Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

941–950 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#941

Post by belorn »

VikingCoder wrote: post #667
xdennis wrote: post #581

Earlier quoted context omitted.

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their priv…

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

Its very interesting if limiting how companies are allowed to track, store and sell private information would be the central issue for which the internet will fragment around. It almost like tracking, storing and selling is the center of the modern Internet, rather than protocols like tcp, upd, https and so on.

In the past people said that the Internet was made for porn. Today the Internet is seemingly made for advertisement and surveillance. It not strange that so many people who worked in this industry for decades are feeling a bit lost in this new horrifying industry, which if the Internet really is made only to do advertisement and surveillance, I honestly think humanity is better off without it.

Re: Use of Google Analytics declared illegal by French data protection authority

#942

Post by drusepth »

lucideer wrote: post #456
VikingCoder wrote: post #392

If someone adds http://blah.us "> to their website, and that image is hosted in the United States, how does that not also violate French data protection? The user's browser makes a request to a US server, including the user's IP address. I legit do not understand how to make French people happy with these laws.

> how does that not also violate French data protection? The regulations don't ban collecting IPs (nor any PII). They just regulate it to the point that it must be deemed necessary according to certain criteria. I would imagine linking an image may be fine in 95% of cases, but what it would mainly depend on is the logging practices of the image hosting company. Their business would be bound by EU regulation if they a…

>Their business would be bound by EU regulation if they are choosing to sell service to an EU-based website, and it's likely that image host that would be liable for compliance.

Is the image hosting company really _choosing_ to sell service to an EU-based website if someone adds http://blah.us"> to their (French) website? It seems like it'd be an unreasonable expectation upon a company (especially one in a completely different country/jurisdiction) to e.g. ensure their existing logging practices _also_ comply with French, Austrian, etc laws.

Surely the user who adds/posts the image on a French site would/should be liable here, not the host of the US-based image (service?), no?

Re: Use of Google Analytics declared illegal by French data protection authority

#943

Post by drusepth »

andrewaylett wrote: post #576
Dave3of5 wrote: post #212

Earlier quoted context omitted.

Ok so what's the actual minimum you've said two weeks here but where is this actually defined ?

With GDPR and personal data, if you can justify your use then it's legit. Working out which justifications are acceptable is left -- at least partly -- as an exercise for the reader ('s legal team). But we may observe that some practices are easy to justify, while others are more challenging. Some attempts at justification have been rejected, which means that trying to rely on them in the future is a bad plan. Also,…

>Also, intent matters. If you're trying to do the right thing, you're unlikely to get into real trouble. The most likely consequence is that you're told you should stop, and given a deadline. If you don't stop by the deadline then it's fairly obvious that you're now not trying to do the right thing.

The vague, uncodified "intent" is my biggest problem with GDPR and GDPR-like laws, especially when it comes to small businesses. Even with the best intent, I've seen startups in my community get into "real" trouble trying to comply with mixed results. Not every company can afford to allocate the time/money necessary to comply with sudden deadlines and/or new technical requirements. Not every company can afford to take the risk of "I think this PII is absolutely necessary, but... could I prove it in court? Can I even afford the lawyers to try?" If I didn't read HN, I doubt I'd even know laws like this new French one even existed; I can't afford to dedicate someone to monitor changing laws around the world.

Saying "it's important for businesses to allocate sufficient resources toward researching evolving law in every country they might do business in, and it's okay if businesses fail if they can't afford to do so" is reasonable.

Saying "if you're trying to do the right thing, you'll be fine" is, quite frankly, the complete opposite experience I've seen from most well-meaning companies in my sphere trying to accomodate GDPR rules with limited budgets.

Of course, I am located in the US so maybe this is the intended result.

Re: Use of Google Analytics declared illegal by French data protection authority

#944

Post by VikingCoder »

belorn wrote: post #941
VikingCoder wrote: post #667

Earlier quoted context omitted.

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

Its very interesting if limiting how companies are allowed to track, store and sell private information would be the central issue for which the internet will fragment around. It almost like tracking, storing and selling is the center of the modern Internet, rather than protocols like tcp, upd, https and so on. In the past people said that the Internet was made for porn. Today the Internet is seemingly made for adver…

The internet is a tool.

You should support companies with the best behavior.

I worked at a company that enabled a radiologist in over country to do a preliminary read of a CT scan performed in another country.

Cutting the amount of time for a CT scan, and even connecting a CT scan with a radiologist who specialized in that particular kind of scan, we saved lives.

And yes, there's also furry porn.

It's a tool.

I feel like I'm trying to convince you that BOOKS are good, despite the existence of hentai.

Re: Use of Google Analytics declared illegal by French data protection authority

#945

Post by drusepth »

judge2020 wrote: post #657
youngtaff wrote: post #567

Earlier quoted context omitted.

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. If you've sought the visitors consent then yes it's legal

This court case makes it illegal since, while the user might consent to GA tracking, they legally can't consent to giving up their GDPR rights. Given that, the US law enforcement could still break GDPR by forcing the US corporation to hand over EU citizens' data.

Seems like a nice opportunity for a browser extension to automatically detect sites using GA, and also automatically report them to EU authorities. Zero clicks needed!

Re: Use of Google Analytics declared illegal by French data protection authority

#946

Post by drusepth »

tantalor wrote: post #279
iqanq wrote: post #203

Earlier quoted context omitted.

Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.

An agreement requires a meeting of the minds. Blindly clicking "yes, accept cookies" in popups does not rise to that level. People just want to read the article, they do not understand or care about the data retention policy. So it is very hard to claim they consented.

Then why does every site ever seem to still use huge cookie banners asking for that consent?

Re: Use of Google Analytics declared illegal by French data protection authority

#947

Post by [deleted] »

CamperBob2 wrote: post #850
mping wrote: post #699

Earlier quoted context omitted.

This completely misses the point, the laws shouldn't be written to accommodate businesses, its the other way around. If fragmenting is a consequence of better privacy laws, so be it.

If a business pays taxes, and the laws don't take their needs into account to some extent, that's not justice. It's just mob protection with a veneer of legitimacy. Lots of loaded assumptions there, of course, starting with the first conditional clause.

[deleted]

Re: Use of Google Analytics declared illegal by French data protection authority

#948

Post by Barrin92 »

maccolgan wrote: post #686
qualudeheart wrote: post #406

Earlier quoted context omitted.

That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.

Wow, unironic protectionism and "it'll create jobs" rhetoric.

this isn't just 'jerbs' rhetoric. Having French data on French soil guarantees that if push comes to shove French authorities are in control of their citizens' data. It's a matter of national sovereignty. If companies have billions of dollars worth of physical infrastructure located in the countries they operate you can be sure compliance with local laws will actually happen.

Re: Use of Google Analytics declared illegal by French data protection authority

#949

Post by Anthony-G »

Last night I finally pulled the trigger on becoming a Supporting Member of NOYB¹ (My Privacy is None of Your Business). Seeing this story on Hacker News tonight reaffirms that decision and I’d recommend that other Hacker News users who care about data privacy do the same. Technological solutions that we use (Firefox containers, uBlock, etc.) are band-aids that work for a technically adept minority of citizens. The real struggle is political – and legal when there’s data protection legislation isn’t being enforced.

¹ https://noyb.eu/en/support-us

Re: Use of Google Analytics declared illegal by French data protection authority

#950

Post by titzer »

VikingCoder wrote: post #851
zelphirkalt wrote: post #845

Earlier quoted context omitted.

You are building up a whole strawman here. This is all about sending personal data to a machine in the US, owned by a company, which falls under US law. You don't have to send that personal data to the US, do you? Why would you do such a thing in the first place? Surely informed people would not simply consent to such a practice. And I mean informed. Not just clicking "OK OK next OK" without knowing what actually goe…

It's not a strawman, it was the company I worked for. We helped manufacture medical devices. We sold a device that took medical images, and then sent the images to a server. The server would do tons of processing on the images, and help manufacture a medical device custom to the patient. We ran our servers in the United States. We could not sell our product in France, until we stood up servers in France to store and…

Why are you so shocked that people want to assert control over their medical data? This is the crux of the problem. You're being absolutely incredulous that someone have a say in data that is about them.

Other people exist and have rights. It's about time that people assert their rights over data that is absolutely consequential to their lives, instead of being tiny pawns of companies who treat them like a highschool science experiment with live ants.

Post reply on HN