10 ms·
Austria's data protection authority has found that Google Analytics is illegal
- epalm 5y agoWhat does it mean these days to be a “European website” (or a “Canadian website”, etc)? The server is located in Europe? The domain name is owned by a company registered in Europe? What if a CDN serves the site from another location? What if the site is served in an iframe on a site in another location?
- geewee 5y agoBasically the GDPR considers anything that's accessible or marketed to EU residents (not citizens) under its jurisdiction. In practice this is (probably) pretty much every side that isn't a local business or specifically blocking visitors from the EU.
- zelphirkalt 5y agoAs far as I understand the decision is about US being able to order companies inside the US, to give them any data, even when that data origins from overseas. So regarding your question, I guess the answer would be: A European website makes use only of services, which are not in danger of the US (or other countries from outside Europe) ordering the company to grant them access to the data. I guess this means, that you cannot use any services, which are offered by companies, which store data in the US and possibly even if they store it elsewhere, but fall under US law.
- libertine 5y agoIt's about the user, not the website. I'd guess a "European website" stands for a website that safeguards EU users by being compliant with GDPR.
- vegai_ 5y agoThe article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?
- raesene9 5y agoThe legislation that is relevant here is GDPR which is EU wide (each country has it's own implementation but they should be overall similar). In the article it points out that there are similar suits across the EU by the same organization, so it's not too unlikely that there will be similar reults in some or all of the cases.
- jacquesm 5y agoPrivacy law in the EU is harmonized.
- JumpCrisscross 5y ago> Privacy law in the EU is harmonized In theory. Reality is quite far from that, as anyone on the ground can attest.
- jacquesm 5y agoAs someone 'on the ground' I see things moving in a much more uniform direction than where they were in the past, the differences are not large enough to make a fuss about. The thing to note is that the GDPR is a minimum set, local law is free to exceed the GDPR.
- JumpCrisscross 5y agoThere is currently an EU member challenging the concept of European law’s primacy. Meanwhile, implementation of other courts’ rulings are delayed by years between jurisdictions. There is zero chance, for instance, that anyone in Greece or Portugal or Ireland will be impacted, judicially, by this decision for several years. That’s better than before. But it’s far from e.g. a U.S. federal court ruling in California’s impact in New York, or a French court’s ruling in Paris in Marseille.
- tremon 5y agoThere is currently an EU member challenging the concept of European law’s primacy That's a charitable phrasing. As per Protocol 2 on the functioning of the European Union, article 8 [2]: The Court of Justice of the European Union shall have jurisdiction in actions on grounds of infringement of the principle of subsidiarity by a legislative act, brought in accordance with the rules laid down in Article 263 of the Treaty on the Functioning of the European Union by Member States What Poland did was declare nationally (government, and then a national court) that the EC was infringing on its sovereignty (principle of subsidiarity). But as the above text says, national governments don't have jurisdiction when it comes to matters questioning the primacy of European law. [2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12008E/PRO/02 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12...
- rhn_mk1 5y agoDoes Recaptcha use similar technology as Google Analytics? I would happily see it burn.
- scarab92 5y agoTo be clear, the transfer of EU citizen's data to the US was deemed against the GDPR. This decision does not mean that Google Analytics itself is illegal.
- darkwater 5y agoI think the syllogism comes from the fact that currently GA does transfer EU data to the US by default (and probably currently there is no way to prevent that?). But I'm not a GA expert at any rate so I can be totally wrong.
- smoe 5y agoAs I understood it, data location is not even the problem, but the US CLOUD Act, that allows their authorities to request data from US companies no matter where it is stored. So even if Google Analytics would store data from EU citizens in Europe, they would still violate GDPR, because US authorities can access the data without the users consent.
- jusssi 5y agoSo they set up an EU subsidiary that's independent enough for CLOUD Act to not apply. Problem solved.
- krageon 5y ago> for CLOUD Act to not apply If there is oversight from the US (i.e. it is still the owner), this is not possible.
- geewee 5y agoNope. I've heard some people talk about company constructions where you create a new officially unaffiliated company in the EU, that then just lends the IP to create a datacenter from the US-based companies, but I'm not sure if that's actually feasible.
- sschueller 5y agoThe CLOUD Act itself is the issue. Don't use MS Office 365 or any other US based service even if their servers are in Europe as they can not guarantee that your data is not accessible by the US. Amazon and Cloudflare are all great service but your data is under US jurisdiction.
- lnsp 5y agoYou can control locality for some parts of Cloudflare's offering [1], so I guess if you want to comply with the privacy shield stuff, you would have to ensure that the data is stored on a server within a EU country. [1] https://blog.cloudflare.com/introducing-the-cloudflare-data-localization-suite/ https://blog.cloudflare.com/introducing-the-cloudflare-data-...
- dismalpedigree 5y agoDoesn’t work that way. This issue is that CloudFlare is a US company and can be compelled to disclose information to US Govt regardless of where they hold the data.
- throwawayvibes 5y agoI came here to say this. People should read at least the Wikipedia summary for CLOUD act. It's classic US legislation, 'we don't care about borders when it suits us' style.
- kube-system 5y ago> It's classic US legislation, 'we don't care about borders when it suits us' style. GDPR is written the same way. i.e: https://gdpr.eu/article-3-requirements-of-handling-personal-data-of-subjects-in-the-union/ https://gdpr.eu/article-3-requirements-of-handling-personal-...
- throwawayvibes 5y ago
- matsemann 5y agoNOYB's article itself discussed here: https://news.ycombinator.com/item?id=29918496 https://news.ycombinator.com/item?id=29918496
- bertman 5y agoI really hope this will have consequences that shake up ad tech, but the cynic in me says: They're just going to add another disclaimer in their cookie banner and exactly nothing will happen.
- Macha 5y agoWell part of the ruling is that the "standard contractual clauses", basically an attempt to contract away the regulation is not valid. From the article, it seems to be just conceptually, which gels with my understanding of the GDPR, so it's not going to be just adjusting/appending the legal wording in the TOS to fix that.
- kazen44 5y ago> "standard contractual clauses", basically an attempt to contract away the regulation is not valid. how is this suprising? This has been the case in Civil law since atleast napoleonic times. Contracts do not declare laws or rights invalid, unless these exceptions are defined in said law.
- RugnirViking 5y agoof course, companies will try their luck right up until somebody loses a meaningful amount of money. I assume this ruling is gearing up and posturing towards major judgements against google should they fail to follow through
- Macha 5y agoJudgements against Google and Facebook have started, which I assume will get increased for being repeat offenders the more they try to weasel out of complying: https://news.ycombinator.com/item?id=29821386 https://news.ycombinator.com/item?id=29821386
- geewee 5y agoThis is only sort of a half-truth though. The SCC's are created by the European Data Protection Board, and it works for transfers to third countries because the companies legally say "ok we won't do anything shady with your data" - but you have to actually prove that they can't be compelled to do anything shady under local law - which you can in the US. So the SCC's are a perfectly fine tool, but you just need more than that.
- boshomi 5y agoprevious discussion: »Austrian DSB: EU-US Data Transfers to Google Analytics Illegal« ( https://news.ycombinator.com/item?id=29918496 https://news.ycombinator.com/item?id=29918496)
- triska 5y agoThank you Max Schrems for everything you do to preserve EU citizens' privacy and compliance of companies to European law!
- thisisnotatest1 5y ago
- mort96 5y agoLibertarianism is so silly. "My freedom to live would be best served if there weren't politicians micromanaging other people's right to murder me". It's like a parody.
- brobdingnagians 5y agoLibertarianism is definitely against murder. And quite a few libertarians believe that the FDA and EPA do too much to protect corporations from lawsuits, basically, if it meets their guidelines doesn't matter if it kills you, the company is protected. Absurd reductionism isn't helpful.
- hobs 5y agoAre libertarians into informed consent? Because if they are, then they'd be against most of the data scraping going on.
- brobdingnagians 5y agoYep, they'd definitely be into informed consent. And would probably depend on the individual's definition of property.
- raverbashing 5y agoMight I add, realistic libertarians do what you're saying But there are extreme factions of libertarians who really question things like "Do mothers really have a duty to take care of their children?" or think that private tribunals would work in practice.
- ascar 5y agoAs far as I understand it, it's not Google Analytics per se that is illegal, but the data transfer to the US. If Google Analytics would use servers on European ground it should be fine. Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? But I can't imagine that to be the case, as it would effectively mean that any business where an American company stores user data is illegal.
- sjogress 5y agoAs far as I can tell this ruling means that transfering PII to any company/service controlled by an American company is illegal per the GDPR. I work for a European company that is already being impacted by this ruling. Our first step is to replace Google Analytics, but I believe we are also looking through all cloud usage for any traces of PII. I think this is a huge opportunity for European companies to get a foothold in the Analytics/Ads/Cloud/Office spaces. Perhaps also an opportunity for good open source alternatives, like Matomo Analytics, to get adopted.
- toyg 5y agoThe various shields for EU->US datatransfer, agreed before and after GDPR, have been found incompatible with GDPR even if only potential. It's just that nobody has sued anybody yet, as the industry silently scrambles to look for alternatives. There is the law, and then there is enforcement of the law, and the latter has not fully happened yet.
- mhitza 5y ago> Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? Yes, because of CLOUD Act. If GA would create a deployable agent that proceses user data on your server before sending it in aggregate/anonymously to central GA, that would make it usable
- d1sxeyes 5y agoFrom the Schrems II judgment: > Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned. It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...
- kapsteur 5y agoIt's time for EU services to shine.
- frockington1 5y agoBased on the results of GDPR, it'll probably just result in more annoying sites that users will avoid due to all of the pop up banners. Hopefully I'm wrong, I wish there was strong competition from Europe
- sjogress 5y agoAn optimistic take would be that this forces European companies to think through their analytics/ad needs again, perhaps resulting in less invasive solutions and thus fewer popups/banners and improved privacy. At least that is what I'm hoping for, however unrealistic it might be.
- iqanq 5y agoThey haven't shined in 25 years. We will just be forced to use inferior products.
- toyg 5y agoCome on mate, you're likely listening to music via a EU service (Spotify) and you were calling people with a EU service (Skype) before a US corporation bought it and ruined it.
- znpy 5y agoWell this might open a HUUUGE market for Analytics in the EU. We might see some competition rise and a good (better?) product emerge.
- MomoXenosaga 5y agoPrecisely. If demand for European cloud services rises companies WILL spring up to deliver. That's basic economics. Hell it could be the next Boeing-Airbus saga for all we know. The Chinese certainly don't seem particularly bothered telling the US to go fuck itself.
- thisisnotatest1 5y ago
- thisisnotatest1 5y ago
- b3lvedere 5y agoI think it's time to make good backups of some google accounts.
- catfishx 5y agotakeout.google.com really helps for this
- loceng 5y agoWhy so?
- toyg 5y agoI guess parent fears that Google will blanket-disable access to all Google services in the EU, as retaliation. Unlikely imho, but it's true that Analytics was a big loss - it's only one step down from their core product, Adsense, and if GDPR enforcement comes for Adsense then they will have to go nuclear.
- jacquesm 5y agoEven Google is not too big to fail and cutting off 40% of your income stream isn't a very wise thing to do for any executive that wants to hold on to the pluche.
- tremon 5y agoWhy? If you have a Google account, you have a direct business relationship with Google, and the data in that account doesn't violate the GDPR in any way. (the data Google collects about you outside of your account activities still might, though).
- sixhobbits 5y agoI guess Plausible.io and similar are going to be drowning in cash in the next few months.
- znpy 5y agoI really hope they do.
- brabel 5y agoLooks great! But I feel that $9/month (up to 10k views) is a bit much for my personal website... I pay that much to Google now, but I get a whole suite of tools besides analyticsm, like email addresses (for my whole family under our surname as a domain, which is cool), my own domain (via GogoDaddy, but I got that via Google and pay Google only) and all the small business office tools they offer (though I think those are free?). Are the any alternatives that offer the same kind of thing as Google?
- tilolebo 5y agoThank God we have very capable cloud providers in Europe that will rise to the challenge and offer a viable opportunity to the US major cloud providers!
- heartbeats 5y agoHetzner, OVH, Leaseweb, Scaleway. How many cloud providers do you need?
- tilolebo 5y agoPlease remember me for how long OVH was down when they lost an entire "DC"? And how much customer data did they lose?
- tilolebo 5y agoI don't need many, just one on par with the worst of the 3 major US clouds. I'd even be happy with one that makes it in the top 10.
- spaniard89277 5y agoNone of them compares to Amazon. The only kinda similar competitor in Europe is... Yandex Cloud. The reality is that we don't have the same ability of popping companies up and funding them.
- jeroenhd 5y agoWe definitely do have all of those. For some reason, IT managers prefer to teach themselves the AWS/Azure/GCloud configuration clusterfuck rather than the portable OpenStack configuration clusterfuck, but that's suffering we're all bringing on ourselves.
- Jenz 5y agoWhere can i see an official statement of this? The linked website seems dubious…
- skilled 5y agoIt's pretty ridiculous how much bloat there is in Google Analytics anyway. Their interface hasn't gotten any better over the years. Sorting through behavioral visits will sometimes crash the browser tab. A lot of open-source platforms can do super specific analytics while also remaining privacy-friendly.
- jerrygoyal 5y agoI've heard Google is working on a new cookie-less version of GA just like plausible and other privacy-focused GA alternatives. Wondering if this cookie-less GA would still come under the ban.
- geewee 5y agoIt almost certainly would. This isn't about cookies, this is about sending PII (which IP's are) to GA. I have a hard time imagining some safeguards that'll allow you to use GA, without ever hitting a GA server.
- Nextgrid 5y agoGDPR is about sharing personal data and tracking users. It doesn’t matter if it’s done via cookies or some other way.
- singingwolfboy 5y agohttps://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
- denton-scratch 5y ago> Therefore, the data of European citizens may not be transferred across the Atlantic. That is different from the headline. GA is still legal; the judgement is that it remains illegal to transfer PII from the EU to the US. That's not new; that's GDPR. This judgement is just upholding GDPR. It's just data traders grumbling about a law they don't like in a place they don't live in.
- sprkwd 5y agoI’m guessing this does not include UK based websites these days? What about people viewing from the EU? All very confusing.
- jeroenhd 5y agoIANAL, but the UK has kept (for now) an implementation of the GDPR, and judges may opt to take into account the GDPR their law was based upon when it was drafted. However, there's no guarantee they'll consider that with too much weight, because they're no longer bound by the EU legislation. For the UK, I'd say the current state is "probably just as illegal, until the law changes, but it's not been tested in court so you may risk it". The GDPR covers the privacy of individuals residing in the EU. That means you don't need to track which user has which nationality, you can just make decisions based on the location of your users. If you're an American company targeting American customers then you don't need to worry about Europeans passing by on their holidays. If the request comes from the EU, don't load your personal data collection code, internal or external, if you're unsure about the legality. That said, if you don't offer any services (free or paid) to the EU and one of your customers happens to use your service on a business trip, you don't need to worry either. This mostly applies to contracts and data procession, much less to actual websites and web services reachable from anywhere, but it's an exemption that'll save a lot of data hoarding companies that track Americans, Asians, etc. through indirect means.
- suction 5y agoI am not aware of an automatic and immediate adoption of an EU member state's rulings for the whole EU. Headline seems wrong, but maybe what it means to say is that such an adoption is 100% sure?
- geewee 5y agoThis is true - but courts have been going in this direction for a while now, and noyb has filed 100+ similar suits. Expect most of the legal landscape to agree with this in the not-so-distant future.
- Kstarek 5y agowe out here saying fuck Europe
- evancoop 5y agoSeems to raise a couple profound questions: 1. Is there a credible alternative (comparable ease of access and implementation)? 2. Does the absence of such a tool hinder business operating efficiency? If the answer to #1 is no, then any assertions that Google is not operating as a monopoly in the space are undercut. If the answer is #2 is no, then there are quite a few BI/Analytics/Strategy personnel who might find their value more difficult to justify!
- oaiey 5y agoWell Microsoft just needs to found a company owned 51% by a European entity /shareholders and operated by Europeans. Like that, the cloud act cannot be enforced. MS licenses the Azure/Office/whatever to this company so it will grap the majority of revenue. They can make fancy auditing agreements making sure that this company never steals anything from them. China is doing this model for years. Just with a different motive I guess. They tried this also with Telekom Germany for the Azure cloud but stopped doing it
- deleted 5y ago[deleted]
- geewee 5y agoThe writing's been on the wall about this for a long time, and anyone following the space has seen this coming. I'm glad that we're starting to see some judgements now, so people have something to point to when arguing to not send PII to america.
- sanitycheck 5y agoMaybe someone more knowledgable can provide some insight here? The problem seems to revolve around transmission of PII: "Based on this data, Google was able to deduce who he or she was." Presumably the PII didn't come from the data transmitted to GA by the site, more that GA was able to cross-reference the client ID from the cookie and determine the identity of the user. So if one was to disable GA cookies and/or override the client ID being sent from one's own site, would that be a workaround?
- deleted 5y ago[deleted]
- benja123 5y agoI maybe in the minority here, but I believe that this is not good for the average European and definitely not good for the European tech scene. Europe is already a more complicated place to launch a new company as you have to support multiple languages, countries etc. just to get to the potential market size you have in the US. Strict regulations are that are complicated to implement means that more new companies will choose to launch and build themselves up in the US first. By the time they come to Europe they will already be big and established and can afford to implement the complicated infrastructure that is necessary to support cross continent data storage (or ignore the regulation and pay the fines) while eating up all the small startups that were trying to capture the EU market while dealing with masses amounts of regulation and red tape. Now to be very clear! I am not against most of GDPR. But some of the interpretations of it have gone too far and it will hurt Europeans in the long run. This is actually one of the best things that can happen to companies like google and Microsoft as they can afford to develop the infrastructure to support easy geo based cross continent data storage - and they can then sell it as part of their cloud offerings.
- geewee 5y agoGeo-based cross continent data storage isn't enough. The fact that the parent company is a US entity still makes it illegal, no matter where the data is stored.
- benja123 5y agoTrue, forgot about that. Makes it harder and more expensive for a small business to support Europe unless they are based in the EU from day one.
- stef25 5y agoAs a European, frankly this is ridiculous. I'm as concerned as anyone about privacy issues but GDPR has just gone too far in the sense that nobody really understands it (I've undergone trainings with 2x previous employers and everyone just kind of shrugs that it doesn't make sense and we'll do our best bla bla bla ...) and that now they're trying to make an actual useful piece of software illegal? And that for reasons that the very people they're trying to protect will completely fail to understand. So many marketing departments depend on it, how can they realistically enforce this law? I'm saying this as someone who's not a fanboy, GA can be a pain to use and overly complex, maybe Matomo is even better. This is typical EU over reaching bs.
- vijaybritto 5y agoThey are only making transferring data outside of Europe as illegal right? I'm not getting what's over reaching in this
- stef25 5y agoWhat will it solve?
- vijaybritto 5y agoThe surveillance by US law agencies?
- timeon 5y agoI as EU citizen am happy about it. I do not care about any marketing department that is lazy to move from cross site voyeurism.
- stef25 5y agoNobody understands this, apart from us techies. Try explain to the average user that storing his screen resolution on a server in the US could mean he's being profiled by the NSA. Reaction will be "oooo you spooky hacker". It frustrates me that people react like this, don't get me wrong.
- pieter_mj 5y agoGreat victory. I bet firebase crashlytics is illegal as well in EU. The reason I uninstalled the hacker news app 'Materialistic' is because it regularly crashed and was probably unvoluntarily siphoning off pii data through the crashlytics module.
- ironman1 5y agoLuckily there are alternatives right... we're using Simple Analytics. Quite happy with. GDPR compliant out of the box and good ux
- capr 5y agoGoogle should just return HTTP 451 to all EU see how quickly these unelected EU officials would change their minds. And I say this as an EU citizen.