9 ms·

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and th

Don't quite understand this at all. Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Also is it illegal because there is an anonymised id number created when you send data. If that's the case then it's not just GA that's a problem but any tracking system i.e. Plausable. Furthermore given that a randomised unique id is personal data then there would appear no way to use any websites analytics on any website as you have to store this in a DB which will require a unique id per row by design. What about other data for example a webserver log will contain similar data is that not allowed? If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers.

iamacyborg 5y ago
> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. Yes, because you're still passing personal data to the USA, which means US intelligence services can access it.
- Dave3of5 5y ago
  Is that the case for any data that is passed into the USA then rather than just GA? So if I hosted my servers in any of the AWS US regions that too would be illegal if they have any personal data in them. In this case personal data is a randomised unique id. So say I have a table of users and all I have is a username and a password and a unique id for the record that's personal data and the customer is not allowed to give their permission for me to store that in a US data center ?
  - iamacyborg 5y ago
    Potentially, yes, though this hasn't been tested in court yet.
    - Dave3of5 5y ago
      Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.
      - shafyy 5y ago
        Yes, of course. It's possible that the they will sue every single big company, but quite possible. I think it's a good way for the EU to build pressure against the US to revise the CLOUD act.
        judge2020 5y ago
        This will only happen if the EU makes a true effort to go after as many big US companies as possible. If corporations actually start to lose access to the EU market, the US will follow suit and change its laws.
        shafyy 5y ago
        Godspeed!
      - numpad0 5y ago
        If enforced thoroughly and by the letters of law. But the authorities in EU has control over selective enforcement of laws(that there potentially won't be by 26th century) letting the law spun as an open negotiation.
      - zelphirkalt 5y ago
        The differentiation is probably, that some data is required for offering a service, that people choose to use, but GA data is not.
      - qualudeheart 5y ago
        That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.
  - cowl 5y ago
    a randomised unique ID and username/password are not personal data if they can't be used to identify a person. IF you associate that uniqueID or username with something that can identify the user (like IP/ Personal name etc) than yes it's illegal for you to store that data in US even with the consent of the user.
    - themanmaran 5y ago
      I feel like this is either a mis-interpretation, or the scope of this law would prevent 95% of websites from existing in the EU (including hackernews which stores your email). So any US company cannot store PII on an EU citizen? If someone from the EU comes to my site to make a purchase, I can't allow them to do that?
      - cowl 5y ago
        Yes that is my interpretation of it. The whole point being that any data stored in US can not be guaranteed to respect GDPR because the US government can request access to that data and the EU citizens don't have a recourse to that. any US buisness that want to have EU citizens PI needs to have a host in EU.
        judge2020 5y ago
        Not just a host, but the corporation in control of the data can't be controlled by a US corporation at all, lest the US corporation be able to pressure the EU subsidiary into handing over that data.
        themanmaran 5y ago
        So every US company needs to have a separate, non-controlled, entity in the EU? Seems pretty unrealistic to me. In this scenario, I feel like the US company would be better off blocking traffic from the EU.
        judge2020 5y ago
  - RIMR 5y ago
    Yes, that's exactly right. Makes perfect sense to me.
  - nomercy400 5y ago
    It will likely become even worse: it is not just AWS US regions, but any region. AWS is a US based company falling under US legislation, and (as far as I know) also owns its EU regions. So basically you cannot use AWS to store content of EU citizens. You know any other US based companies? They have to follow the same reasoning. It might even be if you are a US based company, you have to follow the same reasoning. As a US company, you are not allowed to store or transfer data considered personal by GDPR of EU citizens, as your company can be compelled by the US government to hand over that data through an opaque/secret order where the EU citizen is not notified nor has the option to challenge this.
- im3w1l 5y ago
  If my website is hosted on a server located in the US, then is this illegal? Serious question. Assume it's a static site and that I don't collect any data myself whatsoever. But who knows what the server operator could be doing covertly? If this doesn't cut the internet in two, I don't get where the line goes.
  - iamacyborg 5y ago
    Are you hosting and processing personal data (including IP) on your server? It might be.
    - im3w1l 5y ago
      Ninja edited.
  - iLoveOncall 5y ago
    A static site still logs the visitor's IP address in the logs of your webserver for example.
pfortuny 5y ago
There is the fact that in the EU you have the right to ask (and the business the obligation to comply) for your data to be deleted. This is incompatible with your data being kept by a US business in the US, which is not subject to that law.
iqanq 5y ago
>If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. The basis of regulations is that citizens are too stupid to consent to things even if they are fully informed. Whether that is a good or bad approach is up for debate.
- dbbk 5y ago
  That's not at all the point. The issue here is data residency.
  - tantalor 5y ago
    Asking permission for something users don't understand is tantamount to not asking in the first place.
    - iqanq 5y ago
      Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.
      - krageon 5y ago
        No, this is not how consent works. Consent has to be informed and well-judged: If you don't understand what you're agreeing with, you have not given it (even if you say yes the other party cannot proceed as if they have gotten it).
      - tantalor 5y ago
        An agreement requires a meeting of the minds. Blindly clicking "yes, accept cookies" in popups does not rise to that level. People just want to read the article, they do not understand or care about the data retention policy. So it is very hard to claim they consented.
martin_a 5y ago
> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.
- Dave3of5 5y ago
  Ok so what's the actual minimum you've said two weeks here but where is this actually defined ?
  - martin_a 5y ago
    There's no hard limit here provided by the law or otherwise. Some of the local data protection offices say that they find something of "up to 30 days" reasonable, so I guess that's a good starting point. Cutting that time in half will show good faith and you'll still be able to analyze logs, I think.
    - Dave3of5 5y ago
      Ok 30 days do you have a link for that?
      - martin_a 5y ago
        Well, you'll for example find the 30 days in this document of the data protection office of Bavaria: https://www.lda.bayern.de/media/muster_1_verein_verzeichnis.pdf https://www.lda.bayern.de/media/muster_1_verein_verzeichnis.... (It's a sample for sport clubs etc.) and it's also what our lawyer has recommended to our company as the upper limit.
  - M2Ys4U 5y ago
    It's not defined, because it depends on why you're processing the data. Different reasons would entail different retention times.
dbrgn 5y ago
> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. From what I can tell: If you ask your users for permisssion ("informed consent"), then no, it is not illegal. The way I understood the court case in Austria, the disputed point was whether or not the use of GA falls under the GDPR. If it does fall under it, then you are obliged to ask your users for consent ("opt-in"). If it does not, you can use it freely without consent. Because analytics data isn't worth that much if you collect only part of the data, most collectors of data do not want to ask users for their consent, because most users would reject this. But IANAL. In any case, please stop using Google Analytics, and self-host your analytics using Matomo, Plausible, or something similar. Matomo can also be configured to use server-side analytics, in which case your analytics become both less invasive (no client-side JS needed) and more complete (can't be blocked by ad-blockers).
- tempnow987 5y ago
  I think this is basically a fat EU lie - that if you pop up a cookie popup most users say no to cookie banners. I've heard that if you do a non-modal cookie banner, 75% of people just ignore it rather than go into it to deny cookies. About 12% (half of remaining) click accept all cookies. The rest close it again without taking action if they can. I realize there are folks who go into things and customize everything on every website - most users I think don't care enough. What's funny -> your ISP might be selling your browsing history. Your TV is selling your watching history and no one cares. But cookie pop-ups everywhere is all these privacy idiots can think about. It's performative privacy, that annoys the heck out of a lot of users and wastes a ton of time.
  - scraptor 5y ago
    My hypothetical ISP and TV would also be violating GDPR if they did such things. They might currently face fewer lawsuits than google but that doesn't mean that no one cares.
    - tempnow987 5y ago
youngtaff 5y ago
> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. If you've sought the visitors consent then yes it's legal
- judge2020 5y ago
  This court case makes it illegal since, while the user might consent to GA tracking, they legally can't consent to giving up their GDPR rights. Given that, the US law enforcement could still break GDPR by forcing the US corporation to hand over EU citizens' data.
  - drusepth 5y ago
    Seems like a nice opportunity for a browser extension to automatically detect sites using GA, and also automatically report them to EU authorities. Zero clicks needed!
    - judge2020 5y ago
      But that also remains true for the website themselves, since there is proof that the website illegally sends data of any EU citizen to the US. This really is pretty wild regulation.
remram 5y ago
If they can say no and can still use the website, you are definitely in the clear.
pyrale 5y ago
You can likely still do analytics if you don't collect an identifier that persists through multiple sessions. That's a big hit for ad-tech, but plenty other use cases don't really care for that property. You can also collect that identifier if 1) you have a legitimate reasons to do so and 2) don't share it with third parties.
Dave3of5 5y ago
Utterly confused here half this thread is contractdicting the other half.

iamacyborg 5y ago

Dave3of5 5y ago
Is that the case for any data that is passed into the USA then rather than just GA? So if I hosted my servers in any of the AWS US regions that too would be illegal if they have any personal data in them. In this case personal data is a randomised unique id. So say I have a table of users and all I have is a username and a password and a unique id for the record that's personal data and the customer is not allowed to give their permission for me to store that in a US data center ?
- iamacyborg 5y ago
  Potentially, yes, though this hasn't been tested in court yet.
  - Dave3of5 5y ago
    Wouldn't that cut off a vast swath of the internet from France though ? Some of the main big providers of internet services use US based data centres. I'm meaning: * Amazon * Google * Facebook * Netflix * Microsoft * Twitter * Uber I mean the list goes on but these are a really big part of the internet.
    - shafyy 5y ago
      Yes, of course. It's possible that the they will sue every single big company, but quite possible. I think it's a good way for the EU to build pressure against the US to revise the CLOUD act.
      - judge2020 5y ago
        This will only happen if the EU makes a true effort to go after as many big US companies as possible. If corporations actually start to lose access to the EU market, the US will follow suit and change its laws.
        shafyy 5y ago
        Godspeed!
    - numpad0 5y ago
      If enforced thoroughly and by the letters of law. But the authorities in EU has control over selective enforcement of laws(that there potentially won't be by 26th century) letting the law spun as an open negotiation.
    - zelphirkalt 5y ago
      The differentiation is probably, that some data is required for offering a service, that people choose to use, but GA data is not.
    - qualudeheart 5y ago
      That might be a good thing. New data centers would be constructed in France and the french people would have more jobs. It’d also be a national security boost because France would be less reliant on external data centre providers.
- cowl 5y ago
  a randomised unique ID and username/password are not personal data if they can't be used to identify a person. IF you associate that uniqueID or username with something that can identify the user (like IP/ Personal name etc) than yes it's illegal for you to store that data in US even with the consent of the user.
  - themanmaran 5y ago
    I feel like this is either a mis-interpretation, or the scope of this law would prevent 95% of websites from existing in the EU (including hackernews which stores your email). So any US company cannot store PII on an EU citizen? If someone from the EU comes to my site to make a purchase, I can't allow them to do that?
    - cowl 5y ago
      Yes that is my interpretation of it. The whole point being that any data stored in US can not be guaranteed to respect GDPR because the US government can request access to that data and the EU citizens don't have a recourse to that. any US buisness that want to have EU citizens PI needs to have a host in EU.
      - judge2020 5y ago
        Not just a host, but the corporation in control of the data can't be controlled by a US corporation at all, lest the US corporation be able to pressure the EU subsidiary into handing over that data.
        themanmaran 5y ago
        So every US company needs to have a separate, non-controlled, entity in the EU? Seems pretty unrealistic to me. In this scenario, I feel like the US company would be better off blocking traffic from the EU.
        judge2020 5y ago
- RIMR 5y ago
  Yes, that's exactly right. Makes perfect sense to me.
- nomercy400 5y ago
  It will likely become even worse: it is not just AWS US regions, but any region. AWS is a US based company falling under US legislation, and (as far as I know) also owns its EU regions. So basically you cannot use AWS to store content of EU citizens. You know any other US based companies? They have to follow the same reasoning. It might even be if you are a US based company, you have to follow the same reasoning. As a US company, you are not allowed to store or transfer data considered personal by GDPR of EU citizens, as your company can be compelled by the US government to hand over that data through an opaque/secret order where the EU citizen is not notified nor has the option to challenge this.
im3w1l 5y ago
If my website is hosted on a server located in the US, then is this illegal? Serious question. Assume it's a static site and that I don't collect any data myself whatsoever. But who knows what the server operator could be doing covertly? If this doesn't cut the internet in two, I don't get where the line goes.
- iamacyborg 5y ago
  Are you hosting and processing personal data (including IP) on your server? It might be.
  - im3w1l 5y ago
    Ninja edited.
- iLoveOncall 5y ago
  A static site still logs the visitor's IP address in the logs of your webserver for example.

pfortuny 5y ago

There is the fact that in the EU you have the right to ask (and the business the obligation to comply) for your data to be deleted. This is incompatible with your data being kept by a US business in the US, which is not subject to that law.

iqanq 5y ago

>If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. The basis of regulations is that citizens are too stupid to consent to things even if they are fully informed. Whether that is a good or bad approach is up for debate.

dbbk 5y ago
That's not at all the point. The issue here is data residency.
- tantalor 5y ago
  Asking permission for something users don't understand is tantamount to not asking in the first place.
  - iqanq 5y ago
    Will you defrob my balancator? Of course not, because you don't know what it is. The same applies here: if you don't know what something means then say no. If you say yes then it's understood that you know what you signed up to.
    - krageon 5y ago
      No, this is not how consent works. Consent has to be informed and well-judged: If you don't understand what you're agreeing with, you have not given it (even if you say yes the other party cannot proceed as if they have gotten it).
    - tantalor 5y ago
      An agreement requires a meeting of the minds. Blindly clicking "yes, accept cookies" in popups does not rise to that level. People just want to read the article, they do not understand or care about the data retention policy. So it is very hard to claim they consented.

martin_a 5y ago

> If it's not allowed how can I ensure my site is protected as I need those logs to identify and ban hackers. Server logs are allowed as "technically necessary" as long as you show "good will" (I'd call it that way) in keeping the saved data to a minimum. 14 days of log keeping? Fine, that's cool for technical reasons. 14 weeks of log keeping? That's excessive and could get you in trouble.

Dave3of5 5y ago
Ok so what's the actual minimum you've said two weeks here but where is this actually defined ?
- martin_a 5y ago
  There's no hard limit here provided by the law or otherwise. Some of the local data protection offices say that they find something of "up to 30 days" reasonable, so I guess that's a good starting point. Cutting that time in half will show good faith and you'll still be able to analyze logs, I think.
  - Dave3of5 5y ago
    Ok 30 days do you have a link for that?
    - martin_a 5y ago
      Well, you'll for example find the 30 days in this document of the data protection office of Bavaria: https://www.lda.bayern.de/media/muster_1_verein_verzeichnis.pdf https://www.lda.bayern.de/media/muster_1_verein_verzeichnis.... (It's a sample for sport clubs etc.) and it's also what our lawyer has recommended to our company as the upper limit.
- M2Ys4U 5y ago
  It's not defined, because it depends on why you're processing the data. Different reasons would entail different retention times.

dbrgn 5y ago

> Can we cut through the clickbait and see what's wrong here. If my website askes users for their permission to use GA and they click yes then is that still illegal here? I see this as yes it's still illegal. From what I can tell: If you ask your users for permisssion ("informed consent"), then no, it is not illegal. The way I understood the court case in Austria, the disputed point was whether or not the use of GA falls under the GDPR. If it does fall under it, then you are obliged to ask your users for consent ("opt-in"). If it does not, you can use it freely without consent. Because analytics data isn't worth that much if you collect only part of the data, most collectors of data do not want to ask users for their consent, because most users would reject this. But IANAL. In any case, please stop using Google Analytics, and self-host your analytics using Matomo, Plausible, or something similar. Matomo can also be configured to use server-side analytics, in which case your analytics become both less invasive (no client-side JS needed) and more complete (can't be blocked by ad-blockers).

tempnow987 5y ago
I think this is basically a fat EU lie - that if you pop up a cookie popup most users say no to cookie banners. I've heard that if you do a non-modal cookie banner, 75% of people just ignore it rather than go into it to deny cookies. About 12% (half of remaining) click accept all cookies. The rest close it again without taking action if they can. I realize there are folks who go into things and customize everything on every website - most users I think don't care enough. What's funny -> your ISP might be selling your browsing history. Your TV is selling your watching history and no one cares. But cookie pop-ups everywhere is all these privacy idiots can think about. It's performative privacy, that annoys the heck out of a lot of users and wastes a ton of time.
- scraptor 5y ago
  My hypothetical ISP and TV would also be violating GDPR if they did such things. They might currently face fewer lawsuits than google but that doesn't mean that no one cares.
  - tempnow987 5y ago

youngtaff 5y ago

judge2020 5y ago
This court case makes it illegal since, while the user might consent to GA tracking, they legally can't consent to giving up their GDPR rights. Given that, the US law enforcement could still break GDPR by forcing the US corporation to hand over EU citizens' data.
- drusepth 5y ago
  Seems like a nice opportunity for a browser extension to automatically detect sites using GA, and also automatically report them to EU authorities. Zero clicks needed!
  - judge2020 5y ago
    But that also remains true for the website themselves, since there is proof that the website illegally sends data of any EU citizen to the US. This really is pretty wild regulation.

remram 5y ago

If they can say no and can still use the website, you are definitely in the clear.

pyrale 5y ago

You can likely still do analytics if you don't collect an identifier that persists through multiple sessions. That's a big hit for ad-tech, but plenty other use cases don't really care for that property. You can also collect that identifier if 1) you have a legitimate reasons to do so and 2) don't share it with third parties.

Dave3of5 5y ago

Utterly confused here half this thread is contractdicting the other half.