6 ms·
Google Analytics Illegal in Austria; Other EU Member States Expected to Follow
- eatonphil 5y agoGenuine question: what does this mean for, say, my blog that has Google Analytics on it. I'm in the US. Is my blog violating Austrian law and I'm at legal risk (sure, probably not serious risk) because of it? Also, what's stopping GA from just showing the consent form automatically? Why haven't they done that already or made it an option?
- hardolaf 5y agoAnd people were making fun of American businesses for just geoblocking the EU.
- moonchrome 5y agoIt says Austrian business in the article. You aren't in their jurisdiction.
- eatonphil 5y ago> or your website services Austrian citizens I'm sure I get Austrian traffic from time to time.
- deleted 5y ago[deleted]
- micromacrofoot 5y agoyou're not servicing anyone, you're not a business
- masswerk 5y agoI just made sure you do get traffic from Austria – there, you have it. :-) On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.) Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.) Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)
- _heimdall 5y agoTheir anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request. This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.
- masswerk 5y agoYes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.
- Retr0id 5y agoWhy do so many US sites block my EU IP address, citing GDPR?
- seszett 5y agoTheir owner generally also owns an advertising business or similar and wants to make a point.
- gjs278 5y ago
- irrational 5y agoWhen GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
- micromacrofoot 5y agobecause they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
- hardolaf 5y agoIt's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
- micromacrofoot 5y agothere are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
- tankenmate 5y agoIf you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/
- tankenmate 5y agoFor further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0] [0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
- sporedro 5y agoMy understanding was you had to either not allow connections from that country to access your site or have some version that doesn’t track them. Your probably not at risk for anything, as your using googles service, but I’m not a lawyer. I’d assume if your using google analytics, google would be responsible for following these guidelines? Google will probably release info on this if they haven’t already. But I find it hard to believe unless your rolling your own analytics anyone would come after you.
- cassianoleal 5y ago> I’d assume if your using google analytics, google would be responsible for following these guidelines? IANAL but I doubt that's the case. If GA is being used through your site, you're the data controller and Google are the data processor. [0] At the very least, you're liable as you're the one sending the user's data to GA. This probably holds true even if technically it's the user's own browser making the calls to GA directly, since it was only doing so because your site instructed. Happy to be corrected if that's not the case. [0] https://www.gdpreu.org/the-regulation/key-concepts/data-controllers-and-processors/#What_Is_The_Difference_A_Between_Controller_And_Processor https://www.gdpreu.org/the-regulation/key-concepts/data-cont...
- whakim 5y agoThe GP's blog (the "data controller" in GDPR parlance) isn't an EU entity and it's not clearly intending to offer goods or services to EU data subjects. The blog therefore isn't subject to the GDPR.
- suifbwish 5y agoIf a country wants to do this why don’t they just block connections to all foreign IP ranges and be done with it; don’t make it the rest of the worlds problem.
- IAmEveryone 5y agoIt means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there. For GDPR to apply, your website needs some connection to an EU country beyond just being on the internet. What constitutes such a connection isn't an exact science, obviously, which leads and/or allows people to make rather strange claims, the worst of which is probably that such ambiguity makes it entirely impossible to make laws on the subject. The "official example" is explicitly making accommodations to sell to customers in the EU. The marginal example on the non-GDPR side of the dividing line is a US website, in English, that does sell to EU customers, but only if they sneak their country into the generic second line of the address form. What gets you to the other side of the line is, for example, a drop-down that lets you chose an EU country for delivery, a switch that allows users to chose to read your website in German (but not Portuguese b/c Brasil), etc. While there are plenty of cases, as always in life, that straddle the border, one thing is and always was clear: your English-language blog does not fall under GDPR.
- whakim 5y agoYeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.
- XCSme 5y agoBut then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?
- whakim 5y agoIn this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.
- fnord77 5y ago> This ruling stems from a decision made in 2020 by the Court of Justice of the European Union (CJEU) that stated that cloud services hosted in the US are incapable of complying with the GDPR and EU privacy laws. So why can't google analytics simply be served/processed from an EU data center?
- Rygian 5y agoBecause then the NSA can't access that data.
- xNeil 5y agoDoesn't the CLOUD Act state that companies operating under US jurisdiction are legally required to hand over data outside US borders if the US Government was to ask for it? https://aws.amazon.com/compliance/cloud-act/ https://aws.amazon.com/compliance/cloud-act/
- xNeil 5y agoThere does, however, seem to be a section in which an order may be challenged in case the CLOUD Act conflicted with local laws.
- bikeshaving 5y agoWhat’s the latest recommendation for what to use besides Google Analytics? I don’t need most of what the dashboard gives me. I exclusively use Google Analytics to keep track of page views and referrers for some low-traffic sites, and everything else the dashboard provides I honestly find really creepy. The only thing keeping on Google Analytics is the free part.
- Retr0id 5y agoIf you just want page views and referrers, then your webserver logs should have all the data you need already. There is no need to inject 3rd party JS or tracking pixels into your pages. Personally I use GoAccess to visualise this data. > GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser. > It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. https://goaccess.io/ https://goaccess.io/
- Tenoke 5y agoOne of the places I use GA is on my blog which is hosted on Github Pages. There's no server (which I can access). Without js tracking (GA or not) what you've left with is something along the lines of putting it behind Cloudflare and seeing the little you get there. Ironically on the other hand, services like Cloudflare are also what makes server logs less useful in some cases - users might not hit your servers at all for you to record them there.
- mdoms 5y agoI'm using Cloudflare Web Analytics. It's free, offers you far less information but in exchange you offer your users much more privacy. It's still a front-end analytics system which means you'll still lose information from users with tracker blockers, just like with GA. https://developers.cloudflare.com/analytics/web-analytics https://developers.cloudflare.com/analytics/web-analytics
- micromacrofoot 5y agoHave you ever used that data for anything other than a passing curiosity? Most people using Analytics probably don't even need it.
- 51Cards 5y agoUltimately this is an Ad for Matamoto. I am no expert on how various platforms work but wouldn't this just be a case of the biggest target being taken down first? That the same policies are going to apply to all similar analytics services?
- eatonphil 5y agoI assume that Matamoto actually offers the consent dialog which they point out GA does not.
- bryanrasmussen 5y agoAs long as the analytics service is not in the U.S where the privacy protections can be broken by the American Government what's the problem?
- TheBozzCL 5y agoI wasn't familiar with Matomo until I read this article. Of course it ends up being basically an ad for themselves, which made me skeptical... so I decided to look for other sources. It seems to be accurate, though: https://fortune.com/2022/01/13/austria-gdpr-google-analytics-max-schrems-noyb-edps/ https://fortune.com/2022/01/13/austria-gdpr-google-analytics... https://www.wired.co.uk/article/google-analytics-europe-austria-privacy-shield https://www.wired.co.uk/article/google-analytics-europe-aust... I should start this discussion at work, I'm not sure if we serve customers in Austria but I know we use Google Analytics.
- jbverschoor 5y agoThat's when you start charging for email / workspace :-)
- AtNightWeCode 5y agoTouched this in a reason HN thread. "Is this accurate? We have the Schrems II ruling that made some countries think they could not use services like Cloudflare and Azure. Still Cloudflare and Azure are widely used within EU. (Germany is an outcast). One should as always be transparent about what data is collected. From the GA projects I been involved in (in EU) GDPR has never been a concern." Is GA really illegal in AU?
- micromacrofoot 5y agoYes, this is a legal ruling. They've determined that Google Analytics violates the GDPR. I think the bigger question is... will anyone enforce it? For you, a random unknown person? probably not.
- AtNightWeCode 5y agoThis is not my first rodeo. People are always trying to sell their products in these situations. I would not trust a blog post from one of these. We saw the same thing when SOX, GDRP and money laundering laws in EU came about. Some businesses selling more work than necessary. Also, legal rulings typically don’t extrapolate.
- masswerk 5y agoAT not AU (no kangaroos will be hurt in any legal proceedings). I didn't know that this works in Alpha-2, a well. :-)
- jsnell 5y agoDupe. https://news.ycombinator.com/item?id=29918496 https://news.ycombinator.com/item?id=29918496 https://news.ycombinator.com/item?id=29992741 https://news.ycombinator.com/item?id=29992741 https://news.ycombinator.com/item?id=29994183 https://news.ycombinator.com/item?id=29994183
- beebeepka 5y agoGoogle analytics is the first thing I remove from NoScript's whitelist. I've even had developers praising amp as a good thing. It's amazing how even literal poison can be seen as a good thing. Granted, at the time I was working for a company selling ads. They liked everything I disliked, and vice versa
- youngtaff 5y agoWhile all the focus is on GA, the bigger problem is that possibly every web site hosted on AWS, Google Cloud, Azure etc is illegal in EU The GA case seems to hinge on the IP addresses being send to a US provider, and so is deemed illegal under the Cloud Act (as US gov can compel companies to track etc. based on those IPs)
- _heimdall 5y agoFathom Analytics has a few podcast episodes covering the impact of recent EU court rulings. They're biased for sure, being one of the few (or only) analytics companies with full EU isolation to make sure EU data is never sent to a US server.
- moribunda 5y agoOk, only strong point is that there is user personal data - IP for example, but GA has a switch to anonymize IPs. Also there is built-in option for cookie allowance in Google tag manager and Google ads. This looks like an ad.