build successful companies in the US which then enter the European markets with a massive warchest and dominate any domestic EU startup in the space.
Post reply on HN