9 ms·

"makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says. Just because use of a product is determi

by rlpb 4y ago

"makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says. Just because use of a product is determined to contravene a country's law doesn't mean that the product itself is made illegal; it can be adapted to be compliant instead.

robertlagrant 4y ago
I don't see there's a difference. Say they lowered the speed limit, making driving at current top speed illegal. You could say that speed's not illegal, it just needs modifying, but that would seem a strange point to make.
- bryanrasmussen 4y ago
  I think that's a strange way of arguing actually, you would say the speed is illegal and the car and driver behavior just needs modifying. Google analytics would by analogy be closer to a car that can go a certain speed. But the question is if the law says that any car that can go that speed is no longer street legal, then it is a problem because it is probably difficult to modify the car. Just as there are structural issues about Google Analytics where GDPR is concerned that makes altering it really difficult if not impossible, and if you can't fix GA to make it legal it is de facto illegal.
  - BlueTemplar 4y ago
    I guess the parallel works even better with *minimum* rather than maximum speed limits ?
  - lupire 4y ago
    Google Analytics isn't a street-legal car.
- nephanth 4y ago
  better analogy is if they decreased the weight limit of vehicles your license allows you to drive, you could say your suv hasn’t become illegal, it just needs modifying (that is, changing the bodywork & the wheels)
kergonath 4y ago
The title is not great, but the Q&A is very explicit: > All data controllers using Google Analytics in a similar way to these organisations should now consider this use as unlawful under the GDPR.
- rlpb 4y ago
  > > in a similar way to these organisations If you use axe in a similar way to an axe murderer then that would make your use illegal. It wouldn't make axes "almost illegal".
  - rtsil 4y ago
    Considering that all uses of GA are illegal under GDPR except for a handful of specific derogations that do not constitute its main usages, an apt comparison would be heroin, which is illegal, except in a very few regulated cases.
  - naniwaduni 4y ago
    There are any number of things you can have that are not technically illegal to acquire or possess per se, but would almost certainly be illegal to use in any expected capacity. I think it's reasonable to describe those as "almost illegal". Google Analytics is, apparently, in that category.
  - eCa 4y ago
    It’s legal to have a Google Analytics account, but if you[1] put the code on your website, then you wield it like an axe murderer. I think that’s where that allegory is going. [1] If you are governed by this ruling etc
  - kergonath 4y ago
    The “similar way to these organisations” is because their ruling was in specific cases (this is just advice). If you read the previous paragraphs, it is obvious that the “similar way” is putting the Google Analytics scripts on a webpage.
kmeisthax 4y ago
The product cannot be adapted as the concern is specifically that Google can be legally compelled to violate GDPR. Schrems II is very explicit that EU companies cannot send data to the US for as long as the US CLOUD Act is on the books. "Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.
- cyral 4y ago
  So really every website, even HN, that doesn't shard all EU data away in a separate EU datacenter (if they aren't already based in the EU) is illegal?
  - jacquesm 4y ago
    No.
  - mminer237 4y ago
    Correct. Also note that IP address are counted as PII, so even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal without getting consent beforehand.
    - tomkarho 4y ago
      I'm not sure that's how it works. Couple of things (IANAL): 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable 2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser
      - josefx 4y ago
        > 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable According to courts just the IP is considered enough: The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1] [1]https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.
kmitz 4y ago
Speaking of adapting the product, the article explicitely states : "Is it possible to set the Google Analytics tool so that personal data is not transferred outside the European Union?" "No." So right now it is practically impossible to use Google Analytics in a legal way in France.
- jeppester 4y ago
  It's a very common misunderstanding (which is happily spread by US cloud providers) that it matters where the data is stored. What matters is that the data is stored by - and accessible to - a company which submits to the US laws.
  - 8ytecoder 4y ago
    I don’t think it has been tested in court. It’s akin to a U.S. Court issuing a search warrant on a house in Paris.
    - Gwypaas 4y ago
      Which is exactly what happened and is causing this mess. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act No problem at all with GDPR and third countries. They simply need to have a regulatory framework making compliance possible. https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/ https://www.imy.se/en/organisations/data-protection/this-app...
      - GekkePrutser 4y ago
        The problem is that frameworks we have with the US keep being shot down by the EU judiciary. First Safe Harbor and now Privacy Shield. For good reason I might add.
    - moontear 4y ago
      Yes, it has been tested: https://amp.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://amp.theguardian.com/technology/2015/sep/09/microsoft... And that’s exactly what it would be like, though the house in Paris would be owned by a company that has a legal entity in the United States.
anothernewdude 4y ago
Yeah, it could become a different product. Therefore Google Analytics becomes illegal. Drug smuggling isn't illegal, those smuggling drugs could all become legitimate export companies!
1vuio0pswjnm7 4y ago
https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... This details the changes Google Analytics users must make to be complient. After making all these changes is there any value left in using Google Analytics. Why bother. Honest questions.
- closewith 4y ago
  Almost everything bar the absence of query parameters could be implemented in a useful privacy-conscious server-side GTM implementation, but without query parameters, none of the advertising integration works, which is the most important part for most businesses (demand generation through Google Ads, Facebook, etc).
- deleted 4y ago
  [deleted]
sigwinch28 4y ago
> "makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says Yep. Also, from the HN guidelines: Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.
- jsiepkes 4y ago
  When the CNIL makes a statement saying it is impossible to legally use Google Analytics a title like "Q&A on the CNIL's formal notices concerning the use of Google Analytics" is simply not going to cut it. The fact that the title hasn't been edited even though the post is over 16 hours old seem to support the above hypothesis.

by rlpb 4y ago

robertlagrant 4y ago

I don't see there's a difference. Say they lowered the speed limit, making driving at current top speed illegal. You could say that speed's not illegal, it just needs modifying, but that would seem a strange point to make.

bryanrasmussen 4y ago
I think that's a strange way of arguing actually, you would say the speed is illegal and the car and driver behavior just needs modifying. Google analytics would by analogy be closer to a car that can go a certain speed. But the question is if the law says that any car that can go that speed is no longer street legal, then it is a problem because it is probably difficult to modify the car. Just as there are structural issues about Google Analytics where GDPR is concerned that makes altering it really difficult if not impossible, and if you can't fix GA to make it legal it is de facto illegal.
- BlueTemplar 4y ago
  I guess the parallel works even better with *minimum* rather than maximum speed limits ?
- lupire 4y ago
  Google Analytics isn't a street-legal car.
nephanth 4y ago
better analogy is if they decreased the weight limit of vehicles your license allows you to drive, you could say your suv hasn’t become illegal, it just needs modifying (that is, changing the bodywork & the wheels)

kergonath 4y ago

The title is not great, but the Q&A is very explicit: > All data controllers using Google Analytics in a similar way to these organisations should now consider this use as unlawful under the GDPR.

rlpb 4y ago
> > in a similar way to these organisations If you use axe in a similar way to an axe murderer then that would make your use illegal. It wouldn't make axes "almost illegal".
- rtsil 4y ago
  Considering that all uses of GA are illegal under GDPR except for a handful of specific derogations that do not constitute its main usages, an apt comparison would be heroin, which is illegal, except in a very few regulated cases.
- naniwaduni 4y ago
  There are any number of things you can have that are not technically illegal to acquire or possess per se, but would almost certainly be illegal to use in any expected capacity. I think it's reasonable to describe those as "almost illegal". Google Analytics is, apparently, in that category.
- eCa 4y ago
  It’s legal to have a Google Analytics account, but if you[1] put the code on your website, then you wield it like an axe murderer. I think that’s where that allegory is going. [1] If you are governed by this ruling etc
- kergonath 4y ago
  The “similar way to these organisations” is because their ruling was in specific cases (this is just advice). If you read the previous paragraphs, it is obvious that the “similar way” is putting the Google Analytics scripts on a webpage.

kmeisthax 4y ago

The product cannot be adapted as the concern is specifically that Google can be legally compelled to violate GDPR. Schrems II is very explicit that EU companies cannot send data to the US for as long as the US CLOUD Act is on the books. "Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.

cyral 4y ago
So really every website, even HN, that doesn't shard all EU data away in a separate EU datacenter (if they aren't already based in the EU) is illegal?
- jacquesm 4y ago
  No.
- mminer237 4y ago
  Correct. Also note that IP address are counted as PII, so even sending an IP address (as required by any TCP/IP request) to a US-located or US-controlled server is illegal without getting consent beforehand.
  - tomkarho 4y ago
    I'm not sure that's how it works. Couple of things (IANAL): 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable 2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser
    - josefx 4y ago
      > 1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable According to courts just the IP is considered enough: The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1] [1]https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.

kmitz 4y ago

Speaking of adapting the product, the article explicitely states : "Is it possible to set the Google Analytics tool so that personal data is not transferred outside the European Union?" "No." So right now it is practically impossible to use Google Analytics in a legal way in France.

jeppester 4y ago
It's a very common misunderstanding (which is happily spread by US cloud providers) that it matters where the data is stored. What matters is that the data is stored by - and accessible to - a company which submits to the US laws.
- 8ytecoder 4y ago
  I don’t think it has been tested in court. It’s akin to a U.S. Court issuing a search warrant on a house in Paris.
  - Gwypaas 4y ago
    Which is exactly what happened and is causing this mess. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act No problem at all with GDPR and third countries. They simply need to have a regulatory framework making compliance possible. https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/transfer-of-data-to-a-third-country/ https://www.imy.se/en/organisations/data-protection/this-app...
    - GekkePrutser 4y ago
      The problem is that frameworks we have with the US keep being shot down by the EU judiciary. First Safe Harbor and now Privacy Shield. For good reason I might add.
  - moontear 4y ago
    Yes, it has been tested: https://amp.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://amp.theguardian.com/technology/2015/sep/09/microsoft... And that’s exactly what it would be like, though the house in Paris would be owned by a company that has a legal entity in the United States.

anothernewdude 4y ago

Yeah, it could become a different product. Therefore Google Analytics becomes illegal. Drug smuggling isn't illegal, those smuggling drugs could all become legitimate export companies!

1vuio0pswjnm7 4y ago

https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... This details the changes Google Analytics users must make to be complient. After making all these changes is there any value left in using Google Analytics. Why bother. Honest questions.

closewith 4y ago
Almost everything bar the absence of query parameters could be implemented in a useful privacy-conscious server-side GTM implementation, but without query parameters, none of the advertising integration works, which is the most important part for most businesses (demand generation through Google Ads, Facebook, etc).
deleted 4y ago
[deleted]

sigwinch28 4y ago

> "makes Google Analytics almost illegal" is an editorialized (biased) title and that's not what the linked article says Yep. Also, from the HN guidelines: Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.

jsiepkes 4y ago
When the CNIL makes a statement saying it is impossible to legally use Google Analytics a title like "Q&A on the CNIL's formal notices concerning the use of Google Analytics" is simply not going to cut it. The fact that the title hasn't been edited even though the post is over 16 hours old seem to support the above hypothesis.