Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

891–900 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#891

Post by belorn »

brianwawok wrote: post #683
belorn wrote: post #643

Earlier quoted context omitted.

I would guess that if costs is an issue then it must also be balanced compared to the potential profits. If your current $200 solution only allowed you to have US customers, while a $300 solution would allow you to have both US and EU customers, which one would you choose?

The US has plenty of customers. If I had to drop EU, I will. It's a nice bonus, but not a core requirement.

That seems good. Someone could copy your business and spin up on the EU market. If its profitable its profitable and its no worry for you. If its not profitable then the EU market is not large enough to carry the product on its own. GDP of the US is around $25 trillion, and EU is around $18 trillion, and population wise there are around 300 million people in the US and 400 million people in the EU.

Might I ask you what kind of product your 1 man startup have?

Re: Use of Google Analytics declared illegal by French data protection authority

#892

Post by ihuman »

tremon wrote: post #586
cdot2 wrote: post #421

Earlier quoted context omitted.

I've been having to remove google fonts because we had some germans say we're breaking their laws by using them

Why remove them? Why not proxy/cache the fonts from your own server?

Depending on the license, that might cost more, or not be an option at all. For example, Adobe doesn't allow you to host their fonts; you have to link to their CDN. https://helpx.adobe.com/fonts/using/font-licensing.html#web-...

Re: Use of Google Analytics declared illegal by French data protection authority

#894

Post by eecc »

VikingCoder wrote: post #780
javajosh wrote: post #772

Earlier quoted context omitted.

>I'm sorry, do you have any idea of the cost of doing these things? Oh indeed yes, which is why for years now I've been warning people to not write to proprietary APIs in the first place. It's a faustian bargain and sooner or later the bill is going to come due! If not because of legal requirements, then because MS or Amazon saturates the market, and has to increase revenue somehow . This is an example of where an ou…

So yeah, using HTTP to connect to a server that happened to be in the US... That's the thing that prevented us from selling in France. But thanks for lecturing me that "vendor lock in" was what killed our 6-developer team that was developing hardware, and computer vision, and 3D computer graphics, while developing a health care product under the tons of regulation that comes with that. Your arrogance is just stunning…

> your arrogance is just stunning.

Sorry if I don’t follow your reasoning, I’m still stuck at this piece of USA policy you seemed to have glossed over:

> Sec. 14. Privacy Act. Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

https://www.govinfo.gov/content/pkg/FR-2017-01-30/pdf/2017-0...

Re: Use of Google Analytics declared illegal by French data protection authority

#895

Post by zekrioca »

VikingCoder wrote: post #796
titzer wrote: post #793

Earlier quoted context omitted.

It isn't about "one computer talking to another", it's about where sensitive information is stored. It has never been legal to store classified US intelligence on computers outside of the control of the US government. That's an extreme example, but the handling of many types of information is prescribed by laws in different jurisdictions. Does that mean that US computers cannot "talk" to another other computers? No.…

I think you're ignoring the harm done to small businesses who cannot afford to implement decentralized services. You are raising the barrier to entry, limiting competition. Competition is good for so many reasons. I think you're deliberately ignoring the impact on small companies and not grasping the larger picture.

And I think your team did not think through before implementing your product. The GDPR and its consequences have been discussed for a very long time. And the product even managed to get locked into Azure.

Re: Use of Google Analytics declared illegal by French data protection authority

#896

Post by arlogilbert »

If you think that launching your app in a another region is hard, there is currently a case being evaluated in Europe which is evaluating the argument that even if the data never leaves the EU and the provider is a European entity but affiliated with or a subsidiary of a US company, that this is stil considered a violation.

So unfortunately just moving hardware locations may be insufficient, even forming a new entity won't suffice.

In my humble opinion we are witnessing the nationalization of the Internet, in the name of good intent, but eventually the risk vs reward calculation of doing business across the Atlantic (for either side) will tilt in the direction of avoiding the risk.

Although it could be argued that "good, laws are made for people not for businesses" I'd counter that a great deal of the free information published by US companies and non-profits will become unavailable in the EEA.

I'm hopeful that the DPAs and courts in Europe will decide to balance these concerns.

FWIW: I run one of the more popular data privacy platforms, Osano, so this is an area we track very closely and which is near and dear to my heart. I built Osano as a Public Benefit (and certifeid B-Corp) to try and prevent the nationalization of the Internet by giving businesses an easy way to respect the rights of their customers & visitors.

Re: Use of Google Analytics declared illegal by French data protection authority

#897

Post by qualudeheart »

maccolgan wrote: post #686
qualudeheart wrote: post #406

Earlier quoted context omitted.

That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.

Wow, unironic protectionism and "it'll create jobs" rhetoric.

It’s a geopolitically grounded form of Protectionism.

I don’t like that smaller countries have to rely on larger countries that don’t have their best interests in mind. Not only should France buid its own tech infrastructure but so should every other country that can build it.

In the post-NSA age this is vital if you want your country and its population to be secure against cyberattacks and mass surveillance by great powers.

Re: Use of Google Analytics declared illegal by French data protection authority

#898

Post by hactually »

teddyh wrote: post #881
VikingCoder wrote: post #825

Earlier quoted context omitted.

Unfortunately, that didn't exist for us back in 2016, and our product is no longer in development.

So your argument is out of date and no longer valid.

I like the hot take but it speaks to the bigger point. The dual stack didnt kill the business, nor did the privacy law.

The company failed - it is what it is, and it sucks for the team - but you can't blame the EU protecting privacy/rights for bad business.

Re: Use of Google Analytics declared illegal by French data protection authority

#899

Post by gnud »

VikingCoder wrote: post #851
zelphirkalt wrote: post #845

Earlier quoted context omitted.

You are building up a whole strawman here. This is all about sending personal data to a machine in the US, owned by a company, which falls under US law. You don't have to send that personal data to the US, do you? Why would you do such a thing in the first place? Surely informed people would not simply consent to such a practice. And I mean informed. Not just clicking "OK OK next OK" without knowing what actually goe…

It's not a strawman, it was the company I worked for. We helped manufacture medical devices. We sold a device that took medical images, and then sent the images to a server. The server would do tons of processing on the images, and help manufacture a medical device custom to the patient. We ran our servers in the United States. We could not sell our product in France, until we stood up servers in France to store and…

This sort of regulation is not new when it comes to health data. I'm actually surprised storing medical data outside the country was legal in France at any point, I don't think it would have been in my country.

So blaming the GDPR and new rules, seems a bit weird in this case.

Now, consumer protection regulation is always a balancing act. And most consumer protection laws will hurt some companies that didn't actually do anything bad. That doesn't mean I don't want any regulations. Particularly when it comes to healthcare.

Re: Use of Google Analytics declared illegal by French data protection authority

#900

Post by danielovichdk »

VikingCoder wrote: post #851
zelphirkalt wrote: post #845

Earlier quoted context omitted.

You are building up a whole strawman here. This is all about sending personal data to a machine in the US, owned by a company, which falls under US law. You don't have to send that personal data to the US, do you? Why would you do such a thing in the first place? Surely informed people would not simply consent to such a practice. And I mean informed. Not just clicking "OK OK next OK" without knowing what actually goe…

It's not a strawman, it was the company I worked for. We helped manufacture medical devices. We sold a device that took medical images, and then sent the images to a server. The server would do tons of processing on the images, and help manufacture a medical device custom to the patient. We ran our servers in the United States. We could not sell our product in France, until we stood up servers in France to store and…

Under which law, please provide them specifically, were this not possible to do in France with data being processed in the US?

I am truly interested in this since I am in EU and use Azure for similar processing.

Post reply on HN