24 ms·

CNIL makes Google Analytics almost illegal in France

224 points by nephanth 4y ago

rlpb 4y ago
"makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says. Just because use of a product is determined to contravene a country's law doesn't mean that the product itself is made illegal; it can be adapted to be compliant instead.
- robertlagrant 4y ago
  I don't see there's a difference. Say they lowered the speed limit, making driving at current top speed illegal. You could say that speed's not illegal, it just needs modifying, but that would seem a strange point to make.
  - bryanrasmussen 4y ago
    I think that's a strange way of arguing actually, you would say the speed is illegal and the car and driver behavior just needs modifying. Google analytics would by analogy be closer to a car that can go a certain speed. But the question is if the law says that any car that can go that speed is no longer street legal, then it is a problem because it is probably difficult to modify the car. Just as there are structural issues about Google Analytics where GDPR is concerned that makes altering it really difficult if not impossible, and if you can't fix GA to make it legal it is de facto illegal.
    - BlueTemplar 4y ago
      I guess the parallel works even better with *minimum* rather than maximum speed limits ?
    - lupire 4y ago
      Google Analytics isn't a street-legal car.
  - nephanth 4y ago
    better analogy is if they decreased the weight limit of vehicles your license allows you to drive, you could say your suv hasn’t become illegal, it just needs modifying (that is, changing the bodywork & the wheels)
- kergonath 4y ago
  The title is not great, but the Q&A is very explicit: > All data controllers using Google Analytics in a similar way to these organisations should now consider this use as unlawful under the GDPR.
  - rlpb 4y ago
    > > in a similar way to these organisations If you use axe in a similar way to an axe murderer then that would make your use illegal. It wouldn't make axes "almost illegal".
    - rtsil 4y ago
      Considering that all uses of GA are illegal under GDPR except for a handful of specific derogations that do not constitute its main usages, an apt comparison would be heroin, which is illegal, except in a very few regulated cases.
    - naniwaduni 4y ago
      There are any number of things you can have that are not technically illegal to acquire or possess per se, but would almost certainly be illegal to use in any expected capacity. I think it's reasonable to describe those as "almost illegal". Google Analytics is, apparently, in that category.
    - eCa 4y ago
      It’s legal to have a Google Analytics account, but if you[1] put the code on your website, then you wield it like an axe murderer. I think that’s where that allegory is going. [1] If you are governed by this ruling etc
    - kergonath 4y ago
      The “similar way to these organisations” is because their ruling was in specific cases (this is just advice). If you read the previous paragraphs, it is obvious that the “similar way” is putting the Google Analytics scripts on a webpage.
- kmeisthax 4y ago
  The product cannot be adapted as the concern is specifically that Google can be legally compelled to violate GDPR. Schrems II is very explicit that EU companies cannot send data to the US for as long as the US CLOUD Act is on the books. "Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.
  - cyral 4y ago
    So really every website, even HN, that doesn't shard all EU data away in a separate EU datacenter (if they aren't already based in the EU) is illegal?
    - jacquesm 4y ago
      No.
    - mminer237 4y ago
      Correct. Also note that IP address are counted as PII, so even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal without getting consent beforehand.
      - tomkarho 4y ago
        I'm not sure that's how it works. Couple of things (IANAL): 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable 2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser
        josefx 4y ago
        > 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable According to courts just the IP is considered enough: The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1] [1]https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.
- kmitz 4y ago
  Speaking of adapting the product, the article explicitely states : "Is it possible to set the Google Analytics tool so that personal data is not transferred outside the European Union?" "No." So right now it is practically impossible to use Google Analytics in a legal way in France.
  - jeppester 4y ago
    It's a very common misunderstanding (which is happily spread by US cloud providers) that it matters where the data is stored. What matters is that the data is stored by - and accessible to - a company which submits to the US laws.
    - 8ytecoder 4y ago
      I don’t think it has been tested in court. It’s akin to a U.S. Court issuing a search warrant on a house in Paris.
      - Gwypaas 4y ago
        Which is exactly what happened and is causing this mess. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act No problem at all with GDPR and third countries. They simply need to have a regulatory framework making compliance possible. https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/ https://www.imy.se/en/organisations/data-protection/this-app...
        GekkePrutser 4y ago
        The problem is that frameworks we have with the US keep being shot down by the EU judiciary. First Safe Harbor and now Privacy Shield. For good reason I might add.
      - moontear 4y ago
        Yes, it has been tested: https://amp.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://amp.theguardian.com/technology/2015/sep/09/microsoft... And that’s exactly what it would be like, though the house in Paris would be owned by a company that has a legal entity in the United States.
- anothernewdude 4y ago
  Yeah, it could become a different product. Therefore Google Analytics becomes illegal. Drug smuggling isn't illegal, those smuggling drugs could all become legitimate export companies!
- 1vuio0pswjnm7 4y ago
  https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... This details the changes Google Analytics users must make to be complient. After making all these changes is there any value left in using Google Analytics. Why bother. Honest questions.
  - closewith 4y ago
    Almost everything bar the absence of query parameters could be implemented in a useful privacy-conscious server-side GTM implementation, but without query parameters, none of the advertising integration works, which is the most important part for most businesses (demand generation through Google Ads, Facebook, etc).
  - deleted 4y ago
    [deleted]
- sigwinch28 4y ago
  > "makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says Yep. Also, from the HN guidelines: Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.
  - jsiepkes 4y ago
    When the CNIL makes a statement saying it is impossible to legally use Google Analytics a title like "Q&A on the CNIL's formal notices concerning the use of Google Analytics" is simply not going to cut it. The fact that the title hasn't been edited even though the post is over 16 hours old seem to support the above hypothesis.
agluszak 4y ago
I hope more and more such laws will be passed in the EU. We need stronger privacy protection against big tech corporations.
- WaitWaitWha 4y ago
  >We need stronger privacy protection against big tech corporations. ... We need stronger privacy protection; ... be it corporations, governments, or individuals.
  - joe-collins 4y ago
    We need stronger protections at all levels of social organization. Every group has incentives to exploit each other. The ever-evolving trick is to arrange the balance of power to minimize each faction's capacity for overreach.
  - rtsil 4y ago
    > ... be it corporations, governments, or individuals. The emphasis on only one/some of these is a matter of country culture. Some countries have more reasons to distrust corporations far more than the government, some distrust the government and idolize corporations and individuals, and others have had bad experiences with all three.
gigel82 4y ago
Server side GTM (and similar devious tactics) should be what gets legislated (since that's the thing that adblockers can't protect us against).
- closewith 4y ago
  Adblockers can still (and do) protect against server-side GTM, as the requests are not obfuscated in any way. That may change in the future, but it’s not the case now. Besides, the CNIL ruling already applies to server-side GTM implementations.
  - gorhill 4y ago
    > as the requests are not obfuscated in any way How do you know for sure that the requests are "not obfuscated in any way"?
    - closewith 4y ago
      Right now, because the requests are identical to the same requests sent to Google Analytics but with a different hostname. It's trivial to identify and block them, and current ad blockers already do.
      - gorhill 4y ago
        > same requests sent to Google Analytics but with a different hostname There are instructions out there to also modify the path of the requests[1]. Consider this paragraph in the Summary section: > Cynics could say that this is an improved way to circumvent ad blockers. And they’d be right! This does make it easier to circumvent ad blockers, as their heuristics target not just the googletagmanager.com domain but also the gtm.js file and the GTM-... container ID. * * * [1] https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/#request-path https://www.simoahava.com/analytics/custom-gtm-loader-server...
        closewith 4y ago
bumper_crop 4y ago
This is great news! For far too long, Website owners have been collecting data on their users at no benefit to the users themselves. When website owners try to collect data on their users (for any and all reasons) it just violates the privacy of those people and needs to be put to an end. Those French website runners should really create their own, CNIL and GDPR compliant anonymized data storing, rather than using off the shelf, low cost alternatives. After all, things have been a bit too easy for them. (Running a website is pretty easy, I would know!). In fact, The fact that other, compliant-data aggregators, offer fewer features and lower reliability is actually a good thing. Trying to improve your website or even pester me with whatever you made is just irritating spam; I can't believe those independent owners would even dare. They should just be flushed out of existence. HEY! Why is everything being centralized to just a few services? Why is the web dying?!
jeppester 4y ago
It's been known for years - and hardly takes a lawyer to understand - that sending user data to US-owned companies is illegal according to GDPR. The US laws are simply incompatible. Yet everyone (including government entities) have been dragging their feet on and on hoping for some divine intervention to help them continue using Google, Amazon and Microsoft. And those companies have kept the hopes high by incorrectly claiming to be GDPR compliant. It's been embarrassing to witnes how little willingness there's been shown towards protecting user data. Especially compared to the amount of whining over how difficult it is to comply. Hopefully these - very predictable - rulings will finally start to get the ball rolling.
- mminer237 4y ago
  I think it's because over 40% of EU business use the cloud[1] and 70% of those use AWS, Azure, or GCS.[2] Enforcing the law consistently would devastate tons of EU businesses as you would suddenly eliminate all of their tech infrastructure overnight with no real alternatives. [1]: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises https://ec.europa.eu/eurostat/statistics-explained/index.php... [2]: https://www.fiercetelecom.com/platforms/european-cloud-providers-take-hit-from-aws-google-azure-says-synergy https://www.fiercetelecom.com/platforms/european-cloud-provi...
  - jeppester 4y ago
    The businesses have had more than enough time to comply with the law. Now is the time to start enforcing the law enough to make them actually care.
    - macinjosh 4y ago
      Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
      - deleted 4y ago
eftychis 4y ago
My applause to CNIL on the action. I don't understand the "almost." The title is editorialized -- as commented elsewhere. There is no almost. It is illegal the way they act and store data. That nobody is going to come and place you on handcuffs doesn't make something legal... Mainly though this is old news -- https://iapp.org/news/a/cnil-is-latest-authority-to-rule-google-analytics-violates-gdpr/ https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo... -- CNIL and the Austrian one did so in the beginning of the year. I would add a February 2022 tag on the post. I hope the whole EU agency pool does the same and start applying fines and every tooth they can.
- nephanth 4y ago
  The document states that there is a way to use Google analytics using an anonymizing proxy. While that way of using it effectively renders it useless, it is authorized. Hence "almost"
MR4D 4y ago
Actual title is “Q&A on the CNIL's formal notices concerning the use of Google Analytics”. This editorializing by the OP is a bit too far.
- anothernewdude 4y ago
  Source is French, therefore the boring title is also biased.
fjfbsufhdvfy 4y ago
I am so glad I didn't start my company in the EU.
- oittaa 4y ago
  And France is arguably the worst in the EU. They try to "protect" local markets like China.
  - throw_m239339 4y ago
    > And France is arguably the worst in the EU. They try to "protect" local markets like China. Every single country engages in some sort of protectionism, including USA the mecca of "free market", it's called corporate subsidies. https://news.ycombinator.com/item?id=32254681 https://news.ycombinator.com/item?id=32254681
    - oittaa 4y ago
      Of course every country prefers their own companies etc., but countries like France just take it to another level. The USA is not going to force a radio station focused on Japanese anime music to play music made in America at least 40% of the time.
      - Quikinterp 4y ago
        I like that law in Canada.
      - pjerem 4y ago
        You are talking about the « French Cultural Exception » which, like its name implies, is an exception to protect French culture and arts from the free markets. We know that we will never be as strong as US majors in cinema, music, arts, … so what this exception is trying to achieve is to preserve the French culture and values (including moral values) through arts. While implementation is falling apart those days and the rules are clearly abused by a lot of companies, I truly think it was a great idea when it was imagined. For instance, Hollywoodian cinema (and don’t get me wrong, we love most of it as an art) naturally promotes US values such as paid education, paid healthcare, free carrying of weapons, strong Christian values, neoliberalism, the idea that US is the center of the civilized world … (I randomly chose those ideas with no judgment whatsoever, just because we have different visions on those topics, so don’t blame me). Those ideas are clearly infusing into young generation as the normality so I do think the idea of this exception was genius. The idea was not to ban anything US (we love US arts) but to keep it in the context of « this is US art, so that’s why [insert_something_different] » instead of « this is mainstream art depicting the world as is should be ». Maybe it’s hard to see it from the US side because you are in the powerful side but imagine if China invested billions in (good) arts and surpassed Hollywood with (really good) movies promoting the Chinese system moral values. I’m pretty sure the US would react immediately and I think it would be normal. But this is just … an exception. And don’t be afraid, our current government is really happy to play the free markets game, including in healthcare.
sylware 4y ago
next, noscript/basic (x)html interop. ...
fatzeus 4y ago
What makes this illegal exactly? Say I stop using Google Analytics and just collect user data and store it in a DB on AWS. Would that be compliant?
- lmkg 4y ago
  What makes it illegal is that the visitor data is available to US law enforcement without any safeguards. The scenario that you posit, the most troublesome part is AWS because Amazon is also subject to US law enforcement. It depends on a few specifics, most significantly 1) does the user connect directly to an AWS service, exposing their IP address? 2) does AWS manage the keys to your database? If you were to instead self-host your DB or use an EU-located hosting provider, then the problems would not apply. You still have some homework to achieve GDPR compliance, but the tools don't require obtuse work-arounds.
  - ec109685 4y ago
    If you are a US based company how could it ever be possible to operate since you will be collecting data like IPs and therefor have a way to get access to it?
    - robin_reala 4y ago
      Have a holding company outside US jurisdiction that owns both a US subsidiary and an EU subsidiary, then make sure the US subsidiary never gets EU users’ data. Or lobby to rescind the CLOUD act.
      - closewith 4y ago
        Even that is not enough, as the US reserves the right to extraterritorial personal jurisdiction over companies on a case-by-case basis, depending on the nature of the company's dealings with the US and business interests in the US.
        robin_reala 4y ago
lttlrck 4y ago
Well maybe that'll encourage La Poste to fix their website which fails to track packages when trackers are blocked...
clement_b 4y ago
It truly saddens me that we're going this route. This pseudo fight for 'privacy' is frustrating and will only bring us closer to a splinternet situation. > the data of European Internet users is therefore illegally transferred through this tool. This isn't a devilish situation to me. We're talking about a tracking pixel, not healthcare records or trade secrets. All that is because we aren't capable of fighting US big tech with innovation. Only with regulation. Appalling. Hopefully, Google finds a legal way around it.
- dewey 4y ago
  > We're talking about a tracking pixel You know where these tracking pixels are? Everywhere, doctors websites, ecommerce checkout pages,... - you can get a lot of very private information about someone by correlating these data points.
- theplumber 4y ago
  I believe the way around it would be to create an "full" EU subsidiary that stores the data within EU and cannot take directives from the U.S parent <- US gov. To be honest I'm really surprised that the stock market had no reaction to the recent Digital Markets Act and GDPR. Currently most of the U.S companies are in illegality. They need to restructure their business significantly. That being said I think EU is right. Why would we want our data shared with the U.S government?
  - iggldiggl 4y ago
    I'm not sure that's really possible, is it? If your legal control over your subsidiary is sufficiently tight that your subsidiary cannot turn rogue on you (and if it doesn't turn rogue on you despite not having sufficiently close legal ties, you might effectively be forming an illegal cartel, wouldn't you?), it's presumably also sufficiently tight for the US government to act through those ties.
    - deleted 4y ago
      [deleted]
    - 4y ago
jokethrowaway 4y ago
If you can't beat them, regulate them out of the market. Pathetic.
freemint 4y ago
Would enabling GA depending if and only if the user explicitly consents to their data being available to US law enforcement be GDPR compliant?
stevenalowe 4y ago
How does this authority contravene the private agreement between the website and the user? Assume the user is well informed and agreed to it and everyone is acting in good faith - I don’t see where any government has the legit power to contravene a private contract Maybe I’m looking at it weirdly
nephanth 4y ago
It is impressive how many people don’t understand the actual stakes of that law in this thread. Let’s look at a similar situation by changing the country names. Right now, most advanced microchips used in the US are made in Taiwan. Imagine for two seconds what would happen if Taiwan passed a bill that all produced microchip must contain a non-removable tracker that sends all data processed by that chip to the Taiwanese intelligence agency (pretend it’s technically possible) Do you think the US would continue importing chips from Taiwan? Sure banning them might hurt the tech industry and all, but if they don’t, in a strategic standpoint, it’s hybris at best, stupidity at worst. Well that’s pretty much what the US is doing with cloud act. Of course their products are going to get forbidden. You just don’t engage in overt mass spying on your allies, that’s in bad taste.

224 points by nephanth 4y ago

rlpb 4y ago

"makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says. Just because use of a product is determined to contravene a country's law doesn't mean that the product itself is made illegal; it can be adapted to be compliant instead.

robertlagrant 4y ago
I don't see there's a difference. Say they lowered the speed limit, making driving at current top speed illegal. You could say that speed's not illegal, it just needs modifying, but that would seem a strange point to make.
- bryanrasmussen 4y ago
  I think that's a strange way of arguing actually, you would say the speed is illegal and the car and driver behavior just needs modifying. Google analytics would by analogy be closer to a car that can go a certain speed. But the question is if the law says that any car that can go that speed is no longer street legal, then it is a problem because it is probably difficult to modify the car. Just as there are structural issues about Google Analytics where GDPR is concerned that makes altering it really difficult if not impossible, and if you can't fix GA to make it legal it is de facto illegal.
  - BlueTemplar 4y ago
    I guess the parallel works even better with *minimum* rather than maximum speed limits ?
  - lupire 4y ago
    Google Analytics isn't a street-legal car.
- nephanth 4y ago
  better analogy is if they decreased the weight limit of vehicles your license allows you to drive, you could say your suv hasn’t become illegal, it just needs modifying (that is, changing the bodywork & the wheels)
kergonath 4y ago
The title is not great, but the Q&A is very explicit: > All data controllers using Google Analytics in a similar way to these organisations should now consider this use as unlawful under the GDPR.
- rlpb 4y ago
  > > in a similar way to these organisations If you use axe in a similar way to an axe murderer then that would make your use illegal. It wouldn't make axes "almost illegal".
  - rtsil 4y ago
    Considering that all uses of GA are illegal under GDPR except for a handful of specific derogations that do not constitute its main usages, an apt comparison would be heroin, which is illegal, except in a very few regulated cases.
  - naniwaduni 4y ago
    There are any number of things you can have that are not technically illegal to acquire or possess per se, but would almost certainly be illegal to use in any expected capacity. I think it's reasonable to describe those as "almost illegal". Google Analytics is, apparently, in that category.
  - eCa 4y ago
    It’s legal to have a Google Analytics account, but if you[1] put the code on your website, then you wield it like an axe murderer. I think that’s where that allegory is going. [1] If you are governed by this ruling etc
  - kergonath 4y ago
    The “similar way to these organisations” is because their ruling was in specific cases (this is just advice). If you read the previous paragraphs, it is obvious that the “similar way” is putting the Google Analytics scripts on a webpage.
kmeisthax 4y ago
The product cannot be adapted as the concern is specifically that Google can be legally compelled to violate GDPR. Schrems II is very explicit that EU companies cannot send data to the US for as long as the US CLOUD Act is on the books. "Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.
- cyral 4y ago
  So really every website, even HN, that doesn't shard all EU data away in a separate EU datacenter (if they aren't already based in the EU) is illegal?
  - jacquesm 4y ago
    No.
  - mminer237 4y ago
    Correct. Also note that IP address are counted as PII, so even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal without getting consent beforehand.
    - tomkarho 4y ago
      I'm not sure that's how it works. Couple of things (IANAL): 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable 2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser
      - josefx 4y ago
        > 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable According to courts just the IP is considered enough: The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1] [1]https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.
kmitz 4y ago
Speaking of adapting the product, the article explicitely states : "Is it possible to set the Google Analytics tool so that personal data is not transferred outside the European Union?" "No." So right now it is practically impossible to use Google Analytics in a legal way in France.
- jeppester 4y ago
  It's a very common misunderstanding (which is happily spread by US cloud providers) that it matters where the data is stored. What matters is that the data is stored by - and accessible to - a company which submits to the US laws.
  - 8ytecoder 4y ago
    I don’t think it has been tested in court. It’s akin to a U.S. Court issuing a search warrant on a house in Paris.
    - Gwypaas 4y ago
      Which is exactly what happened and is causing this mess. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act No problem at all with GDPR and third countries. They simply need to have a regulatory framework making compliance possible. https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/ https://www.imy.se/en/organisations/data-protection/this-app...
      - GekkePrutser 4y ago
        The problem is that frameworks we have with the US keep being shot down by the EU judiciary. First Safe Harbor and now Privacy Shield. For good reason I might add.
    - moontear 4y ago
      Yes, it has been tested: https://amp.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://amp.theguardian.com/technology/2015/sep/09/microsoft... And that’s exactly what it would be like, though the house in Paris would be owned by a company that has a legal entity in the United States.
anothernewdude 4y ago
Yeah, it could become a different product. Therefore Google Analytics becomes illegal. Drug smuggling isn't illegal, those smuggling drugs could all become legitimate export companies!
1vuio0pswjnm7 4y ago
https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... This details the changes Google Analytics users must make to be complient. After making all these changes is there any value left in using Google Analytics. Why bother. Honest questions.
- closewith 4y ago
  Almost everything bar the absence of query parameters could be implemented in a useful privacy-conscious server-side GTM implementation, but without query parameters, none of the advertising integration works, which is the most important part for most businesses (demand generation through Google Ads, Facebook, etc).
- deleted 4y ago
  [deleted]
sigwinch28 4y ago
> "makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says Yep. Also, from the HN guidelines: Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.
- jsiepkes 4y ago
  When the CNIL makes a statement saying it is impossible to legally use Google Analytics a title like "Q&A on the CNIL's formal notices concerning the use of Google Analytics" is simply not going to cut it. The fact that the title hasn't been edited even though the post is over 16 hours old seem to support the above hypothesis.

agluszak 4y ago

I hope more and more such laws will be passed in the EU. We need stronger privacy protection against big tech corporations.

WaitWaitWha 4y ago
>We need stronger privacy protection against big tech corporations. ... We need stronger privacy protection; ... be it corporations, governments, or individuals.
- joe-collins 4y ago
  We need stronger protections at all levels of social organization. Every group has incentives to exploit each other. The ever-evolving trick is to arrange the balance of power to minimize each faction's capacity for overreach.
- rtsil 4y ago
  > ... be it corporations, governments, or individuals. The emphasis on only one/some of these is a matter of country culture. Some countries have more reasons to distrust corporations far more than the government, some distrust the government and idolize corporations and individuals, and others have had bad experiences with all three.

gigel82 4y ago

Server side GTM (and similar devious tactics) should be what gets legislated (since that's the thing that adblockers can't protect us against).

closewith 4y ago
Adblockers can still (and do) protect against server-side GTM, as the requests are not obfuscated in any way. That may change in the future, but it’s not the case now. Besides, the CNIL ruling already applies to server-side GTM implementations.
- gorhill 4y ago
  > as the requests are not obfuscated in any way How do you know for sure that the requests are "not obfuscated in any way"?
  - closewith 4y ago
    Right now, because the requests are identical to the same requests sent to Google Analytics but with a different hostname. It's trivial to identify and block them, and current ad blockers already do.
    - gorhill 4y ago
      > same requests sent to Google Analytics but with a different hostname There are instructions out there to also modify the path of the requests[1]. Consider this paragraph in the Summary section: > Cynics could say that this is an improved way to circumvent ad blockers. And they’d be right! This does make it easier to circumvent ad blockers, as their heuristics target not just the googletagmanager.com domain but also the gtm.js file and the GTM-... container ID. * * * [1] https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/#request-path https://www.simoahava.com/analytics/custom-gtm-loader-server...
      - closewith 4y ago

bumper_crop 4y ago

This is great news! For far too long, Website owners have been collecting data on their users at no benefit to the users themselves. When website owners try to collect data on their users (for any and all reasons) it just violates the privacy of those people and needs to be put to an end. Those French website runners should really create their own, CNIL and GDPR compliant anonymized data storing, rather than using off the shelf, low cost alternatives. After all, things have been a bit too easy for them. (Running a website is pretty easy, I would know!). In fact, The fact that other, compliant-data aggregators, offer fewer features and lower reliability is actually a good thing. Trying to improve your website or even pester me with whatever you made is just irritating spam; I can't believe those independent owners would even dare. They should just be flushed out of existence. HEY! Why is everything being centralized to just a few services? Why is the web dying?!

jeppester 4y ago

It's been known for years - and hardly takes a lawyer to understand - that sending user data to US-owned companies is illegal according to GDPR. The US laws are simply incompatible. Yet everyone (including government entities) have been dragging their feet on and on hoping for some divine intervention to help them continue using Google, Amazon and Microsoft. And those companies have kept the hopes high by incorrectly claiming to be GDPR compliant. It's been embarrassing to witnes how little willingness there's been shown towards protecting user data. Especially compared to the amount of whining over how difficult it is to comply. Hopefully these - very predictable - rulings will finally start to get the ball rolling.

mminer237 4y ago
I think it's because over 40% of EU business use the cloud[1] and 70% of those use AWS, Azure, or GCS.[2] Enforcing the law consistently would devastate tons of EU businesses as you would suddenly eliminate all of their tech infrastructure overnight with no real alternatives. [1]: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises https://ec.europa.eu/eurostat/statistics-explained/index.php... [2]: https://www.fiercetelecom.com/platforms/european-cloud-providers-take-hit-from-aws-google-azure-says-synergy https://www.fiercetelecom.com/platforms/european-cloud-provi...
- jeppester 4y ago
  The businesses have had more than enough time to comply with the law. Now is the time to start enforcing the law enough to make them actually care.
  - macinjosh 4y ago
    Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
    - deleted 4y ago

eftychis 4y ago

My applause to CNIL on the action. I don't understand the "almost." The title is editorialized -- as commented elsewhere. There is no almost. It is illegal the way they act and store data. That nobody is going to come and place you on handcuffs doesn't make something legal... Mainly though this is old news -- https://iapp.org/news/a/cnil-is-latest-authority-to-rule-google-analytics-violates-gdpr/ https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo... -- CNIL and the Austrian one did so in the beginning of the year. I would add a February 2022 tag on the post. I hope the whole EU agency pool does the same and start applying fines and every tooth they can.

nephanth 4y ago
The document states that there is a way to use Google analytics using an anonymizing proxy. While that way of using it effectively renders it useless, it is authorized. Hence "almost"

MR4D 4y ago

Actual title is “Q&A on the CNIL's formal notices concerning the use of Google Analytics”. This editorializing by the OP is a bit too far.

anothernewdude 4y ago
Source is French, therefore the boring title is also biased.

fjfbsufhdvfy 4y ago

I am so glad I didn't start my company in the EU.

oittaa 4y ago
And France is arguably the worst in the EU. They try to "protect" local markets like China.
- throw_m239339 4y ago
  > And France is arguably the worst in the EU. They try to "protect" local markets like China. Every single country engages in some sort of protectionism, including USA the mecca of "free market", it's called corporate subsidies. https://news.ycombinator.com/item?id=32254681 https://news.ycombinator.com/item?id=32254681
  - oittaa 4y ago
    Of course every country prefers their own companies etc., but countries like France just take it to another level. The USA is not going to force a radio station focused on Japanese anime music to play music made in America at least 40% of the time.
    - Quikinterp 4y ago
      I like that law in Canada.
    - pjerem 4y ago
      You are talking about the « French Cultural Exception » which, like its name implies, is an exception to protect French culture and arts from the free markets. We know that we will never be as strong as US majors in cinema, music, arts, … so what this exception is trying to achieve is to preserve the French culture and values (including moral values) through arts. While implementation is falling apart those days and the rules are clearly abused by a lot of companies, I truly think it was a great idea when it was imagined. For instance, Hollywoodian cinema (and don’t get me wrong, we love most of it as an art) naturally promotes US values such as paid education, paid healthcare, free carrying of weapons, strong Christian values, neoliberalism, the idea that US is the center of the civilized world … (I randomly chose those ideas with no judgment whatsoever, just because we have different visions on those topics, so don’t blame me). Those ideas are clearly infusing into young generation as the normality so I do think the idea of this exception was genius. The idea was not to ban anything US (we love US arts) but to keep it in the context of « this is US art, so that’s why [insert_something_different] » instead of « this is mainstream art depicting the world as is should be ». Maybe it’s hard to see it from the US side because you are in the powerful side but imagine if China invested billions in (good) arts and surpassed Hollywood with (really good) movies promoting the Chinese system moral values. I’m pretty sure the US would react immediately and I think it would be normal. But this is just … an exception. And don’t be afraid, our current government is really happy to play the free markets game, including in healthcare.

sylware 4y ago

next, noscript/basic (x)html interop. ...

fatzeus 4y ago

What makes this illegal exactly? Say I stop using Google Analytics and just collect user data and store it in a DB on AWS. Would that be compliant?

lmkg 4y ago
What makes it illegal is that the visitor data is available to US law enforcement without any safeguards. The scenario that you posit, the most troublesome part is AWS because Amazon is also subject to US law enforcement. It depends on a few specifics, most significantly 1) does the user connect directly to an AWS service, exposing their IP address? 2) does AWS manage the keys to your database? If you were to instead self-host your DB or use an EU-located hosting provider, then the problems would not apply. You still have some homework to achieve GDPR compliance, but the tools don't require obtuse work-arounds.
- ec109685 4y ago
  If you are a US based company how could it ever be possible to operate since you will be collecting data like IPs and therefor have a way to get access to it?
  - robin_reala 4y ago
    Have a holding company outside US jurisdiction that owns both a US subsidiary and an EU subsidiary, then make sure the US subsidiary never gets EU users’ data. Or lobby to rescind the CLOUD act.
    - closewith 4y ago
      Even that is not enough, as the US reserves the right to extraterritorial personal jurisdiction over companies on a case-by-case basis, depending on the nature of the company's dealings with the US and business interests in the US.
      - robin_reala 4y ago

lttlrck 4y ago

Well maybe that'll encourage La Poste to fix their website which fails to track packages when trackers are blocked...

clement_b 4y ago

It truly saddens me that we're going this route. This pseudo fight for 'privacy' is frustrating and will only bring us closer to a splinternet situation. > the data of European Internet users is therefore illegally transferred through this tool. This isn't a devilish situation to me. We're talking about a tracking pixel, not healthcare records or trade secrets. All that is because we aren't capable of fighting US big tech with innovation. Only with regulation. Appalling. Hopefully, Google finds a legal way around it.

dewey 4y ago
> We're talking about a tracking pixel You know where these tracking pixels are? Everywhere, doctors websites, ecommerce checkout pages,... - you can get a lot of very private information about someone by correlating these data points.
theplumber 4y ago
I believe the way around it would be to create an "full" EU subsidiary that stores the data within EU and cannot take directives from the U.S parent <- US gov. To be honest I'm really surprised that the stock market had no reaction to the recent Digital Markets Act and GDPR. Currently most of the U.S companies are in illegality. They need to restructure their business significantly. That being said I think EU is right. Why would we want our data shared with the U.S government?
- iggldiggl 4y ago
  I'm not sure that's really possible, is it? If your legal control over your subsidiary is sufficiently tight that your subsidiary cannot turn rogue on you (and if it doesn't turn rogue on you despite not having sufficiently close legal ties, you might effectively be forming an illegal cartel, wouldn't you?), it's presumably also sufficiently tight for the US government to act through those ties.
  - deleted 4y ago
    [deleted]
  - 4y ago

jokethrowaway 4y ago

If you can't beat them, regulate them out of the market. Pathetic.

freemint 4y ago

Would enabling GA depending if and only if the user explicitly consents to their data being available to US law enforcement be GDPR compliant?

stevenalowe 4y ago

How does this authority contravene the private agreement between the website and the user? Assume the user is well informed and agreed to it and everyone is acting in good faith - I don’t see where any government has the legit power to contravene a private contract Maybe I’m looking at it weirdly

nephanth 4y ago

It is impressive how many people don’t understand the actual stakes of that law in this thread. Let’s look at a similar situation by changing the country names. Right now, most advanced microchips used in the US are made in Taiwan. Imagine for two seconds what would happen if Taiwan passed a bill that all produced microchip must contain a non-removable tracker that sends all data processed by that chip to the Taiwanese intelligence agency (pretend it’s technically possible) Do you think the US would continue importing chips from Taiwan? Sure banning them might hurt the tech industry and all, but if they don’t, in a strategic standpoint, it’s hybris at best, stupidity at worst. Well that’s pretty much what the US is doing with cloud act. Of course their products are going to get forbidden. You just don’t engage in overt mass spying on your allies, that’s in bad taste.