3 ms·

Note that this isn't purely "do not use Google Analytics"; it's "do not export EU data". For context, there used to be a trade agreement to ensure EU companies

Note that this isn't purely "do not use Google Analytics"; it's "do not export EU data". For context, there used to be a trade agreement to ensure EU companies were still allowed to use US server hosts, called US Privacy Shield; but that was torpedoed by other legal rulings. TBH, I personally do not understand how it is legal to provide a single shared service in the face of data localization requirements, especially if other countries were to adopt similar rules. Is it just a matter of having separate shards for each jurisdiction? Or do we need to instance the entire application so that US users don't even see EU users and vice-versa? Most off-the-shelf/FOSS webapps aren't built to be sharded this way, they assume One Big Database that has everything. That would include some of the GA alternatives they list; which, again, is a problem if those apps don't shard users by jurisdiction. I suppose for now, just hosting everything in the EU is fine, if only because the other jurisdictions with data localization requirements[0] pretty much can't be served with a shared application anyway. I'm imagining that's what the person who built this was figuring it would be used for. But if the US starts demanding data localization, the Internet is fucked. [0] China, AFAIK

rileymat2 5y ago
“ But if the US starts demanding data localization, the Internet is fucked.” The the demands that tiktok be sold?
- kmeisthax 5y ago
  TikTok is an unusual case, because the US was determined to ratfuck Chinese social media apps a few years back. The executive orders in question only applied to a handful of companies in one country. There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. A general data localization requirement in US law would mean an end to self-hosting one website and serving two jurisdictions for the majority of web users.
  - pyrale 5y ago
    > There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. US claims are wider in scope, since they demand services operating in the US to hand over data, wherever it's located, and wherever the users it's about are located.
ximm 5y ago
GDPR doesn't rule out using servers in other jurisdictions. It just rules out using servers in jurisdictions with shitty privacy laws, e.g. the US. If all countries were to adapt similar laws there wouldn't be a problem.
- lmkg 5y ago
  Exactly. As far as I can tell, the only problem that most European courts cite is the CLOUD Act. If that law were updated, I suspect many of these rulings would get reversed.
- kmeisthax 5y ago
  You are correct that the US copypasting GDPR into it's own law would be an absolute triumph. But that's not what I'm worried about. The problem I'm worried about is multiple countries having conflicting data localization requirements. One of the specific cited concerns with off-site hosting is that it exposes user data to foreign intelligence agencies. This is a valid concern, but it's not unique to the US. It's not like EU member states don't have their own spymasters: they absolutely do, and they are just as atrocious to democratic norms as American ones are. In fact, most EU member states would rather trust the US than each other, that's why their politicians negotiated the Privacy Shield agreement that ultimately got shot down. If the US were to have a data localization requirement, it would almost certainly be incompatible with the EU's data localization requirement. Then everything I mentioned in my prior comment would apply: the need to shard users at best, and a need to firewall users off from one another at worst.
falcolas 5y ago
> But if the US starts demanding data localization, the Internet is fucked. Not... really? The internet (defined as the infrastructure and non-commercial websites) will be fine. Corporations that collect and monetize data will just have to jump through more hoops (and many already do this because of the GDPR and Europe's general feelings about personal data). So they'll be fine too, even if they gripe a bit about it. The only folks who would really be hurt would be small developers, because their potential audience will be limited until they take advantage of foreign hosting and segmenting their user's data. In the end, they'll probably be fine to, even if their growth is stunted while they comply with laws (and ultimately, the wishes of their customers).

rileymat2 5y ago

“ But if the US starts demanding data localization, the Internet is fucked.” The the demands that tiktok be sold?

kmeisthax 5y ago
TikTok is an unusual case, because the US was determined to ratfuck Chinese social media apps a few years back. The executive orders in question only applied to a handful of companies in one country. There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. A general data localization requirement in US law would mean an end to self-hosting one website and serving two jurisdictions for the majority of web users.
- pyrale 5y ago
  > There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. US claims are wider in scope, since they demand services operating in the US to hand over data, wherever it's located, and wherever the users it's about are located.

ximm 5y ago

GDPR doesn't rule out using servers in other jurisdictions. It just rules out using servers in jurisdictions with shitty privacy laws, e.g. the US. If all countries were to adapt similar laws there wouldn't be a problem.

lmkg 5y ago
Exactly. As far as I can tell, the only problem that most European courts cite is the CLOUD Act. If that law were updated, I suspect many of these rulings would get reversed.
kmeisthax 5y ago
You are correct that the US copypasting GDPR into it's own law would be an absolute triumph. But that's not what I'm worried about. The problem I'm worried about is multiple countries having conflicting data localization requirements. One of the specific cited concerns with off-site hosting is that it exposes user data to foreign intelligence agencies. This is a valid concern, but it's not unique to the US. It's not like EU member states don't have their own spymasters: they absolutely do, and they are just as atrocious to democratic norms as American ones are. In fact, most EU member states would rather trust the US than each other, that's why their politicians negotiated the Privacy Shield agreement that ultimately got shot down. If the US were to have a data localization requirement, it would almost certainly be incompatible with the EU's data localization requirement. Then everything I mentioned in my prior comment would apply: the need to shard users at best, and a need to firewall users off from one another at worst.

falcolas 5y ago

> But if the US starts demanding data localization, the Internet is fucked. Not... really? The internet (defined as the infrastructure and non-commercial websites) will be fine. Corporations that collect and monetize data will just have to jump through more hoops (and many already do this because of the GDPR and Europe's general feelings about personal data). So they'll be fine too, even if they gripe a bit about it. The only folks who would really be hurt would be small developers, because their potential audience will be limited until they take advantage of foreign hosting and segmenting their user's data. In the end, they'll probably be fine to, even if their growth is stunted while they comply with laws (and ultimately, the wishes of their customers).