8 ms·
People shouldnt need to be experts in data collection or computing in order to have their data treated fairly. If Google can't protect user's tracking data (an
by AndrewDucker 5y ago
People shouldnt need to be experts in data collection or computing in order to have their data treated fairly.
If Google can't protect user's tracking data (and they can't - the US law won't let them) then they shouldn't be allowed to hold it.
- qiqitori 5y agoPeople shouldn't have to be experts in this stuff either just to put up a website somewhere, or worse keep up with every new ruling.
- demindiro 5y agoYou don't need GA for a website either. Many websites probably don't even need any form of analytics at all.
- pyronik19 5y agoDo you really think we are in a better place now with GPDR and all these annoying cookie banners all over the place?
- dale_glass 5y agoOverall, yes. At the very least it's been incredibly enlightening. It's amazing how random websites have 50 "partners" all of which for some reason need to know what I'm doing.
- nickpp 5y agoSo you think your "enlightenment" is worth the millions of work-hours people are putting in just to read and click a cookie banner they give absolutely not a single crap about?
- jen20 5y agoThey wouldn't have to do this if they didn't spew personal information indiscriminately to scumbag "partners". So yes, I do think that is worthwhile. The cost is born by the correct people.
- nickpp 5y agoThe cost is borne by every single internet user in EU clicking countless stupid boxes every single day - for nothing. Also by the EU users losing access to ad-supported free services.
- FredPret 5y agoAnd every single user outside the EU. I never voted for these crazy runaway regulations, but I can’t browse many sites on mobile at all with all the damn banners. EU bureaucrats are effectively prescribing how the web should work for everyone. Ridiculous.
- dale_glass 5y agoNot for nothing, as you can see in this post. Little by little we're stopping to send private data to the US. That's a good thing, even if it's painful at the start.
- nickpp 5y ago>That's a good thing Says who?! I have zero problems sending my private data to the US. I did it for years and I still think is one of the better places to send my private data to. Definitely better than my own country.
- dale_glass 5y agoMe, obviously, since I made the comment? And why the heck would I want to give my data to a bunch of random companies? What's the benefit in it for me, anyway?
- rascul 5y agoCookie banners were already a thing before GDPR.
- p_l 5y agoYou know those "cookie banners" are illegal under GDPR too, and done specifically to annoy people into agreeing?
- xtracto 5y agoThis is so funny. Under GDPR everything is illegal, the only legal website is no website. Good for Europe, they are just going to law themselves out of the internet. Up to the point were your ISP doing hops to send your TCP packet will be illegal unless you approve them sharing that info with all the shops.
- FredPret 5y agoWhat about clicking or typing in a site? Is your webserver processing those? That means you’re gratuitously using user data to run your for-profit business! That should be illegal! /s
- datavirtue 5y agoHell yeah. The banners are the fault of the website owner. They don't have to display them.
- shadowgovt 5y agoBut they do, and it's terrible. I feel for my European brothers and sisters these days. As an American, I hardly ever see these banners. Went to an EU country for work and... Holy cow. Y'all get these banners every site. How do you tolerate it?
- nickpp 5y agoSearching for "Allow All" becomes a reflex after a while. I don't know anybody rejecting anything anymore, it's even worse.
- shadowgovt 5y agoHonestly, I've never felt the urge to reject. I'm a guest in their data house, soaking their bandwidth for free. Track away.
- can16358p 5y agoThis is weird. I'm neither in US or Europe but still see all those cookie banners everywhere on every site. Thanks to GDPR, we have a much more private web. /s
- jen20 5y agoDo you really think GDPR and cookie banners are related? Most are non-compliant in the first place, and were around for years beforehand. Yes, I think we're in a vastly better place, where there is a cost to doing bad things.
- nickpp 5y agoUnfortunately the cost in borne by us, regular EU internet users through a much degraded Internet browsing experience.
- M2Ys4U 5y ago100%. (Also, the GDPR is not responsible for cookie banners)
- shadowgovt 5y agoGood law understands consequences. The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging.
- M2Ys4U 5y ago>The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging. And now the regulators are responding to it.[0] [0] https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europes-consent-popups-are-unlawful/ https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...
- shadowgovt 5y agoThat ruling declares that a centralized solution is no good. The predictable outcome from that ruling is a decentralized solution: a few libraries attempting to build frameworks that are compliant, everyone implementing their own one-off versions of permission-granting and cookie consent using those frmeworks as a basis, and the Authority chasing mom-and-pop sites that are out of compliance until the sun goes cold. In a sense, that may satisfy the goals: the data will be decentralized, stored widely, and harder to aggregate. On the other hand, what we learned from the virus era and the Windows OS monoculture is thousands of nodes running the same software (but not centrally maintained; maintained by people who have a job other than maintaining a website and are therefore slow to patch security holes) will be vulnerable to scripted attacks against frameworks. My prediction is a net increase in stolen PII and, while individual site-runners will get screwed, the number of sites collecting the data won't go down. It's just too valuable, and the odds you will get hit by a hacker are too low. In any case, it'll be a hell of a ride.
- AndrewDucker 5y agoPut up a static website and you're fine. Collect people's data (and that's what a user analytics system does) and then you're responsible for it, and you have to follow the rules.
- rascul 5y agoStatic websites can collect data too. Lots of stuff can go into web server logs.
- jeroenhd 5y agoAnd web server logs are fine for troubleshooting and detecting abuse, you don't even need to ask for consent! Only things like tracking, ads, and sending data to areas without equivalent privacy laws are forbidden. The intent and usage of the collected information is a big part of what is and isn't allowed.
- nickpp 5y agoSource? AFAIK web-server logs logging IPs are not allowed under GDPR.
- rascul 5y agoThat would be interesting. They all log IPs by default. Here's an example from nginx: 192.168.1.122 - - [10/Feb/2022:11:32:35 +0000] "GET /audio/pop.wav HTTP/1.1" 206 28366 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
- AndrewStephens 5y agoI looked into this at back when the GDPR came into effect [0]. I am not a lawyer but in summary: Web sites are allowed to log data (including visitor requests and IPs) required for the smooth running of the site. It could be argued that keeping logs allows for trouble-shooting so web server logging is probably OK in most circumstances. However, there is no reason to keep months/years of logs around. Having this data is actually a liability under the GDPR and you should be aggressively deleting logs after a few days. [0] https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...
- MereInterest 5y agoIf you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it. But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".
- true_religion 5y agoWell, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).
- viro 5y agoThat's why this whole thing is nothing but protectionism.
- pgeorgi 5y ago> so long as the data is located and processed in France. ... you also have to ask for permission first. The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.
- Nextgrid 5y ago> you can totally contribute to a privacy violating network … so long as the data is located and processed in France. While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.
- shadowgovt 5y agoAt this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.
- can16358p 5y agoThis! GDPR is a big block towards technological improvement. Do virtually any business that involves user registration at some point, and now you need to be sure that you're compliant with all those rules, spending limited resources on that to avoid ridiculous fines. It benefits only the big players who has lawyers to know exactly what to do and not, and a nightmare for anyone who tries to grow a small business or have a small website.
- M2Ys4U 5y ago> GDPR is a big block towards technological improvement. It's exactly the opposite. It forces technology to be developed in a way that protects human rights (specifically the right to privacy). Innovation is not automatically good if you're innovating in the wrong direction. Think of it as a vector, not a scalar.
- nickpp 5y agoWho is deciding what is the wrong and good direction to innovate in for everybody else?
- can16358p 5y agoApparently some politicians in EU who has a grudge against US-based tech companies. "Hey Google and Facebook is doing so well let's make harder for everyone using their services." I neither have sympathy for those companies and never been to US, but adter all these GDPR regulations I actually started to sympathize.
- FredPret 5y agoI was anti-Brexit when it happened, but am beginning to see the wisdom of it.
- can16358p 5y agoIt was already non-invasive. I, as a conscious human being browse a website, use their (potentially free) services. The website can of course put a cookie and track me. If I'm really paranoid I could block cookies etc but regardless, no one forces me to use their website. If someone pointed a gun and forced me to go to a website, enter my personal data and give my data to trackers that would be something else (still not website's fault but anyway).
- FredPret 5y agoSo true. I have a collection of small, US-focused websites. I'm investigating low-effort ways to geo-fence the EU. At some point it just becomes easier to ban Europeans, rather than keep up with whatever they'll come up with next. I saw in this thread that the Google fonts on my website are now a problem as well!? That's the first I heard of it.
- criddell 5y ago> That’s the first I heard of it. This is the perfect example of why government oversight is needed. You run a bunch of websites and aren’t aware that you are inadvertently involved in violating the privacy of the people who visit your sites. How are non-technical people supposed to deal with this?
- FredPret 5y agoNo, this is a perfect example of the exact opposite. A bureaucrat on the other side of the planet comes to a conclusion and I, who never voted for this person or knew about their existence, am legally bound by their decision. On pain of who knows what fines or penalties. I’m nearly overwhelmed by the amount of work on my core product, I can’t add “keep up with European legal opinion” to my todo list as well. As I said, it’s simpler to just geofence everything.
- viro 5y ago
- jen20 5y agoThe argument is not that Google shouldn't hand over data with a warrant if it resides in an appropriate jurisdiction. The argument is that Google shouldn't have the data in that jurisdiction to hand over in the first place unless an individual user has given consent for that.
- viro 5y agoWhy should every US tech company be expected to duplicate its infrastructure in the EU? Google isn't special, this applies to EVERY US-based competitor to GA. This gives EU competitors an unfair advantage.... and that's the real point.
- jen20 5y agoBecause the US cannot implement reasonable privacy laws that give basic safeguards to personal information expected by EU citizens (or even UK citizens). If anything, EU competitors to Google Analytics are at a _disadvantage_ because they can't apply the same lassaiz-faire techniques for US-based customers that US-based companies get away with.
- AndrewDucker 5y ago