31 ms·

Italian watchdog bans use of Google Analytics

dogman144 4y ago
Man, wish we’d do that in the US. Not sure what else to insightfully add after all these years.
yrgulation 4y ago
Time to get off my arse and write a self hosted privacy oriented analytics tool. Whatever happened to awstats. The question is - how to monetise on it?
tick_tock_tick 4y ago
I'd be terrified if I was a EU company at this point. There is not logically way these same rules don't apply to using AWS, GCP, and Azure. There isn't enough other cloud hosting with nearly the same capabilities in Europe to handle that day.
- makeitdouble 4y ago
  GCP and Azure have options to keep all data within the EU, I'm sure AWS has something to at this point. In France GCP is approved for public business, so it seems to be working fine. On your general point, we're way past the point where a company is allowed to blindly use any random SaaS without caring about what it does with the data or where it goes. The pendulum is clearly swinging back.
  - 4ggr0 4y ago
    > GCP and Azure have options to keep all data within the EU I wonder how much of a difference this makes, if the DCs still belong to these american companies and this thing exists: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
    - makeitdouble 4y ago
      GCP made a few adjustments to have something that is compatible with both US laws and the GDPR https://cloud.google.com/blog/products/compliance/how-google-cloud-helps-customers-stay-current-with-gdpr https://cloud.google.com/blog/products/compliance/how-google... From memory, gov entities also have deeper customizations, and data centers might be separate from customers and the standard Google operation altogether.
- hef19898 4y ago
  There seems to be a difference between "B2C" stuff like ad tech and tracking and "B2B" like AWS. The latter seems to be more eager to be compliant, I assume only to prevent local / regional competitors to fill a gap but still. Plus all the nice public contracts to be had.
aliswe 4y ago
What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
- gruturo 4y ago
  This is an English translation from "Garante" which is actually a stronger word - more like Guarantor. It is an official authority with teeth.
  - etagate 4y ago
    Exactly. Just to clarify, this is the authority responsible for those multi-million dollars fines against faang
- x0x0 4y ago
  It's likely a bad translation. The Italian SA is the Italian Data Protection Agency (DPA), one of the per-country European regulators https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm https://ec.europa.eu/justice/article-29/structure/data-prote... . Which acts under the GDPR and predecessor data protection laws, and is very explicitly a governmental regulator.
- noneeeed 4y ago
  Certainly in UK English we use watchdog to mean any organisation that has an oversight role, frequently government ones. For example the Financial Services Authority might be described as “the banking watchdog”, it is very much a government agency.
- chrisseaton 4y ago
  Why do you think watchdogs have to be non-governmental? For example: https://www.theguardian.com/technology/2022/may/05/uk-watchdog-will-have-power-to-impose-huge-fines-on-big-tech-firms https://www.theguardian.com/technology/2022/may/05/uk-watchd...
humanistbot 4y ago
From the article: > A website using Google Analytics (GA) without the safeguards set out in the EU GDPR violates data protection law because it transfers users’ data to the USA, which is a country without an adequate level of data protection. > Upon expiry of the 90-day deadline set out in its decision, the Italian SA will check that the data transfers at issue are compliant with the EU GDPR, including by way of ad-hoc inspections. This follows similar decisions by France [1] and Austria [2]. [1] https://iapp.org/news/a/cnil-is-latest-authority-to-rule-google-analytics-violates-gdpr/ https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo... [2] https://iapp.org/news/a/far-reaching-implications-anticipated-with-austrian-dpas-google-analytics-decision/ https://iapp.org/news/a/far-reaching-implications-anticipate...
lmkg 4y ago
This is consistent with decisions from the Austrian and French data protection authorities (DPAs). Note that Google is a Processor (for this product), meaning that Google itself does not violate GDPR, but only the websites that use it. Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any processing that Google does after collection is not considered to offer any protection, because American law enforcement can just tell them not to do that and they won't. Hence, the "Anonymize IP Address" setting in Google Analytics is not considered to have value for GA. It might theoretically be possible to use GA compliantly by proxying data through an EU-owned service which obfuscates anything considered personal data, at minimum the IP address and various cookie values. This scenario hasn't been confirmed by anyone as compliant, but the regulators seem to always go out of their way to dance around it rather than just saying "GA is non-compliant, always, forever." Still, for the trouble to set up such a service you might as well just stand up a self-hosted first-party analytics solution. This particular decision on GA is purely about the cross-border transfers, and doesn't seem to touch on whether using cookies for analytics requires consent. That's a separate issue (technically about a separate law).
- V__ 4y ago
  > meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.
  - humanistbot 4y ago
    To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.
    - shadowgovt 4y ago
tin7in 4y ago
We are based in Europe and self-host our analytics exactly for this reason. I feel this is just the beginning.
- V__ 4y ago
  Are you using a custom sotware or something like plausible.io?
  - tin7in 4y ago
    I've heard about Plausible but haven't tried it yet. We are using Posthog which is a suite for product analytics.
    - stevoski 4y ago
      Plausible et al all are a pale imitation of GA. They all offer a dashboard with some basic filtering. But they offer little in the way of true analytics features, that allow you to slice, dice, and compare data.
      - mhitza 4y ago
        I'm working on an web analytics project that gives users more power over the way they slice/dice/compare analytics data. Would you be interested in giving it a try when the project launches in alpha? Send me a hello email at the address listed on my profile, would be happy to send out an invite when ready.
      - quickthrower2 4y ago
        Which is a good thing!
- closewith 4y ago
  Unfortunately, you can't self-host the integration with Google Ads or Search Console, which locks anyone who relies on Google (or Facebook, Microsoft, etc) Ads into the use of Google Analytics/Ads tracking.
throwawayjun21 4y ago
corywatilo 4y ago
Italy is the 4th in a string of recent decisions across the EU. (We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.) Note that it's not illegal to use GA entirely, just illegal to use in its default state which transmits PII to the US.
- stingraycharles 4y ago
  That is an extremely important nuance which is not obvious from the title.
  - deleted 4y ago
    [deleted]
  - tut-urut-utut 4y ago
    Most of the people using GA wouldn't be able to set it up correctly. I switched my personal site from GA to Microanalytics, since I wanted to avoid spending time trying to figure out how to configure GA to be conformant. Google should be the one doing the compliance work. If Italy bans some usage pattern in GA, it's Google that should make it impossible to configure it in non-conformant way.
    - mywittyname 4y ago
      It's not that bad: https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi... The most difficult aspect is dealing with URLs. But a company that is large enough to be customizing URLs per user, is large enough to make a few JS changes to ensure they aren't sending those details to GA.
    - throwaway2037 4y ago
      I agree 100% with your second paragraph. I also hope they introduce massive "percent of revenue" fines when Google "forgets" to ban illegal activity on their (near-monopoly) advertising platform. Massive fines has genuinely changed the behaviour of sales & trading at global investment banks. We can do the same for FAANG and friends.
leephillips 4y ago
Good. US citizens should be, at least, disappointed that their government is so bad at protecting their privacy, that US law is so far behind the times. To those companies and people who find these EU decisions baffling or inconvenient: tough. If you had had respect for your users this would not be an issue. You would already not be spying on them. To website visitors: if you see a cookie banner, the site is asking permission to spy on you. If that concerns you, close the tab.
- 2OEH8eoCRo0 4y ago
  America is the LTS branch of Democracy.
  - nix23 4y ago
    More like the bitrotting prototype ;)
    - SkinTaco 4y ago
  - feet 4y ago
    I think the support contract ended a while back
  - hallway_monitor 4y ago
    Privacy improvements will be pulled in along with independent political parties in the next kernel update.
    - feet 4y ago
      You guys are getting kernel updates? Our supreme court is taking us back to v0.1 from 1800
  - baisq 4y ago
    If a modern democracy requires an ever-growing government I think I will stick to Democracy Stable.
ryanmcbride 4y ago
I've been using clicky on a few of my sites and even though they _assure_ me that it's totally compliant with gdpr I don't really believe them, does anyone have a decent alternative for analytics that respects people's privacy? I just want to see when I get new vs returning visitors on a page. Cloudflare's analytics are okay but I like how granular clicky can get, but if there's no good way to do that I think I'm just gonna ditch clicky and make do with the cdn analytics. Hell, I bet the cdn already does everything I need and I just don't know how to use it right, or I'm not paying for the right tier or something.
- deleted 4y ago
  [deleted]
- ClumsyPilot 4y ago
  matomo is something you can self host
  - solar-ice 4y ago
    There's several self-hosted solutions, as well as several GDPR-compliant SaaS solutions. They generally work pretty well; I've seen people set up, for example, Plausible, in a couple of hours on a cheap VPS.
  - tensor 4y ago
    Note that you must make sure that your host is not in the US as well.
tmoneyfish 4y ago
I'm building my own open source analytics solution exactly for this reason.
nwellnhof 4y ago
What's really puzzling is that Google Analytics never got banned because of antitrust laws. It's the most obvious example of predatory pricing I've ever seen. How is a smaller company supposed to compete against a free product?
- tantalor 4y ago
  Lots of ways? Better features, better support, better performance. If you can't beat the free offering, then go home.
  - reaperducer 4y ago
    If you can't beat the free offering, then go home. In the real world of physical goods, there are laws against this. But Google's a tech company, so anything goes.
    - foota 4y ago
      It's not illegal to give things away for free unless it's dumping.
      - reaperducer 4y ago
        It's not illegal to give things away for free unless it's dumping. Which is exactly my point. "[Dumping] occurs when manufacturers export a product... at a price below the normal price with an injuring effect. The objective of dumping is to increase market share in... by driving out competition and thereby create a monopoly situation" https://en.wikipedia.org/wiki/Dumping_(pricing_policy) https://en.wikipedia.org/wiki/Dumping_(pricing_policy) That's exactly what's happening here. Google prices Analytics at $0 to prevent any competition from starting up. While an argument can be made that Google doesn't need to charge money for the product because that cost is made up in other areas, there is no way of knowing that, because those costs are not public. We don't know if it's fully made up by other means, or partially made up by other means, or not at all. Like you, IANAL, but it's my understanding that legally, it's not about the price, it's about the intent.
olalonde 4y ago
I wish GDPR compliance would have been opt-in. For example, a GDPR compliant website could have sent a custom header indicating compliance, which the browser could have displayed in the address bar (a bit like HTTPS). Consumers would then have been free make the decision to not use websites which aren't GDPR compliant. Consumers who are more concerned about privacy could have set their browser to automatically block any non GDPR compliant website.
- eropple 4y ago
  > Consumers who are more concerned about privacy could have set their browser to automatically block any non GDPR compliant website. It may not be your intent, but defaults matter and what you're wishing for here is de-facto scuttling of the GDPR.
  - olalonde 4y ago
    Are you implying that the vast majority of consumers aren't concerned with their privacy and would keep using GDPR-compliant websites? If that's the case, isn't the regulation somewhat against the spirit of democracy?
    - peoplefromibiza 4y ago
      > Are you implying that the vast majority of consumers aren't concerned with their privacy and would keep using GDPR-compliant websites? False premise. Users simply aren't aware, but once they learn about it, they become concerned, > If that's the case, isn't the regulation somewhat against the spirit of democracy? That's a really weird argument. Anyway, that's not the case.
- closewith 4y ago
  Bizarre idea. Should websites be allowed to opt out of anti-fraud legislation? Anti-money laundering? Human rights protections?
  - olalonde 4y ago
mrkramer 4y ago
Google is sucking in so much data that at the end it will be outlawed everywhere.
reaperducer 4y ago
The last time I checked, the Google Analytics' Terms of Service explicitly prohibited its use on web sites involving healthcare companies. That gives you an indication of how invasive it is — that even Google doesn't want to handle the personal information, because it can't be made HIPAA-safe. Naturally, the majority of healthcare web sites use Google Analytics, because nobody ever reads the Terms of Service.
- paulcole 4y ago
  > The last time I checked, the Google Analytics' Terms of Service explicitly prohibited its use on web sites involving healthcare companies. You're missing a key part of the sentence you're remembering: > If you are (or become) a Covered Entity or Business Associate under HIPAA, you may not use Google Analytics for any purpose or in any manner involving Protected Health Information unless you have received prior written consent to such use from Google. Healthcare companies can absolutely use GA on their websites as long as the website isn't involving PHI or ePHI.
cardosof 4y ago
Hindsight is 20/20 but wasn't it clear that the company selling ads shouldn't be in charge of metrics for traffic and ads? Just like the TV channels had to rely on media rating firms.
- badkitty99 4y ago
- youngtaff 4y ago
  Not sure an ad company should he in charge of a browser either
  - cardosof 4y ago
    Oh and don't forget a major OS
openplatypus 4y ago
While I should be happy with narrative (I run https://wideangle.co https://wideangle.co, GA alternative), let's be honest. It not banned. Nor is it illegal. It is illegal to use it in such a way that results in Personal Data being siphoned to the US. Is it hard? Yes. Outright illegal? Nah.
- dx034 4y ago
  But it's enough of a hurdle that many website owners may just decide to go with a EU-based competitor. Certainly a good ruling for the EU tech scene.
- stevoski 4y ago
  It is good to see a GA competitor not resort to FUD as a marketing tool.
current_thing 4y ago
ottime notizie. vietare google e monetizzare le bellissime spiagge, e mangiare pasta autentica.
- nonsapreiche 4y ago
  e w la fica
  - ciarcode 4y ago
    You do maybe
- ciarcode 4y ago
  I don’t think you’re really Italian ahahah
dclusin 4y ago
Suppose I run a website in the us and a user in Italy connects to it. Does this mean I’m now breaking the law serving them the website? My connection logs now have pii. What if I use a cdn that has points of presence in Italy and still pings my server with a head request and the end user ip? Am I also now breaking Italian law by using google analytics?
- kmlx 4y ago
  https://en.m.wikipedia.org/wiki/HTTP_451 https://en.m.wikipedia.org/wiki/HTTP_451 > After introduction of the GDPR in EEA it became common practice for websites located outside EEA to serve HTTP 451 errors to EEA visitors instead of trying to comply with this new privacy law. For instance, many regional U.S. news sites no longer serve web browsers from the EU.
  - Nicksil 4y ago
    https://en.wikipedia.org/wiki/HTTP_451 https://en.wikipedia.org/wiki/HTTP_451
- peoplefromibiza 4y ago
  > Does this mean I’m now breaking the law serving them the website? As the article specifically states: The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. This information was found to be transferred to the USA. In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds. So, unless you are collecting EU citizens user data, transferring it to US and have the capabilities to enrich such data through additional information you hold, no.
- curiousllama 4y ago
  IIRC, it basically only applies if you're actively doing business in the EU, or courting future business. So, if you have a personal blog that grabs IPs? Not illegal. If you start a merch shop for your blog (or put in ads/sponsored content, etc.), then the whole site needs to be GDPR compliant.
iLoveOncall 4y ago
Those decisions are good in theory, but in practice they will kill the free web. The only people that have the work power to put equivalent alternatives in place are the big corporations, that will anyway find a loophole. I run my small blog, and I can't spend days or even weeks to setup a subpar analytics solution. I won't even start talking about self-hosting an analytics solution which would probably double my monthly server cost for a website on which I earn 0€. In 2030, if we continue on that trend, websites will be in two categories: belonging to huge companies, or running illegally. It's baffling that people are applauding the end of the free web.
- freeone3000 4y ago
  Why does your small blog need an "analytics solution" in the first place, if you earn $0?
  - iLoveOncall 4y ago
    Because I want to know where my readers come from, which Google terms they searched, etc.? There's a million reasons to want to know stats like this without earning money...
    - stevoski 4y ago
      > which Google terms they searched, etc. GA doesn't tell you which terms they searched. They mostly stopped doing this in 2013. Google Search Console _does_ tell you the search terms, and without any tracking on your website.
    - progman32 4y ago
      As a user, I don't want to give this info. I'm glad the EU is giving folks an avenue to express this preference.
      - iLoveOncall 4y ago
        I provide free tutorials and articles like this. If you don't want to provide this info then I don't want to provide you free content.
takethat 4y ago
anyone runs self hosted matomo/piwik instance for analytics?
cm2012 4y ago
Another decision in a long stream that will make it much harder for EU start-ups companies to catch up to American ones. With absolutely no improvements to actual EU citizen well being.
- redleather 4y ago
  That's assuming a European GDPR-compliant alternative to Google analytics wouldn't arise. But of course it will. It's not even a very difficult product to build. If anything this is both sticking it to Google and creating opportunities for European startups to fill the void.
- nathanaldensr 4y ago
  Maybe a race where the finish line is maximum exploitation of the digital population isn't a race worth running.
  - iLoveOncall 4y ago
    - waffleiron 4y ago
      So lets legalise child labour? Get rid of OSHA? Where you draw the line is cultural and personal, so don’t dismiss things like this so easily.
  - RubyRidgeRandy 4y ago
    here I thought maximum exploitation would be selling someones identity on the dark web but I come to find on HN that it's actually hashed analytics data D: !!!
    - MarcelOlsz 4y ago
      I wish the internet was purely an informational no bullshit interface/store instead of all this crap. I welcome these changes. Convert it back into a piece of furniture. Oh no we can't make a billion dollars for no reason.
louhike 4y ago
The CNIL in France is really pushing companies to not use Google Analytics, and you better listen to them here. It seems US companies should really make changes to how they host/manage data to be able to able to work in EU in the near future. (It isn’t a criticism, simply an assesment).
- f1refly 4y ago
  There's nothing US companies can do to make themselfes legal to use here. The legal framework in the US allows dragnet spying on every non-american and american companies are forced to participate in that effort.
  - jeroenhd 4y ago
    They're perfectly legal if they don't process any PII. If a US company serves static content there's no need to fear the EU; they'll just have to disable illegal external integrations like Google Analytics/Fonts/etc. A company doing business with other companies might find themselves in a position where they can comply perfectly. Not every company needs to collect PII, though these days every company likes to pretend they do.
    - IX-103 4y ago
      When PII includes IP addresses it's kind of hard not to process. How else are you supposed to group metrics over a session (since cookies are also forbidden)? This seems to ban third-party analytics by any US company. The cynic in me feels this is a little convenient in how it advantages EU organizations over foreign ones...
      - koyote 4y ago
        Do you have a source on PII including IP addresses?
        tylerrobinson 4y ago
la64710 4y ago
This kind of ridiculous laws do not understand the boundless nature of internet. If you want to protect privacy of netizens simply make a universal law instead of having different laws in different countries.
- IncRnd 4y ago
  How does one "simply make a universal law"?
  - la64710 4y ago
    By publishing a RFC.
    - IncRnd 4y ago
      An RFC won't compel people or companies in the way you hope. An RFC is a request and nothing more. A law is driven by the legal authority of a state and is backed by corporate & financial penalties, prisons, and guns.
- tgv 4y ago
  I’m afraid it does understand the boundless nature of the internet, and it wants the owner of the server to do something about it.
- adfm 4y ago
  Since the Internet is not a fiefdom, universal law is moot. Nation states will draft tracking laws that are only only enforceable through tracking in an attempt to gain their slice of authoritarian pie. Pointing to the Google or US is typical strawman BS and gives people a false sense of security because they should assume everyone, not just the Google, is tracking them. Getting people to own their data is an uphill climb, but is ultimately what will curb the negative behavior we're witnessing.
  - la64710 4y ago
    We need a RFC for protecting the internet.
naet 4y ago
As more and more country specific legal regulations are raised, I wonder who will be the ultimate gatekeepers of the general internet when certain actors behave against the "rules". The current landscape is a complex system of seeming contradictions straddling different levels of public and private, centralized and decentralized, anarchical and moderated, etc. Will ISPs be forced to cut off traffic from certain areas? Will centralized companies like Google and Reddit be forced to comply with regulations or cut off services in certain areas? Will governments set up firewalls? Will the buck of responsibility be passed upwards to service providers like GA, or downwards to individual site administrators?
- UncleEntity 4y ago
  Nah, they’ll just slap them with a fine now again as a substitute for direct taxation and let them do what they do basically unchanged. Once the Europeans have to use a foreign proxy to see the regular internet, like the Chinese, then we will have a real discussion on online privacy.
  - djbebs 4y ago
    We already do.
  - djbebs 4y ago
    Have you tried to go to rt.com hany time recently?
    - aembleton 4y ago
      Still works for me from the UK
clairity 4y ago
i’d support any legislation that booted google, fb, ms, adobe, salesforce, and a whole host of other surveillance tech companies from any and all levels of government. it’s literally as important as the separation of church and state. in fact, i’d love to see a constitutional amendment explicitly separating corporate interests from governmental ones, in all facets of civic life (e.g., campaign finance).
- abarwick 4y ago
  This is just naive. Government offices/agencies are so tightly coupled with packages like office 365 that forcefully separating them would require home built solutions which would always be terrible, less secure, and more expensive to the tax payer. There’s a lot of good these products can provide, granted they are properly audited and have high security requirements.
  - clairity 4y ago
    ah, the ad hominem, never a good sign for the proceeding argument. there are a number of other office suites that are entirely adequate for bureaucratic organizations to build methodical processes around (which is what bureaucracies do). the capabilities of the underlying tools don’t matter much in this regard. also, audits aren’t meant to prove anything (like security), but instead to shift liability.
    - Jcowell 4y ago
      > ah, the ad hominem, never a good sign for the proceeding argument. GP never says that you’re naive, but the comment was.
      - clairity 4y ago
        either way (intent can also be multi-modal), it signals a triggered response and is entirely superfluous and distracting. it's worth setting that aside, even after writing it, and examining the emotional underpinnings that led to the response in the first place. we learn a lot about our own subconsciousness that way.
tannhaeuser 4y ago
Well HN, how about a badge for links indicating whether it uses ga? We have to start somewhere don't we? Or we'll continue to see the web decline. Actually, from my PoV, it might be too late already. Maybe it's just me or people in EU being harassed with banner popups, but I hardly go to any link anymore, and so do many other people I know. It's just not worth it.
- ronsor 4y ago
  I'm an American, but I occasionally use an EU VPN. I don't understand how EU residents can tolerate the number of cookie/privacy/GDPR/whatever popups every site has, even on the sites of EU companies.
  - deleted 4y ago
    [deleted]
  - iLoveOncall 4y ago
    We don't. Outside of a few greybeards the vast majority of the population would gladly send all of their data including dick pics and credit card numbers to remove those popups. The law was absolutely useless because 99% of the websites have an illegal implementation and still added a major annoyance in the form of the popup / banner.
  - jokethrowaway 4y ago
    We Europeans are generally used to do whatever the government tell us. We don't have the same culture as Americans. Don't get me wrong, you had a pretty bad deal as well: without much fanfare, your government grew up so much in the last 200 years that it became the largest employer in the world. You pay loads of taxes (even more than several EU countries) and get very little benefits. And yet, I'm sure that if we will get to a political solution to the ever-growing cancers that governments are, that solution is more likely to appear in the states than in Europe. Europe is a hopeless - albeit beautiful - land. The people gave up change 50 years ago.
    - tannhaeuser 4y ago
onphonenow 4y ago
At what point do operators just start blocking access from EU countries. It's hard to imagine its worth jumping through all the complexities here at some point.
- panzerboiler 4y ago
  Sure. Block access to 450 millions people because it is inconvenient to respect their privacy.
- phatfish 4y ago
  Bring it on. Anything that disconnects people from the American tech industry and encourages domestic competition is a good thing.
- amitparikh 4y ago
  They already do. Example: https://www.tribpub.com/gdpr/baltimoresun.com/ https://www.tribpub.com/gdpr/baltimoresun.com/
encoderer 4y ago
There is really no reason to use Google Analytics anymore. There are many great alternatives now, mine is PanelBear.com. Other people love Fathom and Plausible. It’s great to see some unbundling happen.
- sixothree 4y ago
  Yeah, it was another one of those trojan horse programs. Offer something incredibly useful to website owners; something so compelling that they literally can't say no. An oh, it just happens to track the activity of every web user anywhere in the world. The alternative offerings at the time were fairly awful compared to what google released.
- scale8 4y ago
  The reason we built Scale8.com - Time to replace Google Analytics and Google Tag Manager :)
- quickthrower2 4y ago
  I also believe (no proof though!) that you don’t need all that micro detail about your users and it is a distraction for a business. A rough “how many came” is useful. At least to diagnose if the site had problems. Just talk to people and make your thing good!
- dx034 4y ago
  I'm still a fan of Matomo. Very powerful, easy to self-host and you get full control over your data. Never tried their managed services though.
zugi 4y ago
I use NoScript and block Google analytics, facebook, etc. It's nice that they use a domain separate from google.com, making it easy to block.
- leephillips 4y ago
  Yes. I have all their analytics and ad network domains blocked in my hosts file.
calibas 4y ago
If I understand this correctly, the issue isn't Google Analytics specifically, but "because it transfers users’ data to the USA, which is a country without an adequate level of data protection". So this could also apply to any company that sends PII to the USA?
- solar-ice 4y ago
  At present, there is no legal basis for a company covered by the GDPR to send personal data to the US or a US-owned company. The US needs to repeal the CLOUD Act, and maybe one or two other things, in order to make this situation work again.
  - minsc_and_boo 4y ago
    Is that for US- or Italian-based users? What if this is an Italian company running a global website with data from non-GDPR country users?
    - jakubp 4y ago
      GDPR covers EU citizens. I don't think it says anything about non-EU citizens.
      - quickthrower2 4y ago
        Which is nebulous: someone whose grandad was Italian living their whole life in the US might be a defacto EU citizen.
        denton-scratch 4y ago
        No such thing as a de facto citizen; a de facto citizen is also known as a refugee.
      - k1w1 4y ago
        There is nothing in the GDPR about citizenship. GDPR applies to "data subjects who are in the Union" Art 3(2). So it is the physical location of the person that matters. As a US citizen, if you travel to an EU country on vacation then the GDPR applies to you while you are there. GDPR also applies to EU based companies for all of their activities - so in addition to limiting US business in the EU, it limits EU businesses in the US.
hbfdhfdhadfhnfa 4y ago
Meanwhile, COVID-19 certificate app for Czech Republic citizen's uses Google Analytics. We are not the same. Good job Italy!
tqi 4y ago
2008-2018: Banking reform 2018-202?: Data privacy I wonder what the next trendy thing government officials will pretend to care about/fix in order to garner media attention. Something crypto related, maybe?
plandis 4y ago
The US should economically retaliate. GDPR and these other regulations in the EU exist because EU cannot stomach the fact that they got beat on tech and instead of innovating they are regulating to try and even the playing field.
- gnuj3 4y ago
  Hmmm, or maybe they exist because EU has a little bit more respect for privacy of its citizens than US?
- Nextgrid 4y ago
  > the fact that they got beat on tech What tech is the EU missing out on? All the recent "tech" I see from the US is all about novel ways to screw & exploit people for profit, at the expense of turning society into a dangerous wasteland full of outrage and saturated by advertising. No thanks.
scale8 4y ago
This is why we built Scale8.com ! An open-source and privacy-friendly alternative to Google Analytics & Google Tag Manager :) GA is simply not compliant... https://scale8.com/blog/is-ga-gdpr-compliant/ https://scale8.com/blog/is-ga-gdpr-compliant/
sylware 4y ago
I don't understand. They can host locally the data and remotely query it. What's important is the "intelligence" the data does provide: giving critical and unfair advantage for those who have the whole data. For instance, microsoft has an unfair advantage almost anywhere because they have access to the whole linkedin database.
- jeroenhd 4y ago
  European companies are not allowed to share PII with American companies. That goes for companies with a headquarters in the USA or subsidiaries that may be forced to share data thanks to laws like the US Cloud Act. Previously, the EU exempted the USA through an "adequacy decision". That was later deemed illegal under EU law as American laws could not guarantee the privacy of EU citizens to the extend the GDPR prescribes. Then the EU tried again, and again such a decision was also overturned in court. The EU is working on another attempt at letting the USA track PII of EU users, but until they do that again (probably for another few years) it's illegal to share PII with American companies in almost all situations. This is the third time a data processing agency has declared the use of Google Analytics illegal so it shouldn't really come as a surprise to those following tech news. What's important is that the data is PII and that it's going to a place that can't guarantee privacy to an acceptable standard. Business advantage is irrelevant. The intelligence the data provides is also irrelevant. European privacy laws serve people, not businesses.
  - sylware 4y ago
    That does not change the issue: EU microsoft has a local unfair advantage in EU because it has access to the whole database of linkedin (which they own). Additionaly, denying remote access is almost impossible to enforce. It would require a efficient and permanent deep monitoring of their servers. linkedin should be illegal since this data should not be privately own.
AdriaanvRossum 4y ago
Regarding forbidden countries, it’s not forbidden in the Netherlands, yet. They will announce a verdict in a form of a report by the end of 2022 [1]. To give people an option and pink something else over Google Analytics, I have built an alternative, Simple Analytics [2]. It doesn’t use cookies or any form of tracking and you get still the useful data that 80% of the website owners need. [1] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [2] https://simpleanalytics.com https://simpleanalytics.com
- jeroenhd 4y ago
  Worth mentioning that DPAs tend to work together to prevent conflicting laws across the EU. Following Austrian, French, and now Italian rulings, it's almost guaranteed that the Dutch authority will come to the same conclusion.
  - AdriaanvRossum 4y ago
    Yes, I think so too.
- apd_ 4y ago
  How do you track "visitors"?
  - AdriaanvRossum 4y ago
    With a referrer, see these docs [1] [1] https://docs.simpleanalytics.com/explained/unique-visits https://docs.simpleanalytics.com/explained/unique-visits
rkagerer 4y ago
These guys are my heros
de6u99er 4y ago
15 years ago Google Analytics was cool. But ar some point Google ditched the "Don't be evil" culture and tried to get as much out of Google Analytics for themselves, that it became unethical. As long as they haven't died ...
sfifs 4y ago
So reading the English text it is not clear what exactly is the unlawful part. Is the fact that data is flowing to US based servers (which I assume is trivially managed by changing GA server location to Europe) or the fact it is flowing to an American Headquartered company, regardless of where the data is flowing to? Can someone comment if the Italian language text is clearer? Or ehat is in the judgement?
- makeitdouble 4y ago
  There’s a bunch of steps, but jumping to the extreme, a foreign gov having access to the data is the awful part. Data flowing to the US violates that, assuming Google US cannot refuse US gov requests, the headquarter having access to the data is also not accepted.
bradgessler 4y ago
I've slowly started ripping Google Analytics out of my Rails projects and replacing it with https://github.com/ankane/ahoy https://github.com/ankane/ahoy. It's so much better! I can just use SQL to see what's going in and not get overwhelmed with 100's of visualizations and complicated dashboards.
- nathan_f77 4y ago
  I use Ahoy too, but I don't have very good visibility into the data. I should spend more time building queries and creating charts. I should probably set up blazer as well: https://github.com/ankane/blazer https://github.com/ankane/blazer It would be really nice if Ahoy came with a web UI that covered all the basics.
  - bradgessler 4y ago
    Agreed. It would be a really great open source project to have a dashboard with all the basics in addition to standard Ahoy event captures.
nathan_f77 4y ago
I'm actually just about to get rid of Google Analytics on DocSpring.com. I set up a self-hosted instance of Plausible Analytics on Render.com yesterday. I really like it so far. I set it up on a custom subdomain so it's not blocked by any ad blockers, so it's really nice to see analytics data that's almost 100% accurate (unless visitors disable JavaScript.) Especially since DocSpring is a developer tool, so most visitors are using an ad blocker extension. Also it doesn't use any cookies, so I don't need to show a cookie banner. It really feels like a breath of fresh air.
freyr 4y ago
I’m supporting of privacy, but it’s amazing how heavy-handed European regulation can be, and how difficult it can make understanding even basic metrics about our business and how those metrics have shifted over time. I suppose their intentions are good though.
- makeitdouble 4y ago
  Suppose you had an internal tracking library, aggragating data fetch from your own site and mobile clients, all data saved in a data center managed by your country's most reliable provider. EU directives would be a no-brainer. That scenario has always been an option, and would be the most common case if Google didn't provide their own service for free or at cost. What's happening with the EU feels disruptive only because Google had such an unatural position in the market.
  - deleted 4y ago
    [deleted]
- realusername 4y ago
  All of that is because of the cloud act, non american companies won't have as much issues. The obvious solution is to remove this spying law breaching EU laws and common sense.
asasidh 4y ago
this is the start of the unbundling of alphabet
ec109685 4y ago
Google needs to do what apple is doing with PrivateRelay and putting double blind proxies in place so PII can be stripped before Google gets its hands on it.
scoutt 4y ago
I wonder what will happen with websites that use payments integration like PayPal or Stripe.
Traubenfuchs 4y ago
Aren‘t there like about 100 google analytics clones available that do exactly the same thing?

Man, wish we’d do that in the US. Not sure what else to insightfully add after all these years.

Time to get off my arse and write a self hosted privacy oriented analytics tool. Whatever happened to awstats. The question is - how to monetise on it?

tick_tock_tick 4y ago

I'd be terrified if I was a EU company at this point. There is not logically way these same rules don't apply to using AWS, GCP, and Azure. There isn't enough other cloud hosting with nearly the same capabilities in Europe to handle that day.

makeitdouble 4y ago
GCP and Azure have options to keep all data within the EU, I'm sure AWS has something to at this point. In France GCP is approved for public business, so it seems to be working fine. On your general point, we're way past the point where a company is allowed to blindly use any random SaaS without caring about what it does with the data or where it goes. The pendulum is clearly swinging back.
- 4ggr0 4y ago
  > GCP and Azure have options to keep all data within the EU I wonder how much of a difference this makes, if the DCs still belong to these american companies and this thing exists: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
  - makeitdouble 4y ago
    GCP made a few adjustments to have something that is compatible with both US laws and the GDPR https://cloud.google.com/blog/products/compliance/how-google-cloud-helps-customers-stay-current-with-gdpr https://cloud.google.com/blog/products/compliance/how-google... From memory, gov entities also have deeper customizations, and data centers might be separate from customers and the standard Google operation altogether.
hef19898 4y ago
There seems to be a difference between "B2C" stuff like ad tech and tracking and "B2B" like AWS. The latter seems to be more eager to be compliant, I assume only to prevent local / regional competitors to fill a gap but still. Plus all the nice public contracts to be had.

aliswe 4y ago

What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?

gruturo 4y ago
This is an English translation from "Garante" which is actually a stronger word - more like Guarantor. It is an official authority with teeth.
- etagate 4y ago
  Exactly. Just to clarify, this is the authority responsible for those multi-million dollars fines against faang
x0x0 4y ago
It's likely a bad translation. The Italian SA is the Italian Data Protection Agency (DPA), one of the per-country European regulators https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm https://ec.europa.eu/justice/article-29/structure/data-prote... . Which acts under the GDPR and predecessor data protection laws, and is very explicitly a governmental regulator.
noneeeed 4y ago
Certainly in UK English we use watchdog to mean any organisation that has an oversight role, frequently government ones. For example the Financial Services Authority might be described as “the banking watchdog”, it is very much a government agency.
chrisseaton 4y ago
Why do you think watchdogs have to be non-governmental? For example: https://www.theguardian.com/technology/2022/may/05/uk-watchdog-will-have-power-to-impose-huge-fines-on-big-tech-firms https://www.theguardian.com/technology/2022/may/05/uk-watchd...

humanistbot 4y ago

From the article: > A website using Google Analytics (GA) without the safeguards set out in the EU GDPR violates data protection law because it transfers users’ data to the USA, which is a country without an adequate level of data protection. > Upon expiry of the 90-day deadline set out in its decision, the Italian SA will check that the data transfers at issue are compliant with the EU GDPR, including by way of ad-hoc inspections. This follows similar decisions by France [1] and Austria [2]. [1] https://iapp.org/news/a/cnil-is-latest-authority-to-rule-google-analytics-violates-gdpr/ https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo... [2] https://iapp.org/news/a/far-reaching-implications-anticipated-with-austrian-dpas-google-analytics-decision/ https://iapp.org/news/a/far-reaching-implications-anticipate...

lmkg 4y ago

This is consistent with decisions from the Austrian and French data protection authorities (DPAs). Note that Google is a Processor (for this product), meaning that Google itself does not violate GDPR, but only the websites that use it. Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any processing that Google does after collection is not considered to offer any protection, because American law enforcement can just tell them not to do that and they won't. Hence, the "Anonymize IP Address" setting in Google Analytics is not considered to have value for GA. It might theoretically be possible to use GA compliantly by proxying data through an EU-owned service which obfuscates anything considered personal data, at minimum the IP address and various cookie values. This scenario hasn't been confirmed by anyone as compliant, but the regulators seem to always go out of their way to dance around it rather than just saying "GA is non-compliant, always, forever." Still, for the trouble to set up such a service you might as well just stand up a self-hosted first-party analytics solution. This particular decision on GA is purely about the cross-border transfers, and doesn't seem to touch on whether using cookies for analytics requires consent. That's a separate issue (technically about a separate law).

V__ 4y ago
> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.
- humanistbot 4y ago
  To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.
  - shadowgovt 4y ago

tin7in 4y ago

We are based in Europe and self-host our analytics exactly for this reason. I feel this is just the beginning.

V__ 4y ago
Are you using a custom sotware or something like plausible.io?
- tin7in 4y ago
  I've heard about Plausible but haven't tried it yet. We are using Posthog which is a suite for product analytics.
  - stevoski 4y ago
    Plausible et al all are a pale imitation of GA. They all offer a dashboard with some basic filtering. But they offer little in the way of true analytics features, that allow you to slice, dice, and compare data.
    - mhitza 4y ago
      I'm working on an web analytics project that gives users more power over the way they slice/dice/compare analytics data. Would you be interested in giving it a try when the project launches in alpha? Send me a hello email at the address listed on my profile, would be happy to send out an invite when ready.
    - quickthrower2 4y ago
      Which is a good thing!
closewith 4y ago
Unfortunately, you can't self-host the integration with Google Ads or Search Console, which locks anyone who relies on Google (or Facebook, Microsoft, etc) Ads into the use of Google Analytics/Ads tracking.

throwawayjun21 4y ago

corywatilo 4y ago

Italy is the 4th in a string of recent decisions across the EU. (We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.) Note that it's not illegal to use GA entirely, just illegal to use in its default state which transmits PII to the US.

stingraycharles 4y ago
That is an extremely important nuance which is not obvious from the title.
- deleted 4y ago
  [deleted]
- tut-urut-utut 4y ago
  Most of the people using GA wouldn't be able to set it up correctly. I switched my personal site from GA to Microanalytics, since I wanted to avoid spending time trying to figure out how to configure GA to be conformant. Google should be the one doing the compliance work. If Italy bans some usage pattern in GA, it's Google that should make it impossible to configure it in non-conformant way.
  - mywittyname 4y ago
    It's not that bad: https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi... The most difficult aspect is dealing with URLs. But a company that is large enough to be customizing URLs per user, is large enough to make a few JS changes to ensure they aren't sending those details to GA.
  - throwaway2037 4y ago
    I agree 100% with your second paragraph. I also hope they introduce massive "percent of revenue" fines when Google "forgets" to ban illegal activity on their (near-monopoly) advertising platform. Massive fines has genuinely changed the behaviour of sales & trading at global investment banks. We can do the same for FAANG and friends.

leephillips 4y ago

Good. US citizens should be, at least, disappointed that their government is so bad at protecting their privacy, that US law is so far behind the times. To those companies and people who find these EU decisions baffling or inconvenient: tough. If you had had respect for your users this would not be an issue. You would already not be spying on them. To website visitors: if you see a cookie banner, the site is asking permission to spy on you. If that concerns you, close the tab.

2OEH8eoCRo0 4y ago
America is the LTS branch of Democracy.
- nix23 4y ago
  More like the bitrotting prototype ;)
  - SkinTaco 4y ago
- feet 4y ago
  I think the support contract ended a while back
- hallway_monitor 4y ago
  Privacy improvements will be pulled in along with independent political parties in the next kernel update.
  - feet 4y ago
    You guys are getting kernel updates? Our supreme court is taking us back to v0.1 from 1800
- baisq 4y ago
  If a modern democracy requires an ever-growing government I think I will stick to Democracy Stable.

ryanmcbride 4y ago

I've been using clicky on a few of my sites and even though they _assure_ me that it's totally compliant with gdpr I don't really believe them, does anyone have a decent alternative for analytics that respects people's privacy? I just want to see when I get new vs returning visitors on a page. Cloudflare's analytics are okay but I like how granular clicky can get, but if there's no good way to do that I think I'm just gonna ditch clicky and make do with the cdn analytics. Hell, I bet the cdn already does everything I need and I just don't know how to use it right, or I'm not paying for the right tier or something.

deleted 4y ago
[deleted]
ClumsyPilot 4y ago
matomo is something you can self host
- solar-ice 4y ago
  There's several self-hosted solutions, as well as several GDPR-compliant SaaS solutions. They generally work pretty well; I've seen people set up, for example, Plausible, in a couple of hours on a cheap VPS.
- tensor 4y ago
  Note that you must make sure that your host is not in the US as well.

tmoneyfish 4y ago

I'm building my own open source analytics solution exactly for this reason.

nwellnhof 4y ago

What's really puzzling is that Google Analytics never got banned because of antitrust laws. It's the most obvious example of predatory pricing I've ever seen. How is a smaller company supposed to compete against a free product?

tantalor 4y ago
Lots of ways? Better features, better support, better performance. If you can't beat the free offering, then go home.
- reaperducer 4y ago
  If you can't beat the free offering, then go home. In the real world of physical goods, there are laws against this. But Google's a tech company, so anything goes.
  - foota 4y ago
    It's not illegal to give things away for free unless it's dumping.
    - reaperducer 4y ago
      It's not illegal to give things away for free unless it's dumping. Which is exactly my point. "[Dumping] occurs when manufacturers export a product... at a price below the normal price with an injuring effect. The objective of dumping is to increase market share in... by driving out competition and thereby create a monopoly situation" https://en.wikipedia.org/wiki/Dumping_(pricing_policy) https://en.wikipedia.org/wiki/Dumping_(pricing_policy) That's exactly what's happening here. Google prices Analytics at $0 to prevent any competition from starting up. While an argument can be made that Google doesn't need to charge money for the product because that cost is made up in other areas, there is no way of knowing that, because those costs are not public. We don't know if it's fully made up by other means, or partially made up by other means, or not at all. Like you, IANAL, but it's my understanding that legally, it's not about the price, it's about the intent.

olalonde 4y ago

I wish GDPR compliance would have been opt-in. For example, a GDPR compliant website could have sent a custom header indicating compliance, which the browser could have displayed in the address bar (a bit like HTTPS). Consumers would then have been free make the decision to not use websites which aren't GDPR compliant. Consumers who are more concerned about privacy could have set their browser to automatically block any non GDPR compliant website.

eropple 4y ago
> Consumers who are more concerned about privacy could have set their browser to automatically block any non GDPR compliant website. It may not be your intent, but defaults matter and what you're wishing for here is de-facto scuttling of the GDPR.
- olalonde 4y ago
  Are you implying that the vast majority of consumers aren't concerned with their privacy and would keep using GDPR-compliant websites? If that's the case, isn't the regulation somewhat against the spirit of democracy?
  - peoplefromibiza 4y ago
    > Are you implying that the vast majority of consumers aren't concerned with their privacy and would keep using GDPR-compliant websites? False premise. Users simply aren't aware, but once they learn about it, they become concerned, > If that's the case, isn't the regulation somewhat against the spirit of democracy? That's a really weird argument. Anyway, that's not the case.
closewith 4y ago
Bizarre idea. Should websites be allowed to opt out of anti-fraud legislation? Anti-money laundering? Human rights protections?
- olalonde 4y ago

mrkramer 4y ago

Google is sucking in so much data that at the end it will be outlawed everywhere.

reaperducer 4y ago

The last time I checked, the Google Analytics' Terms of Service explicitly prohibited its use on web sites involving healthcare companies. That gives you an indication of how invasive it is — that even Google doesn't want to handle the personal information, because it can't be made HIPAA-safe. Naturally, the majority of healthcare web sites use Google Analytics, because nobody ever reads the Terms of Service.

paulcole 4y ago
> The last time I checked, the Google Analytics' Terms of Service explicitly prohibited its use on web sites involving healthcare companies. You're missing a key part of the sentence you're remembering: > If you are (or become) a Covered Entity or Business Associate under HIPAA, you may not use Google Analytics for any purpose or in any manner involving Protected Health Information unless you have received prior written consent to such use from Google. Healthcare companies can absolutely use GA on their websites as long as the website isn't involving PHI or ePHI.

cardosof 4y ago

Hindsight is 20/20 but wasn't it clear that the company selling ads shouldn't be in charge of metrics for traffic and ads? Just like the TV channels had to rely on media rating firms.

badkitty99 4y ago
youngtaff 4y ago
Not sure an ad company should he in charge of a browser either
- cardosof 4y ago
  Oh and don't forget a major OS

openplatypus 4y ago

While I should be happy with narrative (I run https://wideangle.co https://wideangle.co, GA alternative), let's be honest. It not banned. Nor is it illegal. It is illegal to use it in such a way that results in Personal Data being siphoned to the US. Is it hard? Yes. Outright illegal? Nah.

dx034 4y ago
But it's enough of a hurdle that many website owners may just decide to go with a EU-based competitor. Certainly a good ruling for the EU tech scene.
stevoski 4y ago
It is good to see a GA competitor not resort to FUD as a marketing tool.

current_thing 4y ago

ottime notizie. vietare google e monetizzare le bellissime spiagge, e mangiare pasta autentica.

nonsapreiche 4y ago
e w la fica
- ciarcode 4y ago
  You do maybe
ciarcode 4y ago
I don’t think you’re really Italian ahahah

dclusin 4y ago

Suppose I run a website in the us and a user in Italy connects to it. Does this mean I’m now breaking the law serving them the website? My connection logs now have pii. What if I use a cdn that has points of presence in Italy and still pings my server with a head request and the end user ip? Am I also now breaking Italian law by using google analytics?

kmlx 4y ago
https://en.m.wikipedia.org/wiki/HTTP_451 https://en.m.wikipedia.org/wiki/HTTP_451 > After introduction of the GDPR in EEA it became common practice for websites located outside EEA to serve HTTP 451 errors to EEA visitors instead of trying to comply with this new privacy law. For instance, many regional U.S. news sites no longer serve web browsers from the EU.
- Nicksil 4y ago
  https://en.wikipedia.org/wiki/HTTP_451 https://en.wikipedia.org/wiki/HTTP_451
peoplefromibiza 4y ago
> Does this mean I’m now breaking the law serving them the website? As the article specifically states: The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. This information was found to be transferred to the USA. In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds. So, unless you are collecting EU citizens user data, transferring it to US and have the capabilities to enrich such data through additional information you hold, no.
curiousllama 4y ago
IIRC, it basically only applies if you're actively doing business in the EU, or courting future business. So, if you have a personal blog that grabs IPs? Not illegal. If you start a merch shop for your blog (or put in ads/sponsored content, etc.), then the whole site needs to be GDPR compliant.

iLoveOncall 4y ago

Those decisions are good in theory, but in practice they will kill the free web. The only people that have the work power to put equivalent alternatives in place are the big corporations, that will anyway find a loophole. I run my small blog, and I can't spend days or even weeks to setup a subpar analytics solution. I won't even start talking about self-hosting an analytics solution which would probably double my monthly server cost for a website on which I earn 0€. In 2030, if we continue on that trend, websites will be in two categories: belonging to huge companies, or running illegally. It's baffling that people are applauding the end of the free web.

freeone3000 4y ago
Why does your small blog need an "analytics solution" in the first place, if you earn $0?
- iLoveOncall 4y ago
  Because I want to know where my readers come from, which Google terms they searched, etc.? There's a million reasons to want to know stats like this without earning money...
  - stevoski 4y ago
    > which Google terms they searched, etc. GA doesn't tell you which terms they searched. They mostly stopped doing this in 2013. Google Search Console _does_ tell you the search terms, and without any tracking on your website.
  - progman32 4y ago
    As a user, I don't want to give this info. I'm glad the EU is giving folks an avenue to express this preference.
    - iLoveOncall 4y ago
      I provide free tutorials and articles like this. If you don't want to provide this info then I don't want to provide you free content.

takethat 4y ago

anyone runs self hosted matomo/piwik instance for analytics?

cm2012 4y ago

Another decision in a long stream that will make it much harder for EU start-ups companies to catch up to American ones. With absolutely no improvements to actual EU citizen well being.

redleather 4y ago
That's assuming a European GDPR-compliant alternative to Google analytics wouldn't arise. But of course it will. It's not even a very difficult product to build. If anything this is both sticking it to Google and creating opportunities for European startups to fill the void.
nathanaldensr 4y ago
Maybe a race where the finish line is maximum exploitation of the digital population isn't a race worth running.
- iLoveOncall 4y ago
  - waffleiron 4y ago
    So lets legalise child labour? Get rid of OSHA? Where you draw the line is cultural and personal, so don’t dismiss things like this so easily.
- RubyRidgeRandy 4y ago
  here I thought maximum exploitation would be selling someones identity on the dark web but I come to find on HN that it's actually hashed analytics data D: !!!
  - MarcelOlsz 4y ago
    I wish the internet was purely an informational no bullshit interface/store instead of all this crap. I welcome these changes. Convert it back into a piece of furniture. Oh no we can't make a billion dollars for no reason.

louhike 4y ago

The CNIL in France is really pushing companies to not use Google Analytics, and you better listen to them here. It seems US companies should really make changes to how they host/manage data to be able to able to work in EU in the near future. (It isn’t a criticism, simply an assesment).

f1refly 4y ago
There's nothing US companies can do to make themselfes legal to use here. The legal framework in the US allows dragnet spying on every non-american and american companies are forced to participate in that effort.
- jeroenhd 4y ago
  They're perfectly legal if they don't process any PII. If a US company serves static content there's no need to fear the EU; they'll just have to disable illegal external integrations like Google Analytics/Fonts/etc. A company doing business with other companies might find themselves in a position where they can comply perfectly. Not every company needs to collect PII, though these days every company likes to pretend they do.
  - IX-103 4y ago
    When PII includes IP addresses it's kind of hard not to process. How else are you supposed to group metrics over a session (since cookies are also forbidden)? This seems to ban third-party analytics by any US company. The cynic in me feels this is a little convenient in how it advantages EU organizations over foreign ones...
    - koyote 4y ago
      Do you have a source on PII including IP addresses?
      - tylerrobinson 4y ago

la64710 4y ago

This kind of ridiculous laws do not understand the boundless nature of internet. If you want to protect privacy of netizens simply make a universal law instead of having different laws in different countries.

IncRnd 4y ago
How does one "simply make a universal law"?
- la64710 4y ago
  By publishing a RFC.
  - IncRnd 4y ago
    An RFC won't compel people or companies in the way you hope. An RFC is a request and nothing more. A law is driven by the legal authority of a state and is backed by corporate & financial penalties, prisons, and guns.
tgv 4y ago
I’m afraid it does understand the boundless nature of the internet, and it wants the owner of the server to do something about it.
adfm 4y ago
Since the Internet is not a fiefdom, universal law is moot. Nation states will draft tracking laws that are only only enforceable through tracking in an attempt to gain their slice of authoritarian pie. Pointing to the Google or US is typical strawman BS and gives people a false sense of security because they should assume everyone, not just the Google, is tracking them. Getting people to own their data is an uphill climb, but is ultimately what will curb the negative behavior we're witnessing.
- la64710 4y ago
  We need a RFC for protecting the internet.

naet 4y ago

As more and more country specific legal regulations are raised, I wonder who will be the ultimate gatekeepers of the general internet when certain actors behave against the "rules". The current landscape is a complex system of seeming contradictions straddling different levels of public and private, centralized and decentralized, anarchical and moderated, etc. Will ISPs be forced to cut off traffic from certain areas? Will centralized companies like Google and Reddit be forced to comply with regulations or cut off services in certain areas? Will governments set up firewalls? Will the buck of responsibility be passed upwards to service providers like GA, or downwards to individual site administrators?

UncleEntity 4y ago
Nah, they’ll just slap them with a fine now again as a substitute for direct taxation and let them do what they do basically unchanged. Once the Europeans have to use a foreign proxy to see the regular internet, like the Chinese, then we will have a real discussion on online privacy.
- djbebs 4y ago
  We already do.
- djbebs 4y ago
  Have you tried to go to rt.com hany time recently?
  - aembleton 4y ago
    Still works for me from the UK

clairity 4y ago

i’d support any legislation that booted google, fb, ms, adobe, salesforce, and a whole host of other surveillance tech companies from any and all levels of government. it’s literally as important as the separation of church and state. in fact, i’d love to see a constitutional amendment explicitly separating corporate interests from governmental ones, in all facets of civic life (e.g., campaign finance).

abarwick 4y ago
This is just naive. Government offices/agencies are so tightly coupled with packages like office 365 that forcefully separating them would require home built solutions which would always be terrible, less secure, and more expensive to the tax payer. There’s a lot of good these products can provide, granted they are properly audited and have high security requirements.
- clairity 4y ago
  ah, the ad hominem, never a good sign for the proceeding argument. there are a number of other office suites that are entirely adequate for bureaucratic organizations to build methodical processes around (which is what bureaucracies do). the capabilities of the underlying tools don’t matter much in this regard. also, audits aren’t meant to prove anything (like security), but instead to shift liability.
  - Jcowell 4y ago
    > ah, the ad hominem, never a good sign for the proceeding argument. GP never says that you’re naive, but the comment was.
    - clairity 4y ago
      either way (intent can also be multi-modal), it signals a triggered response and is entirely superfluous and distracting. it's worth setting that aside, even after writing it, and examining the emotional underpinnings that led to the response in the first place. we learn a lot about our own subconsciousness that way.

tannhaeuser 4y ago

Well HN, how about a badge for links indicating whether it uses ga? We have to start somewhere don't we? Or we'll continue to see the web decline. Actually, from my PoV, it might be too late already. Maybe it's just me or people in EU being harassed with banner popups, but I hardly go to any link anymore, and so do many other people I know. It's just not worth it.

ronsor 4y ago
I'm an American, but I occasionally use an EU VPN. I don't understand how EU residents can tolerate the number of cookie/privacy/GDPR/whatever popups every site has, even on the sites of EU companies.
- deleted 4y ago
  [deleted]
- iLoveOncall 4y ago
  We don't. Outside of a few greybeards the vast majority of the population would gladly send all of their data including dick pics and credit card numbers to remove those popups. The law was absolutely useless because 99% of the websites have an illegal implementation and still added a major annoyance in the form of the popup / banner.
- jokethrowaway 4y ago
  We Europeans are generally used to do whatever the government tell us. We don't have the same culture as Americans. Don't get me wrong, you had a pretty bad deal as well: without much fanfare, your government grew up so much in the last 200 years that it became the largest employer in the world. You pay loads of taxes (even more than several EU countries) and get very little benefits. And yet, I'm sure that if we will get to a political solution to the ever-growing cancers that governments are, that solution is more likely to appear in the states than in Europe. Europe is a hopeless - albeit beautiful - land. The people gave up change 50 years ago.
  - tannhaeuser 4y ago

onphonenow 4y ago

At what point do operators just start blocking access from EU countries. It's hard to imagine its worth jumping through all the complexities here at some point.

panzerboiler 4y ago
Sure. Block access to 450 millions people because it is inconvenient to respect their privacy.
phatfish 4y ago
Bring it on. Anything that disconnects people from the American tech industry and encourages domestic competition is a good thing.
amitparikh 4y ago
They already do. Example: https://www.tribpub.com/gdpr/baltimoresun.com/ https://www.tribpub.com/gdpr/baltimoresun.com/

encoderer 4y ago

There is really no reason to use Google Analytics anymore. There are many great alternatives now, mine is PanelBear.com. Other people love Fathom and Plausible. It’s great to see some unbundling happen.

sixothree 4y ago
Yeah, it was another one of those trojan horse programs. Offer something incredibly useful to website owners; something so compelling that they literally can't say no. An oh, it just happens to track the activity of every web user anywhere in the world. The alternative offerings at the time were fairly awful compared to what google released.
scale8 4y ago
The reason we built Scale8.com - Time to replace Google Analytics and Google Tag Manager :)
quickthrower2 4y ago
I also believe (no proof though!) that you don’t need all that micro detail about your users and it is a distraction for a business. A rough “how many came” is useful. At least to diagnose if the site had problems. Just talk to people and make your thing good!
dx034 4y ago
I'm still a fan of Matomo. Very powerful, easy to self-host and you get full control over your data. Never tried their managed services though.

zugi 4y ago

I use NoScript and block Google analytics, facebook, etc. It's nice that they use a domain separate from google.com, making it easy to block.

leephillips 4y ago
Yes. I have all their analytics and ad network domains blocked in my hosts file.

calibas 4y ago

If I understand this correctly, the issue isn't Google Analytics specifically, but "because it transfers users’ data to the USA, which is a country without an adequate level of data protection". So this could also apply to any company that sends PII to the USA?

solar-ice 4y ago
At present, there is no legal basis for a company covered by the GDPR to send personal data to the US or a US-owned company. The US needs to repeal the CLOUD Act, and maybe one or two other things, in order to make this situation work again.
- minsc_and_boo 4y ago
  Is that for US- or Italian-based users? What if this is an Italian company running a global website with data from non-GDPR country users?
  - jakubp 4y ago
    GDPR covers EU citizens. I don't think it says anything about non-EU citizens.
    - quickthrower2 4y ago
      Which is nebulous: someone whose grandad was Italian living their whole life in the US might be a defacto EU citizen.
      - denton-scratch 4y ago
        No such thing as a de facto citizen; a de facto citizen is also known as a refugee.
    - k1w1 4y ago
      There is nothing in the GDPR about citizenship. GDPR applies to "data subjects who are in the Union" Art 3(2). So it is the physical location of the person that matters. As a US citizen, if you travel to an EU country on vacation then the GDPR applies to you while you are there. GDPR also applies to EU based companies for all of their activities - so in addition to limiting US business in the EU, it limits EU businesses in the US.

hbfdhfdhadfhnfa 4y ago

Meanwhile, COVID-19 certificate app for Czech Republic citizen's uses Google Analytics. We are not the same. Good job Italy!

tqi 4y ago

2008-2018: Banking reform 2018-202?: Data privacy I wonder what the next trendy thing government officials will pretend to care about/fix in order to garner media attention. Something crypto related, maybe?

plandis 4y ago

The US should economically retaliate. GDPR and these other regulations in the EU exist because EU cannot stomach the fact that they got beat on tech and instead of innovating they are regulating to try and even the playing field.

gnuj3 4y ago
Hmmm, or maybe they exist because EU has a little bit more respect for privacy of its citizens than US?
Nextgrid 4y ago
> the fact that they got beat on tech What tech is the EU missing out on? All the recent "tech" I see from the US is all about novel ways to screw & exploit people for profit, at the expense of turning society into a dangerous wasteland full of outrage and saturated by advertising. No thanks.

scale8 4y ago

This is why we built Scale8.com ! An open-source and privacy-friendly alternative to Google Analytics & Google Tag Manager :) GA is simply not compliant... https://scale8.com/blog/is-ga-gdpr-compliant/ https://scale8.com/blog/is-ga-gdpr-compliant/

sylware 4y ago

I don't understand. They can host locally the data and remotely query it. What's important is the "intelligence" the data does provide: giving critical and unfair advantage for those who have the whole data. For instance, microsoft has an unfair advantage almost anywhere because they have access to the whole linkedin database.

jeroenhd 4y ago
European companies are not allowed to share PII with American companies. That goes for companies with a headquarters in the USA or subsidiaries that may be forced to share data thanks to laws like the US Cloud Act. Previously, the EU exempted the USA through an "adequacy decision". That was later deemed illegal under EU law as American laws could not guarantee the privacy of EU citizens to the extend the GDPR prescribes. Then the EU tried again, and again such a decision was also overturned in court. The EU is working on another attempt at letting the USA track PII of EU users, but until they do that again (probably for another few years) it's illegal to share PII with American companies in almost all situations. This is the third time a data processing agency has declared the use of Google Analytics illegal so it shouldn't really come as a surprise to those following tech news. What's important is that the data is PII and that it's going to a place that can't guarantee privacy to an acceptable standard. Business advantage is irrelevant. The intelligence the data provides is also irrelevant. European privacy laws serve people, not businesses.
- sylware 4y ago
  That does not change the issue: EU microsoft has a local unfair advantage in EU because it has access to the whole database of linkedin (which they own). Additionaly, denying remote access is almost impossible to enforce. It would require a efficient and permanent deep monitoring of their servers. linkedin should be illegal since this data should not be privately own.

AdriaanvRossum 4y ago

Regarding forbidden countries, it’s not forbidden in the Netherlands, yet. They will announce a verdict in a form of a report by the end of 2022 [1]. To give people an option and pink something else over Google Analytics, I have built an alternative, Simple Analytics [2]. It doesn’t use cookies or any form of tracking and you get still the useful data that 80% of the website owners need. [1] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [2] https://simpleanalytics.com https://simpleanalytics.com

jeroenhd 4y ago
Worth mentioning that DPAs tend to work together to prevent conflicting laws across the EU. Following Austrian, French, and now Italian rulings, it's almost guaranteed that the Dutch authority will come to the same conclusion.
- AdriaanvRossum 4y ago
  Yes, I think so too.
apd_ 4y ago
How do you track "visitors"?
- AdriaanvRossum 4y ago
  With a referrer, see these docs [1] [1] https://docs.simpleanalytics.com/explained/unique-visits https://docs.simpleanalytics.com/explained/unique-visits

rkagerer 4y ago

These guys are my heros

de6u99er 4y ago

15 years ago Google Analytics was cool. But ar some point Google ditched the "Don't be evil" culture and tried to get as much out of Google Analytics for themselves, that it became unethical. As long as they haven't died ...

sfifs 4y ago

So reading the English text it is not clear what exactly is the unlawful part. Is the fact that data is flowing to US based servers (which I assume is trivially managed by changing GA server location to Europe) or the fact it is flowing to an American Headquartered company, regardless of where the data is flowing to? Can someone comment if the Italian language text is clearer? Or ehat is in the judgement?

makeitdouble 4y ago
There’s a bunch of steps, but jumping to the extreme, a foreign gov having access to the data is the awful part. Data flowing to the US violates that, assuming Google US cannot refuse US gov requests, the headquarter having access to the data is also not accepted.

bradgessler 4y ago

I've slowly started ripping Google Analytics out of my Rails projects and replacing it with https://github.com/ankane/ahoy https://github.com/ankane/ahoy. It's so much better! I can just use SQL to see what's going in and not get overwhelmed with 100's of visualizations and complicated dashboards.

nathan_f77 4y ago
I use Ahoy too, but I don't have very good visibility into the data. I should spend more time building queries and creating charts. I should probably set up blazer as well: https://github.com/ankane/blazer https://github.com/ankane/blazer It would be really nice if Ahoy came with a web UI that covered all the basics.
- bradgessler 4y ago
  Agreed. It would be a really great open source project to have a dashboard with all the basics in addition to standard Ahoy event captures.

nathan_f77 4y ago

I'm actually just about to get rid of Google Analytics on DocSpring.com. I set up a self-hosted instance of Plausible Analytics on Render.com yesterday. I really like it so far. I set it up on a custom subdomain so it's not blocked by any ad blockers, so it's really nice to see analytics data that's almost 100% accurate (unless visitors disable JavaScript.) Especially since DocSpring is a developer tool, so most visitors are using an ad blocker extension. Also it doesn't use any cookies, so I don't need to show a cookie banner. It really feels like a breath of fresh air.

freyr 4y ago

I’m supporting of privacy, but it’s amazing how heavy-handed European regulation can be, and how difficult it can make understanding even basic metrics about our business and how those metrics have shifted over time. I suppose their intentions are good though.

makeitdouble 4y ago
Suppose you had an internal tracking library, aggragating data fetch from your own site and mobile clients, all data saved in a data center managed by your country's most reliable provider. EU directives would be a no-brainer. That scenario has always been an option, and would be the most common case if Google didn't provide their own service for free or at cost. What's happening with the EU feels disruptive only because Google had such an unatural position in the market.
- deleted 4y ago
  [deleted]
realusername 4y ago
All of that is because of the cloud act, non american companies won't have as much issues. The obvious solution is to remove this spying law breaching EU laws and common sense.

asasidh 4y ago

this is the start of the unbundling of alphabet

ec109685 4y ago

Google needs to do what apple is doing with PrivateRelay and putting double blind proxies in place so PII can be stripped before Google gets its hands on it.

scoutt 4y ago

I wonder what will happen with websites that use payments integration like PayPal or Stripe.

Traubenfuchs 4y ago

Aren‘t there like about 100 google analytics clones available that do exactly the same thing?