Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

981–990 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#981

Post by DocTomoe »

baridbelmedar wrote: post #801
DocTomoe wrote: post #672

Earlier quoted context omitted.

> Why limit it to the EU? Shouldn't every country have their own AWS, Azure and Google Cloud? Careful, there is such a thing as network effect for knowledge. More fractured systems mean more different approaches means less aftermarket documentation means less people being able to work for you.

I happen to be European but with that said, I also get the feeling that many western European HN-users here seem to fancy the idea of having many small local service providers that have challenges providing anything beyond basic hosting. And that totally fine, if you think European companies have no competitive disadvantage on the global market to being forced to use traditional VPS providers or build and set up ever…

In all fairness, the faster, better, cheaper argument sounds too much like marketeese to me, and I have not yet seen that effect in real life. You can find dedicated people who are sufficiently good to manage some Linux server infrastructure relatively easily - all while AWS consultancies seem to pop up all over the place like mushrooms after a rain.

Re: Use of Google Analytics declared illegal by French data protection authority

#982

Post by mrunkel »

ihuman wrote: post #892
tremon wrote: post #586

Earlier quoted context omitted.

Why remove them? Why not proxy/cache the fonts from your own server?

Depending on the license, that might cost more, or not be an option at all. For example, Adobe doesn't allow you to host their fonts; you have to link to their CDN. https://helpx.adobe.com/fonts/using/font-licensing.html#web-...

Except he explicitly referenced Google Fonts

Re: Use of Google Analytics declared illegal by French data protection authority

#983

Post by southerntofu »

PoignardAzur wrote: post #402
southerntofu wrote: post #86

Is the CNIL actually starting to do its job? Since the early 2000's they were doing literally nothing against the many crimes against users committed by big tech. In the past few years though they started to distribute fines when the law was obviously and willingly broken (eg. Google)... did they suddenly start to care for users? or do they care that they can fill the pockets of the government (who doesn't dare to ta…

> I mean CNIL does not exactly have a reputation of helping/protecting users... they more have a reputation of being a watchdog who sees no problem with government surveillance programs and does not react when you send them reports of illegal activities surrounding personal data We have a very different view of the CNIL. Every time I hear about them, they're either giving GDPR fines or signalling illegal government a…

> Every time I hear about them, they're either giving GDPR fines or signalling illegal government activity

Yes, now think about all the times we don't hear from/about them. It seems that they are doing more as time goes, but they have done little to stop dragnet surveillance, racial/religious/political profiling by the authorities, the deployment of CCTV all across France, (il)legal ⁽⁰⁾ obligations for ISPs to track their users, school restaurants requiring fingerprints to get a meal (yes that's a thing), public services using Google Analytics / Zoom / Microsoft / Doctolib, stingrays operated by police for political repression, and the list goes on and on...

In "digital freedom" (LQDN, FFDN, April, Framasoft, etc) the CNIL is (or at least used to be) rightly regarded as a joke when it comes to human/user freedom, despite having very noble goals. The fact that the press only talks about them when they're doing their job doesn't change that they've clearly failed their mission to protect civil rights in the computer era, despite very good and reasonable legal guidelines dating from 1978.

⁽⁰⁾ French data retention laws are illegal by european standards.

Re: Use of Google Analytics declared illegal by French data protection authority

#984

Post by southerntofu »

zoobab wrote: post #132
Fiahil wrote: post #107

Earlier quoted context omitted.

> Is the CNIL actually starting to do its job? IIRC, They got massive funding with GDPR

GDPR enforcement is big business for the government, but no money goes to the poor associations, like LQDN or NYOB. Quite the contrary, those associations have to survive on 'donations', and probably not very high salaries for their staff.

Not sure why you're being downvoted. People from such non-profits were key to european institutions developing a proper understanding of the problem space, which directly led to GDPR legislation.

If you're rich enough, be sure to donate some money to LQDN/EFF and others to protect human rights in the digital realm.

Re: Use of Google Analytics declared illegal by French data protection authority

#985

Post by intrasight »

ATsch wrote: post #929
intrasight wrote: post #853

Earlier quoted context omitted.

So it's an easy fix for Google - change GA to only save those anonymized IPs

Not quite. Google still has access to those IPs when it receives the request from the browser and could be compelled to store them by US intelligence. Thus data are being transferred to a party that can not adequately protect them. So in this case, as I understand it, the solution would have to be something more elaborate, like proxying the analytics requests through the server to strip the original IP address. Which…

Lots of other tech companies, as I understand it, choose not to be "compelled" to store something they don't want to store. Apple being the prime example.

Re: Use of Google Analytics declared illegal by French data protection authority

#986

Post by FredPret »

snovv_crash wrote: post #924
FredPret wrote: post #873

Earlier quoted context omitted.

Laws should be written to facilitate and improve the growth of civilization. This includes practical and fair measures for conducting business. Imposing byzantine regulations on every webmaster on the planet isn't helping anyone, least of all the European user, who will increasingly be locked out from the rest of the planet.

Depends on your perspective. It might be that American/Chinese predatory service providers are instead locked out of the European market, allowing the breathing space for local solutions to flourish.

If your local providers need the rest of the world to be kneecapped in order to compete, you may want to start with that problem.

The EU consumer will end up with strictly worse solutions and all the rest of the world will “gain” will be the crappy trade-barrier-supported Euro versions of Google and Facebook.

Re: Use of Google Analytics declared illegal by French data protection authority

#987

Post by tekknik »

javajosh wrote: post #772
VikingCoder wrote: post #756

Earlier quoted context omitted.

We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort. We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our serve…

>I'm sorry, do you have any idea of the cost of doing these things? Oh indeed yes, which is why for years now I've been warning people to not write to proprietary APIs in the first place. It's a faustian bargain and sooner or later the bill is going to come due! If not because of legal requirements, then because MS or Amazon saturates the market, and has to increase revenue somehow . This is an example of where an ou…

You pay for every invocation of what exactly? Lambda, certainly not fargate or ec2.

Then there’s the cost of your devs implementing the same feature azure and aws already has, which is usually forgotten about.

Also the icing on the cake for oracle was a contract termination fee. No cloud provider comes close to the oracle billing nightmare.

Re: Use of Google Analytics declared illegal by French data protection authority

#988

Post by anticensor »

Vosporos wrote: post #176
p4bl0 wrote: post #72

Sadly I don't see how this decision can be translated into practice, since I strongly doubt the CNIL will be able (or willing) to send formal notice, and fine after a grace period, all French companies that make use of Google Analytics on their website.

nul n'est censé ignorer la loi.

Translated into English: The law everyone ignores isn't.

Re: Use of Google Analytics declared illegal by French data protection authority

#989

Post by dspillett »

VikingCoder wrote: post #667
xdennis wrote: post #581

Earlier quoted context omitted.

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their priv…

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may bel…

> We had PII on Azure.

So why didn't you use Azure resources in Europe instead of "some crappy provider"? Sounds like you made a rod for your own back. If our clients are happy with Azure (in the right region) then I can't imagine many in the EU (other than perhaps national security services and their suppliers) reasonably refusing to allow use of it.

We host in Azure for some pretty significant financial organisations, mostly UK based but spreading our area. Some companies are requiring us to fully host in Azure DCs in their region, and some of those are Eastern, not UK/EU, based companies. At least one US interest that a friend's employer supplies demands data about its employees be hosted over there rather than over here, presumably so they can be assured it is kept to standards they are locally required to follow. Is it wrong that way around in your book too?

It isn't as easy as having everything in one region of course, but not much harder nor massively more expensive (caveat: most likely, as far as I know, I have the luxury of ignoring the bits that don't interest me and money is often one of those things, but I'm also senior enough that if there was something expensive happening, or something not happening due to expense, I'd catch wind as it would affect things I need to plan around) and it can't be as faffy/costly as using different providers in each territory.

If you are correctly following relevant regulations everywhere this does not fragment things any more than other rules that already existed. Aside from the fact things are being enforced this time, forcing companies handling PII to not quietly do things wrong because it is inconvenient to do things right. As an individual I'm perfectly fine with this.

Re: Use of Google Analytics declared illegal by French data protection authority

#990

Post by salawat »

VikingCoder wrote: post #796
titzer wrote: post #793

Earlier quoted context omitted.

It isn't about "one computer talking to another", it's about where sensitive information is stored. It has never been legal to store classified US intelligence on computers outside of the control of the US government. That's an extreme example, but the handling of many types of information is prescribed by laws in different jurisdictions. Does that mean that US computers cannot "talk" to another other computers? No.…

I think you're ignoring the harm done to small businesses who cannot afford to implement decentralized services. You are raising the barrier to entry, limiting competition. Competition is good for so many reasons. I think you're deliberately ignoring the impact on small companies and not grasping the larger picture.

You're absolutely right. Unfortunately, the little guy is more easily accommodated for with lenoency during onboarding regulation-wise, and the bigger actors can never be brought to heel if something doesn't go down on paper.
Post reply on HN