3 ms·

> This message is brought to you by > PostHog is the only open source product analytics platform where customer data never leaves your infrastructure. Hosting

> This message is brought to you by > PostHog is the only open source product analytics platform where customer data never leaves your infrastructure. Hosting my own Matomo installation I beg to differ. Matomo is open source and my visitors data never leaves my own server. Except they only do backend tracking and see https traffic from website frontend tracking reaching my analytics server as it "leaves your infrastructure". But they at least made one thing obviously clear to me. I would never consider using them in the future. Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). So not caring about the law when implementing GA and doing it just wrong is forbidden in Austria. Who would have thought. Using it correctly and adhering to data privacy best practices is just fine with GA.

ratww 5y ago
> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). That's some very interesting information. So, the real answer to the question of whether it's illegal in Austria or not is a "MAYBE", and it is quite easy to make it legal? If so, that should be on this site.
ceejayoz 5y ago
> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). I've only got a machine translation of the ruling (https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_EN_bk.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...), but it includes: "The specific IP address used can no longer be determined by the complainant either. However, this is irrelevant, since the UUID in the cookies is already clearly linked to a person." I've been skeptical of the "just turn on anonymizeIp" approach for this reason; xxx.xxx.xxx.0 plus, say, the user agent, is likely plenty to identify me.
- sdoering 5y ago
  Probably. I tried to read the translated ruling but I have to admit that I find it difficult. Need to search the German version to better understand the fine details. And yes the User ID/cookie ID is PD and one needs consent to transmit that. As one needs consent to store a non essential, non functional cookie. If I read the ruling correctly (and I might be wrong here) the defendant didn't ask for consent.
zelphirkalt 5y ago
Hopefully though, this will make the otherwise so risk aware management layers think again, before they demand adding GA to websites from their developers. Hopefully will even make them avoid it, as an unnecessary risk.
lmkg 5y ago
> Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). There is a BIG issue here which is usually splitting hairs, but in this case is super-relevant. Google's TOS forbids storing PII. GDPR forbids transferring Personal Data (PD). These are nowhere near the same thing. Pseudonymous identifiers are not PII, but are often PD. Google Analytics requires a pseudonymous identifier to work (the "client ID," by default randomly generated value stored in a cookie). This may on its own constitute a GDPR violation, despite not counting as PII for Google's ToS or any other American law.
- sanitycheck 5y ago
  It's possible for a developer to disable GA cookies and/or provide a different client ID to GA, which would make cross-site user tracking and identification of individuals more difficult. Google would still always get the IP and user-agent though, so maybe that's not enough. Proxying calls to GA and stripping anything which could contribute to a fingerprint should logically make it "legal" everywhere, I would have thought?
fleddr 5y ago
That's not my understanding of the ruling. My interpretation is that even with those GA settings in place (anonymize IP), GA still does not comply with GDPR. To back that up: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleiding_privacyvriendelijk_instellen_google_analytics.pdf https://autoriteitpersoonsgegevens.nl/sites/default/files/at... Above is the official guidance from the dutch privacy authority. It basically documents the best practice since 2018: anonymize IP and how to configure several other privacy-friendly settings in GA. Exactly one week ago they added an explicit note to the very top of the document. It says that soon GA (as a whole) may no longer be allowed. No matter how you configure it. They go on to explain that they're in the process of investigating two other complaints and will come to a final conclusion early this year.

ratww 5y ago

> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). That's some very interesting information. So, the real answer to the question of whether it's illegal in Austria or not is a "MAYBE", and it is quite easy to make it legal? If so, that should be on this site.

ceejayoz 5y ago

> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). I've only got a machine translation of the ruling (https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_EN_bk.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...), but it includes: "The specific IP address used can no longer be determined by the complainant either. However, this is irrelevant, since the UUID in the cookies is already clearly linked to a person." I've been skeptical of the "just turn on anonymizeIp" approach for this reason; xxx.xxx.xxx.0 plus, say, the user agent, is likely plenty to identify me.

sdoering 5y ago
Probably. I tried to read the translated ruling but I have to admit that I find it difficult. Need to search the German version to better understand the fine details. And yes the User ID/cookie ID is PD and one needs consent to transmit that. As one needs consent to store a non essential, non functional cookie. If I read the ruling correctly (and I might be wrong here) the defendant didn't ask for consent.

zelphirkalt 5y ago

Hopefully though, this will make the otherwise so risk aware management layers think again, before they demand adding GA to websites from their developers. Hopefully will even make them avoid it, as an unnecessary risk.

lmkg 5y ago

> Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). There is a BIG issue here which is usually splitting hairs, but in this case is super-relevant. Google's TOS forbids storing PII. GDPR forbids transferring Personal Data (PD). These are nowhere near the same thing. Pseudonymous identifiers are not PII, but are often PD. Google Analytics requires a pseudonymous identifier to work (the "client ID," by default randomly generated value stored in a cookie). This may on its own constitute a GDPR violation, despite not counting as PII for Google's ToS or any other American law.

sanitycheck 5y ago
It's possible for a developer to disable GA cookies and/or provide a different client ID to GA, which would make cross-site user tracking and identification of individuals more difficult. Google would still always get the IP and user-agent though, so maybe that's not enough. Proxying calls to GA and stripping anything which could contribute to a fingerprint should logically make it "legal" everywhere, I would have thought?

fleddr 5y ago

That's not my understanding of the ruling. My interpretation is that even with those GA settings in place (anonymize IP), GA still does not comply with GDPR. To back that up: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleiding_privacyvriendelijk_instellen_google_analytics.pdf https://autoriteitpersoonsgegevens.nl/sites/default/files/at... Above is the official guidance from the dutch privacy authority. It basically documents the best practice since 2018: anonymize IP and how to configure several other privacy-friendly settings in GA. Exactly one week ago they added an explicit note to the very top of the document. It says that soon GA (as a whole) may no longer be allowed. No matter how you configure it. They go on to explain that they're in the process of investigating two other complaints and will come to a final conclusion early this year.