9 ms·

Italy is the 4th in a string of recent decisions across the EU. (We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.) Note

Italy is the 4th in a string of recent decisions across the EU. (We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.) Note that it's not illegal to use GA entirely, just illegal to use in its default state which transmits PII to the US.

stingraycharles 4y ago
That is an extremely important nuance which is not obvious from the title.
- deleted 4y ago
  [deleted]
- tut-urut-utut 4y ago
  Most of the people using GA wouldn't be able to set it up correctly. I switched my personal site from GA to Microanalytics, since I wanted to avoid spending time trying to figure out how to configure GA to be conformant. Google should be the one doing the compliance work. If Italy bans some usage pattern in GA, it's Google that should make it impossible to configure it in non-conformant way.
  - mywittyname 4y ago
    It's not that bad: https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi... The most difficult aspect is dealing with URLs. But a company that is large enough to be customizing URLs per user, is large enough to make a few JS changes to ensure they aren't sending those details to GA.
  - throwaway2037 4y ago
    I agree 100% with your second paragraph. I also hope they introduce massive "percent of revenue" fines when Google "forgets" to ban illegal activity on their (near-monopoly) advertising platform. Massive fines has genuinely changed the behaviour of sales & trading at global investment banks. We can do the same for FAANG and friends.
lmkg 4y ago
> just illegal to use in its default state which transmits PII to the US As I mentioned in a sibling comment, this is technically true but complying with GDPR takes more than unchecking a few boxes. I've never seen any GA set-up that would remotely approach compliance. At minimum, you need to mask IP's before they reach Google, which means standing up a non-Google server to proxy all the hits. That is more complexity than 99+% of GA installations.
- closewith 4y ago
  That’s a very common implementation of serverside GTM/GA in the EU. If you advertise, you’ll still be sending GCLIDs, though.
  - Nextgrid 4y ago
    If only ad clicks send back tracking parameters (and nothing else) it might actually fall into legitimate interest.
    - closewith 4y ago
      The current issue isn't the lawful basis for the processing, as compliant companies already only use Google Analytics once they have consent. The issue is that without an adequacy decision from the EU to allow data transfers to the US, and with the global reach of US authorities thanks to the CLOUD Act, there's no way to keep personal data safe from US law enforcement.
- naet 4y ago
  My current understanding of google analytics and GDPR compliance is that you can use it in a GDPR compliant manner without that much trouble. On the older UA there is a simple flag that enables IP anonymization and on the new GA4 there is purportedly no need for it as they don't collect or store the IP at all. For many clients I have set up a cookie compliance tool like Onetrust, which blocks loading of GA and other scripts with one of the consent popups. With this combined configuration (and having verified nothing sneaks through before someone gives consent) most company legal / compliance teams I have worked with have deemed this to be a fully compliant setup. Of course, this might not be actually compliant, but the company legal team has done some research and arrived at this as the most advantageous position currently available. I think using a compliance based tool like Onetrust also gives a sense of legal security in that if our configuration is properly set up they are advertising that we then get compliance as part of their service, and so responsibility of a violation could potentially be passed to them in a legal setting. ref: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
mro_name 4y ago
yeah, like 'swimming pools only bear a danger of drowning when wet'.
- rightbyte 4y ago
  Empty pools are probably more dangerous.
  - Forge36 4y ago
    I hear they attract skaters.
    - rightbyte 4y ago
      Those pools don't have sharp drops and are rather safe I guess. I wonder if that is the reason some pools are built like that ...
- hnarn 4y ago
  That analogy makes no sense at all.
digitalengineer 4y ago
Some time ago Google gave EU admins the option to select a local regional (EU) server. This means the data is not send to the US. But! It’s still nog fully legal as the Google HQ (and thus the US government( can still access all the data.
- y42 4y ago
  Like Adobe, who uses tracking servers in the EU, but Data Processing happens in the US?
- googlryas 4y ago
  Why is that not fully legal? Wouldn't the same law prevent Google USA from querying PII data from Google Italia?
  - marcosdumay 4y ago
    Italian laws do not apply to Google USA.
    - googlryas 4y ago
      Not generally, but they do apply to Google Italia, who would not legally be allowed to respond to requests from Google USA for European PII.
      - marcosdumay 4y ago
        Yes, the Italian law that prohibits sending data abroad applies to Google Italia, but Google USA is submitted to the USA law, that says that the USA government can request any data from Google Italia and they are required to get it. So the existence of Google USA makes Google Italia operation illegal.
        baq 4y ago
        ...in USA.
minsc_and_boo 4y ago
Isn't it already against Google Analytics' policy to put PII in the platform to begin with? https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi...
- rgbrenner 4y ago
  Gdpr uses a more expansive definition of personal data, and it includes the IP address and geolocation data, for example.
  - dudus 4y ago
    And to be clear Google Analytics has a setting to "anonymize" the IP address which deletes the last octet of the address and makes geolocation less accurate. Then there's an argument that the IP address still reaches Google servers before it's deleted. But that's just splitting hairs at this point. If Google doesn't process the data with IP the IP address I see no harm. IP addresses are not something that you can choose to not send at all. It's kind of required by the TCP/IP stack. If that was the case users in EU could not access any website in the USA.
    - riffraff 4y ago
      The press release mentions that partial truncation is not considered good enough as google has enough ancillary metadata to reverse it.
    - y42 4y ago
      I guess the difference here is, that I want to visit a website in the US versus a tracking request, that happens in the background.
    - fulafel 4y ago
      The GDPR is a product of the Snowden revealed pervasive surveillance done by US TLAs. Keeping the data in EU vs sending it over to US under assurances is a big hair.
  - 4y ago
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
1vuio0pswjnm7 4y ago
Here are the URLs for those who disable Javascript (from https://github.com/PostHog/isgoogleanalyticsillegal.com https://github.com/PostHog/isgoogleanalyticsillegal.com) https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586 https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586... https://www.cnil.fr/en/use-google-analytics-and-data-transfe https://www.cnil.fr/en/use-google-analytics-and-data-transfe... https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google- https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... NOYB is the primary source tracking these cases and generally was also responsible for filing the complaints that led to them. All the details are available from NOYB's GDPRhub wiki, https://gdprhub.eu https://gdprhub.eu. GDPRhub attempts to provide information on all the European DPAs including how to file complaints. At the least it provides contact info for all the DPAs and English translations of DPA decisions. As stated in 13 Jan 2022 announcement on noyb.eu, these decisions are generally the result of the "Max Schrems II" decision. After that decision, Schrems filed 101 complaints to DPAs, and now the chickens are coming home to roost. Note that the "legality" of Google Fonts, under the default configuration, is also in question. Arguably use of Google Fonts is even more widespread than use of Google Analytics.
deleted 4y ago
[deleted]
stickfigure 4y ago
Is it illegal to use my website from Italy? I store PII (and everything else) in the US.
- dmitriid 4y ago
  No. It's illegal for you to operate in the EU.
  - stickfigure 4y ago
    What does that mean? Europeans use my website.
    - xcdzvyn 4y ago
      It's your responsibility to not export PII of Europeans to America, and/or to stop them from accessing your content.
      - stickfigure 4y ago
        My website does not care where you live. What exactly will happen me if I do not block Europeans from using my website?
        bruce343434 4y ago
        If you are breaking European law, you can't operate in Europe? What is so hard to understand about this? Amend your code to not send PII of Europeans outside Europe, or pussy out and give a "451 Unavailable For Legal Reasons".
        stickfigure 4y ago
        The question is still outstanding, so let me quote myself: > What exactly will happen me if I do not block Europeans from using my website? My website is available to Europeans. They use it. They even pay me money for it. What's going to happen?
ricardobayes 4y ago
Forget anonimized GA, I wonder what regulators would say to the likes of Hotjar which even records your screen and can be played back.
- FateOfNations 4y ago
  They aren't Google, so the anti-"American Big Tech" energy isn't as strong.
remram 4y ago
I understand that this is primarily an advertisement for Posthog, but if you're going to keep posting it you might want to keep it up to date. There are only 4 countries on your map and one of them is: > The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022. At least you removed "the only open source product analytics platform" and the Google fonts since the last time a Posthog employee posted it https://news.ycombinator.com/item?id=29994183 https://news.ycombinator.com/item?id=29994183

stingraycharles 4y ago

That is an extremely important nuance which is not obvious from the title.

deleted 4y ago
[deleted]
tut-urut-utut 4y ago
Most of the people using GA wouldn't be able to set it up correctly. I switched my personal site from GA to Microanalytics, since I wanted to avoid spending time trying to figure out how to configure GA to be conformant. Google should be the one doing the compliance work. If Italy bans some usage pattern in GA, it's Google that should make it impossible to configure it in non-conformant way.
- mywittyname 4y ago
  It's not that bad: https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi... The most difficult aspect is dealing with URLs. But a company that is large enough to be customizing URLs per user, is large enough to make a few JS changes to ensure they aren't sending those details to GA.
- throwaway2037 4y ago
  I agree 100% with your second paragraph. I also hope they introduce massive "percent of revenue" fines when Google "forgets" to ban illegal activity on their (near-monopoly) advertising platform. Massive fines has genuinely changed the behaviour of sales & trading at global investment banks. We can do the same for FAANG and friends.

lmkg 4y ago

> just illegal to use in its default state which transmits PII to the US As I mentioned in a sibling comment, this is technically true but complying with GDPR takes more than unchecking a few boxes. I've never seen any GA set-up that would remotely approach compliance. At minimum, you need to mask IP's before they reach Google, which means standing up a non-Google server to proxy all the hits. That is more complexity than 99+% of GA installations.

closewith 4y ago
That’s a very common implementation of serverside GTM/GA in the EU. If you advertise, you’ll still be sending GCLIDs, though.
- Nextgrid 4y ago
  If only ad clicks send back tracking parameters (and nothing else) it might actually fall into legitimate interest.
  - closewith 4y ago
    The current issue isn't the lawful basis for the processing, as compliant companies already only use Google Analytics once they have consent. The issue is that without an adequacy decision from the EU to allow data transfers to the US, and with the global reach of US authorities thanks to the CLOUD Act, there's no way to keep personal data safe from US law enforcement.
naet 4y ago
My current understanding of google analytics and GDPR compliance is that you can use it in a GDPR compliant manner without that much trouble. On the older UA there is a simple flag that enables IP anonymization and on the new GA4 there is purportedly no need for it as they don't collect or store the IP at all. For many clients I have set up a cookie compliance tool like Onetrust, which blocks loading of GA and other scripts with one of the consent popups. With this combined configuration (and having verified nothing sneaks through before someone gives consent) most company legal / compliance teams I have worked with have deemed this to be a fully compliant setup. Of course, this might not be actually compliant, but the company legal team has done some research and arrived at this as the most advantageous position currently available. I think using a compliance based tool like Onetrust also gives a sense of legal security in that if our configuration is properly set up they are advertising that we then get compliance as part of their service, and so responsibility of a violation could potentially be passed to them in a legal setting. ref: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en

mro_name 4y ago

yeah, like 'swimming pools only bear a danger of drowning when wet'.

rightbyte 4y ago
Empty pools are probably more dangerous.
- Forge36 4y ago
  I hear they attract skaters.
  - rightbyte 4y ago
    Those pools don't have sharp drops and are rather safe I guess. I wonder if that is the reason some pools are built like that ...
hnarn 4y ago
That analogy makes no sense at all.

digitalengineer 4y ago

Some time ago Google gave EU admins the option to select a local regional (EU) server. This means the data is not send to the US. But! It’s still nog fully legal as the Google HQ (and thus the US government( can still access all the data.

y42 4y ago
Like Adobe, who uses tracking servers in the EU, but Data Processing happens in the US?
googlryas 4y ago
Why is that not fully legal? Wouldn't the same law prevent Google USA from querying PII data from Google Italia?
- marcosdumay 4y ago
  Italian laws do not apply to Google USA.
  - googlryas 4y ago
    Not generally, but they do apply to Google Italia, who would not legally be allowed to respond to requests from Google USA for European PII.
    - marcosdumay 4y ago
      Yes, the Italian law that prohibits sending data abroad applies to Google Italia, but Google USA is submitted to the USA law, that says that the USA government can request any data from Google Italia and they are required to get it. So the existence of Google USA makes Google Italia operation illegal.
      - baq 4y ago
        ...in USA.

minsc_and_boo 4y ago

Isn't it already against Google Analytics' policy to put PII in the platform to begin with? https://support.google.com/analytics/answer/6366371?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/6366371?hl=en#zi...

rgbrenner 4y ago
Gdpr uses a more expansive definition of personal data, and it includes the IP address and geolocation data, for example.
- dudus 4y ago
  And to be clear Google Analytics has a setting to "anonymize" the IP address which deletes the last octet of the address and makes geolocation less accurate. Then there's an argument that the IP address still reaches Google servers before it's deleted. But that's just splitting hairs at this point. If Google doesn't process the data with IP the IP address I see no harm. IP addresses are not something that you can choose to not send at all. It's kind of required by the TCP/IP stack. If that was the case users in EU could not access any website in the USA.
  - riffraff 4y ago
    The press release mentions that partial truncation is not considered good enough as google has enough ancillary metadata to reverse it.
  - y42 4y ago
    I guess the difference here is, that I want to visit a website in the US versus a tracking request, that happens in the background.
  - fulafel 4y ago
    The GDPR is a product of the Snowden revealed pervasive surveillance done by US TLAs. Keeping the data in EU vs sending it over to US under assurances is a big hair.
- 4y ago

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

1vuio0pswjnm7 4y ago

Here are the URLs for those who disable Javascript (from https://github.com/PostHog/isgoogleanalyticsillegal.com https://github.com/PostHog/isgoogleanalyticsillegal.com) https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586 https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586... https://www.cnil.fr/en/use-google-analytics-and-data-transfe https://www.cnil.fr/en/use-google-analytics-and-data-transfe... https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google- https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... NOYB is the primary source tracking these cases and generally was also responsible for filing the complaints that led to them. All the details are available from NOYB's GDPRhub wiki, https://gdprhub.eu https://gdprhub.eu. GDPRhub attempts to provide information on all the European DPAs including how to file complaints. At the least it provides contact info for all the DPAs and English translations of DPA decisions. As stated in 13 Jan 2022 announcement on noyb.eu, these decisions are generally the result of the "Max Schrems II" decision. After that decision, Schrems filed 101 complaints to DPAs, and now the chickens are coming home to roost. Note that the "legality" of Google Fonts, under the default configuration, is also in question. Arguably use of Google Fonts is even more widespread than use of Google Analytics.

deleted 4y ago

[deleted]

stickfigure 4y ago

Is it illegal to use my website from Italy? I store PII (and everything else) in the US.

dmitriid 4y ago
No. It's illegal for you to operate in the EU.
- stickfigure 4y ago
  What does that mean? Europeans use my website.
  - xcdzvyn 4y ago
    It's your responsibility to not export PII of Europeans to America, and/or to stop them from accessing your content.
    - stickfigure 4y ago
      My website does not care where you live. What exactly will happen me if I do not block Europeans from using my website?
      - bruce343434 4y ago
        If you are breaking European law, you can't operate in Europe? What is so hard to understand about this? Amend your code to not send PII of Europeans outside Europe, or pussy out and give a "451 Unavailable For Legal Reasons".
        stickfigure 4y ago
        The question is still outstanding, so let me quote myself: > What exactly will happen me if I do not block Europeans from using my website? My website is available to Europeans. They use it. They even pay me money for it. What's going to happen?

ricardobayes 4y ago

Forget anonimized GA, I wonder what regulators would say to the likes of Hotjar which even records your screen and can be played back.

FateOfNations 4y ago
They aren't Google, so the anti-"American Big Tech" energy isn't as strong.

remram 4y ago

I understand that this is primarily an advertisement for Posthog, but if you're going to keep posting it you might want to keep it up to date. There are only 4 countries on your map and one of them is: > The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022. At least you removed "the only open source product analytics platform" and the Google fonts since the last time a Posthog employee posted it https://news.ycombinator.com/item?id=29994183 https://news.ycombinator.com/item?id=29994183