4 ms·

The onus is on Google to suspend or anonymize Analytics. Individual Website managers can't be expected to discriminate based on geographical origin, as the docu

The onus is on Google to suspend or anonymize Analytics. Individual Website managers can't be expected to discriminate based on geographical origin, as the document seems to imply.

Macha 5y ago
If Google does not do so or fails to do so adequately, then the onus is on website owners to stop using a service which does not allow them to meet their data protection obligations. The data controller can't offload all responsibility to the data processor, in GDPR terms.
- robertlagrant 5y ago
  Yes, this is correct. GA could make the controller's lives easier, but it isn't ultimately responsible for this.
xxs 5y ago
>Individual Website managers It's their responsibility to include or not google analytics, though.
SquareWheel 5y ago
It's worth noting that GA4 does this already. GA3 (AKA Universal Analytics) requires owners to set the anonymize_ip flag though. I agree that Google should have retroactively changed this policy for GA3 accounts, even if it would cause some breakage. https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
- waffleiron 5y ago
  The English post from CNIL makes it clear it's not just IP that's the issue: >In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States.
  - SquareWheel 5y ago
    Fair point. The English link was not yet posted when I read the (translated) article, so the nature of the personal data wasn't that clear.
dumbfounder 5y ago
If Google doesn't offer the ability then it is up to the customer to not use GA until Google complies. I hate this ruling, but implying it's just Google's job to do this and everyone else should just do nothing is crazy.
- deleted 5y ago
  [deleted]
- rightbyte 5y ago
  Surely Google has presense in France? Why not go after Google directly. It is way easier than processing 1000s of siteowners. Google are the ones spying. The aggregate put on GA dashboard are a minute of the personal info they collect.
  - arlcode 5y ago
    Reasons: 1. Legal: It's the site owners integrating GA and therefore taking on the liabilities just like they do with every other supplier. When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). 2. Practical: A website 100% located in France and catering to 100% french customers is much more likely to fix the problem than the international anonymous machine that is Google.
    - V__ 5y ago
      > When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). And the manufacturer can go after Bosch, who is responsible in the end. > than the international anonymous machine that is Google. Except the law applies to Europe as a whole, and it's really not that much to ask one of the biggest technology companies in the world to use European servers and anonymize European traffic by default. They just don't want to or don't care. Which both should be reason enough to stronger regulate them.
      - 5y ago
southerntofu 5y ago
I both agree and disagree. I agree what Google has been doing for years is morally/legally wrong. I disagree that they should change it, because it would still be triggering 3rd party requests from your browser to Google which is wrong for so many reasons (first and foremost latency and privacy). IMO we should break away Google entirely and trial their execs for crimes against humanity. They're cooperating with USA, China, Saudi Arabia... by helping murderous regimes deploy their techno-police, how many million people have they helped imprison/murder?

The onus is on Google to suspend or anonymize Analytics. Individual Website managers can't be expected to discriminate based on geographical origin, as the document seems to imply.

Macha 5y ago

If Google does not do so or fails to do so adequately, then the onus is on website owners to stop using a service which does not allow them to meet their data protection obligations. The data controller can't offload all responsibility to the data processor, in GDPR terms.

robertlagrant 5y ago
Yes, this is correct. GA could make the controller's lives easier, but it isn't ultimately responsible for this.

xxs 5y ago

>Individual Website managers It's their responsibility to include or not google analytics, though.

SquareWheel 5y ago

It's worth noting that GA4 does this already. GA3 (AKA Universal Analytics) requires owners to set the anonymize_ip flag though. I agree that Google should have retroactively changed this policy for GA3 accounts, even if it would cause some breakage. https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en

waffleiron 5y ago
The English post from CNIL makes it clear it's not just IP that's the issue: >In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States.
- SquareWheel 5y ago
  Fair point. The English link was not yet posted when I read the (translated) article, so the nature of the personal data wasn't that clear.

dumbfounder 5y ago

If Google doesn't offer the ability then it is up to the customer to not use GA until Google complies. I hate this ruling, but implying it's just Google's job to do this and everyone else should just do nothing is crazy.

deleted 5y ago
[deleted]
rightbyte 5y ago
Surely Google has presense in France? Why not go after Google directly. It is way easier than processing 1000s of siteowners. Google are the ones spying. The aggregate put on GA dashboard are a minute of the personal info they collect.
- arlcode 5y ago
  Reasons: 1. Legal: It's the site owners integrating GA and therefore taking on the liabilities just like they do with every other supplier. When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). 2. Practical: A website 100% located in France and catering to 100% french customers is much more likely to fix the problem than the international anonymous machine that is Google.
  - V__ 5y ago
    > When a part in your car fails immediately after you bought it, it's the manufacturers job to fix it even if they acquired the parts from a third party (e.g. Bosch). And the manufacturer can go after Bosch, who is responsible in the end. > than the international anonymous machine that is Google. Except the law applies to Europe as a whole, and it's really not that much to ask one of the biggest technology companies in the world to use European servers and anonymize European traffic by default. They just don't want to or don't care. Which both should be reason enough to stronger regulate them.
    - 5y ago

southerntofu 5y ago

I both agree and disagree. I agree what Google has been doing for years is morally/legally wrong. I disagree that they should change it, because it would still be triggering 3rd party requests from your browser to Google which is wrong for so many reasons (first and foremost latency and privacy). IMO we should break away Google entirely and trial their execs for crimes against humanity. They're cooperating with USA, China, Saudi Arabia... by helping murderous regimes deploy their techno-police, how many million people have they helped imprison/murder?