3 ms·

Unfortunately a lot of sites are mis-adviced about the GDPR. In fact, a good percentage (most?) of the cookie pop-ups are illegal under the GDPR. European Data

Unfortunately a lot of sites are mis-adviced about the GDPR. In fact, a good percentage (most?) of the cookie pop-ups are illegal under the GDPR. European Data Protection Authorities (DPAs)in Austria, France, and Italy have ruled that Google Analytics violates the law: https://www.natlawreview.com/article/google-analytics-runs-afoul-gdpr https://www.natlawreview.com/article/google-analytics-runs-a... France’s data watchdog warns over illegal use of Google Analytics: https://techcrunch.com/2022/06/08/google-analytics-gdpr-breach-cnil/ https://techcrunch.com/2022/06/08/google-analytics-gdpr-brea... Italy Bans Google Analytics Over Improper EU-US Data Transfers: https://www.cpomagazine.com/data-protection/italy-bans-google-analytics-over-improper-eu-us-data-transfers/ https://www.cpomagazine.com/data-protection/italy-bans-googl... Austrian website’s use of Google Analytics found to breach GDPR: https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ ... all this from a quick Google search.

cinntaile 4y ago
Those decisions are all from 2022. GDPR has existed since 2016 and GA wasn't an issue then so a recent ruling must have happened that changed this. But sure enough, it means I am wrong.
- elondaits 4y ago
  The GDPR came in effect in 2018 (May 25). When it did, most companies scrambled to comply. Back then I researched the analytics situation and can say from what I remember (and my POV): - It was super clear it was a touchy subject, because you're basically disclosing private information (IP, tech capabilities, some browsing history, etc.) to a third party who may or may not comply with GDPR's basic requirements about data protection, right to be forgotten, etc. - It was super clear there were some minimum requirements, like anonymizing IPs, limiting storage of data, storing the data in Europe, or making sure URLs didn't disclose personal information. - Google didn't say much about compliance of GA. Their text was more about shifting the responsibility to web admins. Possibly because there were some doubts, like the validity of the Privacy Shield, which eventually was deemed invalid. - Other analytics tools, like Matomo, offered configuration settings for anonymizing visitors and limiting storage. - It was often suggested you could solve the issues by having users opt-in to analytics. e.g. "This tool by itself is not in violation, you are in violation if you didn't ask for consent before using it". The "guns don't kill people" argument. However, anyone would agree that if you can only track consenting people your analytics get super skewed, maybe to the point of being useless. One of the main issues back then was that the GDPR doesn't talk about cookies at all, because a separate legislation (updating the existing ones) was going to cover that afterwards. This created a lot of doubts of whether an analytics solution based on cookies (without opt-in) could even be compliant at all. Current understanding is that certain cookies (e.g. login cookies) are and will be OK, while others (cross-site tracking) are absolutely not. I think the reason decisions started coming as late as 2022 is because implementation was super late, and people are still learning about these things. There are still a lot of touchy subjects, like how to deal with YouTube embeds, Google Maps, etc.

cinntaile 4y ago

Those decisions are all from 2022. GDPR has existed since 2016 and GA wasn't an issue then so a recent ruling must have happened that changed this. But sure enough, it means I am wrong.

elondaits 4y ago
The GDPR came in effect in 2018 (May 25). When it did, most companies scrambled to comply. Back then I researched the analytics situation and can say from what I remember (and my POV): - It was super clear it was a touchy subject, because you're basically disclosing private information (IP, tech capabilities, some browsing history, etc.) to a third party who may or may not comply with GDPR's basic requirements about data protection, right to be forgotten, etc. - It was super clear there were some minimum requirements, like anonymizing IPs, limiting storage of data, storing the data in Europe, or making sure URLs didn't disclose personal information. - Google didn't say much about compliance of GA. Their text was more about shifting the responsibility to web admins. Possibly because there were some doubts, like the validity of the Privacy Shield, which eventually was deemed invalid. - Other analytics tools, like Matomo, offered configuration settings for anonymizing visitors and limiting storage. - It was often suggested you could solve the issues by having users opt-in to analytics. e.g. "This tool by itself is not in violation, you are in violation if you didn't ask for consent before using it". The "guns don't kill people" argument. However, anyone would agree that if you can only track consenting people your analytics get super skewed, maybe to the point of being useless. One of the main issues back then was that the GDPR doesn't talk about cookies at all, because a separate legislation (updating the existing ones) was going to cover that afterwards. This created a lot of doubts of whether an analytics solution based on cookies (without opt-in) could even be compliant at all. Current understanding is that certain cookies (e.g. login cookies) are and will be OK, while others (cross-site tracking) are absolutely not. I think the reason decisions started coming as late as 2022 is because implementation was super late, and people are still learning about these things. There are still a lot of touchy subjects, like how to deal with YouTube embeds, Google Maps, etc.