6 ms·

Genuine question: what does this mean for, say, my blog that has Google Analytics on it. I'm in the US. Is my blog violating Austrian law and I'm at legal risk

Genuine question: what does this mean for, say, my blog that has Google Analytics on it. I'm in the US. Is my blog violating Austrian law and I'm at legal risk (sure, probably not serious risk) because of it? Also, what's stopping GA from just showing the consent form automatically? Why haven't they done that already or made it an option?

hardolaf 5y ago
And people were making fun of American businesses for just geoblocking the EU.
moonchrome 5y ago
It says Austrian business in the article. You aren't in their jurisdiction.
- eatonphil 5y ago
  > or your website services Austrian citizens I'm sure I get Austrian traffic from time to time.
  - deleted 5y ago
    [deleted]
  - micromacrofoot 5y ago
    you're not servicing anyone, you're not a business
  - masswerk 5y ago
    I just made sure you do get traffic from Austria – there, you have it. :-) On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.) Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.) Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)
    - _heimdall 5y ago
      Their anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request. This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.
      - masswerk 5y ago
        Yes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.
- Retr0id 5y ago
  Why do so many US sites block my EU IP address, citing GDPR?
  - seszett 5y ago
    Their owner generally also owns an advertising business or similar and wants to make a point.
  - gjs278 5y ago
  - irrational 5y ago
    When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
  - micromacrofoot 5y ago
    because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
    - hardolaf 5y ago
      It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
      - micromacrofoot 5y ago
        there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
- tankenmate 5y ago
  If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/
  - tankenmate 5y ago
    For further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0] [0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
sporedro 5y ago
My understanding was you had to either not allow connections from that country to access your site or have some version that doesn’t track them. Your probably not at risk for anything, as your using googles service, but I’m not a lawyer. I’d assume if your using google analytics, google would be responsible for following these guidelines? Google will probably release info on this if they haven’t already. But I find it hard to believe unless your rolling your own analytics anyone would come after you.
- cassianoleal 5y ago
  > I’d assume if your using google analytics, google would be responsible for following these guidelines? IANAL but I doubt that's the case. If GA is being used through your site, you're the data controller and Google are the data processor. [0] At the very least, you're liable as you're the one sending the user's data to GA. This probably holds true even if technically it's the user's own browser making the calls to GA directly, since it was only doing so because your site instructed. Happy to be corrected if that's not the case. [0] https://www.gdpreu.org/the-regulation/key-concepts/data-controllers-and-processors/#What_Is_The_Difference_A_Between_Controller_And_Processor https://www.gdpreu.org/the-regulation/key-concepts/data-cont...
- whakim 5y ago
  The GP's blog (the "data controller" in GDPR parlance) isn't an EU entity and it's not clearly intending to offer goods or services to EU data subjects. The blog therefore isn't subject to the GDPR.
suifbwish 5y ago
If a country wants to do this why don’t they just block connections to all foreign IP ranges and be done with it; don’t make it the rest of the worlds problem.
IAmEveryone 5y ago
It means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there. For GDPR to apply, your website needs some connection to an EU country beyond just being on the internet. What constitutes such a connection isn't an exact science, obviously, which leads and/or allows people to make rather strange claims, the worst of which is probably that such ambiguity makes it entirely impossible to make laws on the subject. The "official example" is explicitly making accommodations to sell to customers in the EU. The marginal example on the non-GDPR side of the dividing line is a US website, in English, that does sell to EU customers, but only if they sneak their country into the generic second line of the address form. What gets you to the other side of the line is, for example, a drop-down that lets you chose an EU country for delivery, a switch that allows users to chose to read your website in German (but not Portuguese b/c Brasil), etc. While there are plenty of cases, as always in life, that straddle the border, one thing is and always was clear: your English-language blog does not fall under GDPR.
- whakim 5y ago
  Yeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.
  - XCSme 5y ago
    But then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?
    - whakim 5y ago
      In this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.

hardolaf 5y ago

And people were making fun of American businesses for just geoblocking the EU.

moonchrome 5y ago

It says Austrian business in the article. You aren't in their jurisdiction.

eatonphil 5y ago
> or your website services Austrian citizens I'm sure I get Austrian traffic from time to time.
- deleted 5y ago
  [deleted]
- micromacrofoot 5y ago
  you're not servicing anyone, you're not a business
- masswerk 5y ago
  I just made sure you do get traffic from Austria – there, you have it. :-) On the more serious side, I guess, the outcome may be that GA will be not allowed to collect certain data in Austria. (Just a personal opinion, not a legal advice.) Mind that you can add `ga('set', 'anonymizeIp', true);` to any GA embedding script, which should be more in compliance. (My guess is that GA will have to default to this mode anyway.) Edit: GDPR is about storing and processing personalized data. Meaning, if no personalized data is involved, there shouldn't be any need for even declaring it, nor should it be subject to explicit opt-in. On the other hand, we can't be sure, if `ga('set', 'anonymizeIp', true);` really does what it says. (Again, not a legal advice.)
  - _heimdall 5y ago
    Their anonymize IP feature is basically useless unfortunately. It can only anonymize the IP address in a visitor's browser, Google will still get the real IP address from the HTTP request. This feature doesn't do anything for GDPR compliance and almost certainly wouldn't hold up in court, if it ever came to that for a particular site.
    - masswerk 5y ago
      Yes, it's basically just like the do-not-track feature: we can only declare our intend, but we cannot be sure, whether or not this will be honoured on the server side of things. It would be up to Google to provide some kind of proof of legal relevance.
Retr0id 5y ago
Why do so many US sites block my EU IP address, citing GDPR?
- seszett 5y ago
  Their owner generally also owns an advertising business or similar and wants to make a point.
- gjs278 5y ago
- irrational 5y ago
  When GDPR came out, we had a serious discussion about whether Europe having access to our site was important enough to implement GDPR, or if we should just block Europe all together. In the end we decided to bite the bullet and implement it, but it could easily have gone either way.
- micromacrofoot 5y ago
  because they'd rather block the EU than figure out if the GDPR has any implications for them, it's pure laziness
  - hardolaf 5y ago
    It's also a cost. To be compliant, there's a bunch of mandatory expenses you have. It's not as simple as "just figure out the GDPR". Heck, just doing that is paying some lawyer $400-500/hr. And because it's the USA, GDPR compliance lawyers aren't around every corner. So you're probably paying extra above that.
    - micromacrofoot 5y ago
      there are no mandatory expenses, and you can indeed figure it out yourself… especially if you’re not selling things to europeans or handling personal data
tankenmate 5y ago
If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/
- tankenmate 5y ago
  For further guidance the best source is probably the European Data Protection Board's (EDPB) own guidance for the territorial scope of the GDPR.[0] [0] https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

sporedro 5y ago

My understanding was you had to either not allow connections from that country to access your site or have some version that doesn’t track them. Your probably not at risk for anything, as your using googles service, but I’m not a lawyer. I’d assume if your using google analytics, google would be responsible for following these guidelines? Google will probably release info on this if they haven’t already. But I find it hard to believe unless your rolling your own analytics anyone would come after you.

cassianoleal 5y ago
> I’d assume if your using google analytics, google would be responsible for following these guidelines? IANAL but I doubt that's the case. If GA is being used through your site, you're the data controller and Google are the data processor. [0] At the very least, you're liable as you're the one sending the user's data to GA. This probably holds true even if technically it's the user's own browser making the calls to GA directly, since it was only doing so because your site instructed. Happy to be corrected if that's not the case. [0] https://www.gdpreu.org/the-regulation/key-concepts/data-controllers-and-processors/#What_Is_The_Difference_A_Between_Controller_And_Processor https://www.gdpreu.org/the-regulation/key-concepts/data-cont...
whakim 5y ago
The GP's blog (the "data controller" in GDPR parlance) isn't an EU entity and it's not clearly intending to offer goods or services to EU data subjects. The blog therefore isn't subject to the GDPR.

suifbwish 5y ago

If a country wants to do this why don’t they just block connections to all foreign IP ranges and be done with it; don’t make it the rest of the worlds problem.

IAmEveryone 5y ago

It means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there. For GDPR to apply, your website needs some connection to an EU country beyond just being on the internet. What constitutes such a connection isn't an exact science, obviously, which leads and/or allows people to make rather strange claims, the worst of which is probably that such ambiguity makes it entirely impossible to make laws on the subject. The "official example" is explicitly making accommodations to sell to customers in the EU. The marginal example on the non-GDPR side of the dividing line is a US website, in English, that does sell to EU customers, but only if they sneak their country into the generic second line of the address form. What gets you to the other side of the line is, for example, a drop-down that lets you chose an EU country for delivery, a switch that allows users to chose to read your website in German (but not Portuguese b/c Brasil), etc. While there are plenty of cases, as always in life, that straddle the border, one thing is and always was clear: your English-language blog does not fall under GDPR.

whakim 5y ago
Yeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.
- XCSme 5y ago
  But then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?
  - whakim 5y ago
    In this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.