3 ms·

Google Analytics is not a security tool. You can’t even see what an specific IP has been doing.

belorn 8y ago
Of those exception, security is one and the most clear cut one. The other are more muddy which is why I did not describe them, even if in this case those are more likely to be used than security. The list is as following: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. The security exception is then an additional point, Article 6, Paragraph 1, Point F.
michaelbuckbee 8y ago
The issue isn't that _you_ can't see what a specific IP is doing, but Google certainly can, and it's more than that. The GDPR really spells out that you can't ask for consent / basis to do one thing and then flip around and do more with it. Aka, if you consent to signing up for a newsletter they can't turn around and sell your email to another list, take that list to their next startup that's unrelated, etc. For Google this gets tricky, you're consent to using them for analytics (most everyone on the free, non enterprise, version). Are they also using that to feed their search engine? Tweak display ads? Check for fraud? Build profiles of people across sites/browser sessions, and devices? And while this is about analytics, the same can be said for Maps, Docs, Domains, Fonts, etc. all of which have a primary use and (for Google) a stack of juicy secondary uses they can make money off of. Most of it doesn't even strike me as nefarious (it seems reasonable that they'd index pages that come up in Google analytics), but it's not disclosed so nobody is exactly sure what's being done. Even this anonymize IP business is tricky b/c: 1. They still get the IP as surely as you browsing to www.google.com 2. They may be tracking in other ways (fingerprinting, cookies, etc.) that unique identify you, so does it matter?
- candiodari 8y ago
  > The GDPR really spells out that you can't ask for consent / basis to do one thing and then flip around and do more with it. That's not how reality works. Laws, despite god knows how many attempts, don't change that. If you have the information, you can use it. > Aka, if you consent to signing up for a newsletter they can't turn around and sell your email to another list, take that list to their next startup that's unrelated, etc. Ok. When the spam problem stops, I'll believe this. Until then, I reserve judgement. > For Google this gets tricky, you're consent to Sure, but with a chunk of their operating expenses ($9 billion a year) spent on lawyers ... tricky is not a problem. For everyone else, it is. It gives them a legal way to destroy any company they don't like, it's a land-grab for both their own jurisdiction (as opposed to member nations' jurisdictions), it's land-grab for global jurisdiction, it's a (partial) denial of private contracting rights and it's explicitly designed for selective enforcement. What more could one want in a big new law ?
  - frockington 8y ago
    Your points made me think that this law is likely just going to solidify market monopolies and ensure competition can't exist legally, similar to large banks in the US
    - candiodari 8y ago
      Well, yes. However, we should look at illegally: it's going to make it much easier for sites to exist in areas where there won't be any enforcement. So it's going to kill European sites, not anything else. Effectively European companies below a certain size can't allow for forums anymore. Obviously this will impact things like newspaper forums, tech support, webfora on specific topics, ...

Of those exception, security is one and the most clear cut one. The other are more muddy which is why I did not describe them, even if in this case those are more likely to be used than security. The list is as following: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. The security exception is then an additional point, Article 6, Paragraph 1, Point F.

michaelbuckbee 8y ago

The issue isn't that _you_ can't see what a specific IP is doing, but Google certainly can, and it's more than that. The GDPR really spells out that you can't ask for consent / basis to do one thing and then flip around and do more with it. Aka, if you consent to signing up for a newsletter they can't turn around and sell your email to another list, take that list to their next startup that's unrelated, etc. For Google this gets tricky, you're consent to using them for analytics (most everyone on the free, non enterprise, version). Are they also using that to feed their search engine? Tweak display ads? Check for fraud? Build profiles of people across sites/browser sessions, and devices? And while this is about analytics, the same can be said for Maps, Docs, Domains, Fonts, etc. all of which have a primary use and (for Google) a stack of juicy secondary uses they can make money off of. Most of it doesn't even strike me as nefarious (it seems reasonable that they'd index pages that come up in Google analytics), but it's not disclosed so nobody is exactly sure what's being done. Even this anonymize IP business is tricky b/c: 1. They still get the IP as surely as you browsing to www.google.com 2. They may be tracking in other ways (fingerprinting, cookies, etc.) that unique identify you, so does it matter?

candiodari 8y ago
> The GDPR really spells out that you can't ask for consent / basis to do one thing and then flip around and do more with it. That's not how reality works. Laws, despite god knows how many attempts, don't change that. If you have the information, you can use it. > Aka, if you consent to signing up for a newsletter they can't turn around and sell your email to another list, take that list to their next startup that's unrelated, etc. Ok. When the spam problem stops, I'll believe this. Until then, I reserve judgement. > For Google this gets tricky, you're consent to Sure, but with a chunk of their operating expenses ($9 billion a year) spent on lawyers ... tricky is not a problem. For everyone else, it is. It gives them a legal way to destroy any company they don't like, it's a land-grab for both their own jurisdiction (as opposed to member nations' jurisdictions), it's land-grab for global jurisdiction, it's a (partial) denial of private contracting rights and it's explicitly designed for selective enforcement. What more could one want in a big new law ?
- frockington 8y ago
  Your points made me think that this law is likely just going to solidify market monopolies and ensure competition can't exist legally, similar to large banks in the US
  - candiodari 8y ago
    Well, yes. However, we should look at illegally: it's going to make it much easier for sites to exist in areas where there won't be any enforcement. So it's going to kill European sites, not anything else. Effectively European companies below a certain size can't allow for forums anymore. Obviously this will impact things like newspaper forums, tech support, webfora on specific topics, ...