5 ms·

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact t

by V__ 4y ago

> meaning that Google itself does not violate GDPR, but only the websites that use it. This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.

humanistbot 4y ago
To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.
- shadowgovt 4y ago
  Building out the infrastructure necessary for Cloud to be compliant with region-stored data was a multi-year project. Huge swathes of Google's architecture (especially its legacy architecture) have deeply-ingrained location-agnosticism assumptions. It turns out to be extremely complex and expensive to remove those assumptions given the way Google handles data once it hits their datacenter fabric. (Not impossible, mind, just that this assertion that it wouldn't be that hard to do is in "I could build Twitter in a weekend" territory).
  - robin_reala 4y ago
    It’s coming up to a decade since Schrems I, six years since GDPR, and four years since enforcement of GDPR. For a company like Google the writing has been on the wall for a lot longer than a weekend. They’ve simply been gambling that they can get away with it, and now that argument is collapsing.
    - shadowgovt 4y ago
      Oh, no doubt. They've 100% been gambling that they could get away with it. The GDPR has deviated increasingly from what their leadership assumed would be a reasonable position (it continues to drift from the American centroid belief on who owns what data; for Americans, the notion that you can use other people's computers without them keeping records of how you used their computers is kinda weird, and Americans lack the direct historical experience to have the kinds of concerns about mass-citizen-tracking that Europe does). My prediction is that as things move forward, they're going to find it isn't worth their money to offer Analytics for European customers if the GDPR continues to make that more onerous (especially since the monetization story of Analytics for Google is so threadbare) and just offer it for customers in other countries while Europe does its own thing. Win-win.
- MrQuimico 4y ago
  The problem is not only the geo location of the datacenters. As long as these subsidiaries are under the control of a USA corporation, this is illegal, since the USA corporation can be requested by the USA gov to share any data they may have not matter where it's stored. Only options are a 100% GDPR compliant solution (European or from a country with similar laws) or self-host. Hopefully another Privacy Shield like agreement will be in place soon.
  - ClumsyPilot 4y ago
    > another Privacy Shield its real name should have been privacy hole
- dylan604 4y ago
  It wouldn't be hard for Googs to do this on their own so that they comply with the rules/laws in the markets they are operating vs giving it to the end user as an option in the configs. Most people using GA probably wouldn't know what any of that meant anyways. They just want the numbers so their marketing people can tell them what to do next. I'm talking the people running sites on Wix type sites vs having an actual dev team that can push back against a marketing department
- gostsamo 4y ago
  No, they can't as far as I get it. The american cloud act entitles US law enforcement to serve orders to US companies and their foreign branches. So, if you are american with a company in the EU, the important part is that you are an american, not that the company is in a foreign jurisdiction.
  - tempestn 4y ago
    Perhaps Google could license a third party in the EU to host analytics for EU customers?
    - gostsamo 4y ago
      This is an option. I saw somewhere a news that they might license the entire GCloud to a French provider but I can't remember where and when.
      - ohand 4y ago
        You're remembering this announcement from last fall: https://www.thalesgroup.com/en/group/investors/press_release/thales-and-google-cloud-announce-strategic-partnership-jointly https://www.thalesgroup.com/en/group/investors/press_release...
  - closewith 4y ago
    Yes, specifically the CLOUD (Clarifying Lawful Overseas Use of Data) Act, which was enacted following a case in 2014 where Microsoft refused to hand over emails stored in the EU (Ireland, in that case) on foot of a domestic US warrant. The CLOUD Act expressly brings data stored by US-based companies anywhere in the world under the purview of US warrants and subpoenas. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- nisegami 4y ago
  It really makes no difference where the data is stored once it's accessible by a US company: "The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil." from https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- openplatypus 4y ago
  As mentioned by other commentators, this is not enough. Schrems II ruling exposed the risk here. If servers are in EU but are undereffective control (even via proxy) of country with inadequate control (US, RU, CN), then you can't use data location as argument.
leephillips 4y ago
I don’t find it idiotic. It was the client’s decision to spy on its users. I have no sympathy for companies who make that decision.
- V__ 4y ago
  > It was the client’s decision to spy on its users. Calling it spying is a little far-fetched I think, when the problem was the transfer ip addresses to US servers, not Analytics itself.
  - leephillips 4y ago
    Like most people, I have an IP that is unique to me, and will be for weeks, maybe months, until some event causes my ISP to assign me a new one. Google can track and correlate my activity across all the websites that I visit that happen to use GA. In this way they can build a profile. If I used Gmail, they could include information from the content of my email, which they admit their computers examine. With enough data it would be a simple matter to detect when my IP changed, and continue to amass the profile. If this isn’t spying, then nothing is.
    - V__ 4y ago
      Oh, I think I wasn't clear. I meant saying that the client is deciding to spy is a bit far-fetched. Google of course.
- rattlesnakedave 4y ago
  It was the client’s decision to use the service.
  - leephillips 4y ago
    Which is a decision to spy on the users.
- pessimizer 4y ago
  Why do you have to be sympathetic to the client in order to also condemn Google? If someone was selling bleach as a cure for autism through a network of distributors, do you have to be sympathetic to the distributors in order to condemn the manufacturer?
gretch 4y ago
What about Italian websites that serve customers outside of Italy?
- V__ 4y ago
  If they serve customers outside the EU, then they should comply with those laws or not serve them at all.

by V__ 4y ago

humanistbot 4y ago

To be compliant, Google can just set up data centers specific to GA in one of those EU subsidiaries, so GA admins can choose to have their visitors' data stored only in an EU data center (and promise to not transfer that data to the US). This wouldn't be that hard to do.

shadowgovt 4y ago
Building out the infrastructure necessary for Cloud to be compliant with region-stored data was a multi-year project. Huge swathes of Google's architecture (especially its legacy architecture) have deeply-ingrained location-agnosticism assumptions. It turns out to be extremely complex and expensive to remove those assumptions given the way Google handles data once it hits their datacenter fabric. (Not impossible, mind, just that this assertion that it wouldn't be that hard to do is in "I could build Twitter in a weekend" territory).
- robin_reala 4y ago
  It’s coming up to a decade since Schrems I, six years since GDPR, and four years since enforcement of GDPR. For a company like Google the writing has been on the wall for a lot longer than a weekend. They’ve simply been gambling that they can get away with it, and now that argument is collapsing.
  - shadowgovt 4y ago
    Oh, no doubt. They've 100% been gambling that they could get away with it. The GDPR has deviated increasingly from what their leadership assumed would be a reasonable position (it continues to drift from the American centroid belief on who owns what data; for Americans, the notion that you can use other people's computers without them keeping records of how you used their computers is kinda weird, and Americans lack the direct historical experience to have the kinds of concerns about mass-citizen-tracking that Europe does). My prediction is that as things move forward, they're going to find it isn't worth their money to offer Analytics for European customers if the GDPR continues to make that more onerous (especially since the monetization story of Analytics for Google is so threadbare) and just offer it for customers in other countries while Europe does its own thing. Win-win.
MrQuimico 4y ago
The problem is not only the geo location of the datacenters. As long as these subsidiaries are under the control of a USA corporation, this is illegal, since the USA corporation can be requested by the USA gov to share any data they may have not matter where it's stored. Only options are a 100% GDPR compliant solution (European or from a country with similar laws) or self-host. Hopefully another Privacy Shield like agreement will be in place soon.
- ClumsyPilot 4y ago
  > another Privacy Shield its real name should have been privacy hole
dylan604 4y ago
It wouldn't be hard for Googs to do this on their own so that they comply with the rules/laws in the markets they are operating vs giving it to the end user as an option in the configs. Most people using GA probably wouldn't know what any of that meant anyways. They just want the numbers so their marketing people can tell them what to do next. I'm talking the people running sites on Wix type sites vs having an actual dev team that can push back against a marketing department
gostsamo 4y ago
No, they can't as far as I get it. The american cloud act entitles US law enforcement to serve orders to US companies and their foreign branches. So, if you are american with a company in the EU, the important part is that you are an american, not that the company is in a foreign jurisdiction.
- tempestn 4y ago
  Perhaps Google could license a third party in the EU to host analytics for EU customers?
  - gostsamo 4y ago
    This is an option. I saw somewhere a news that they might license the entire GCloud to a French provider but I can't remember where and when.
    - ohand 4y ago
      You're remembering this announcement from last fall: https://www.thalesgroup.com/en/group/investors/press_release/thales-and-google-cloud-announce-strategic-partnership-jointly https://www.thalesgroup.com/en/group/investors/press_release...
- closewith 4y ago
  Yes, specifically the CLOUD (Clarifying Lawful Overseas Use of Data) Act, which was enacted following a case in 2014 where Microsoft refused to hand over emails stored in the EU (Ireland, in that case) on foot of a domestic US warrant. The CLOUD Act expressly brings data stored by US-based companies anywhere in the world under the purview of US warrants and subpoenas. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
nisegami 4y ago
It really makes no difference where the data is stored once it's accessible by a US company: "The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil." from https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
openplatypus 4y ago
As mentioned by other commentators, this is not enough. Schrems II ruling exposed the risk here. If servers are in EU but are undereffective control (even via proxy) of country with inadequate control (US, RU, CN), then you can't use data location as argument.

leephillips 4y ago

I don’t find it idiotic. It was the client’s decision to spy on its users. I have no sympathy for companies who make that decision.

V__ 4y ago
> It was the client’s decision to spy on its users. Calling it spying is a little far-fetched I think, when the problem was the transfer ip addresses to US servers, not Analytics itself.
- leephillips 4y ago
  Like most people, I have an IP that is unique to me, and will be for weeks, maybe months, until some event causes my ISP to assign me a new one. Google can track and correlate my activity across all the websites that I visit that happen to use GA. In this way they can build a profile. If I used Gmail, they could include information from the content of my email, which they admit their computers examine. With enough data it would be a simple matter to detect when my IP changed, and continue to amass the profile. If this isn’t spying, then nothing is.
  - V__ 4y ago
    Oh, I think I wasn't clear. I meant saying that the client is deciding to spy is a bit far-fetched. Google of course.
rattlesnakedave 4y ago
It was the client’s decision to use the service.
- leephillips 4y ago
  Which is a decision to spy on the users.
pessimizer 4y ago
Why do you have to be sympathetic to the client in order to also condemn Google? If someone was selling bleach as a cure for autism through a network of distributors, do you have to be sympathetic to the distributors in order to condemn the manufacturer?

gretch 4y ago

What about Italian websites that serve customers outside of Italy?

V__ 4y ago
If they serve customers outside the EU, then they should comply with those laws or not serve them at all.