11 ms·

Danish Data Protection Agency concludes Google Analytics cannot be used lawfully

312 points by ZacnyLos 4y ago

ZacnyLos 4y ago
There are tons of alternatives: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy...
deleted 4y ago
[deleted]
giuliomagnifico 4y ago
Stop using GA in Europe. There’re lots of other analytics services, don’t gift European data to Google.
- wombarly 4y ago
  >There’re lots of other analytics services Not really. The only actual competitor to GA is Matomo Analytics, the rest are just copies of each other with the same very basic feature set.
  - yakkomajuri 4y ago
    Actually there's a broad spectrum of alternatives out there covering different bits of functionality. GA4 particularly is a much broader product than the original Google Analytics. We keep a list here: https://isgoogleanalyticsillegal.com/alternatives https://isgoogleanalyticsillegal.com/alternatives
  - that_guy_iain 4y ago
    Yea but most of us only need a very basic feature set. Therefore all these other competitors you say aren#t actual competitors are competing and taking users away from Google.
  - drukenemo 4y ago
    Adobe Analytics is a fantastic web analytics platform. You seem to be misinformed.
    - Kye 4y ago
      I'm always wary of a price of "Get in touch." At least give me a range so I know if it's worth getting in touch. https://business.adobe.com/products/analytics/compare-adobe-analytics-packages.html https://business.adobe.com/products/analytics/compare-adobe-...
  - cgraf 4y ago
    Here is also a good list of european alternatives that can be used instead of Google Analytics: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy...
- closewith 4y ago
  Google Analytics is outclassed by many other tools, but it has two features that make it essential (along with its brethren, Google Ads tracking) for most enterprises. One is the Search Console integration, which is the only way to see what Google search queries led people to your site. The second is Google Ads conversion tracking and remarketing, which is de facto required to advertise with Google because it can easily 10x your Return On Advertising Spend, which is a key metric for digital marketing teams. Without those two features, Google Analytics would be easy to drop. Many big companies already have other first- or third-party analytics tools they prefer.
  - that_guy_iain 4y ago
    > One is the Search Console integration, which is the only way to see what Google search queries led people to your site. Don't most analytic tools have this? I know Plausible has Search Console Integration. The Google Ads conversion is the killer feature Google Analytics has in my opinion. But the reality is, most use it because it's defacto and free.
    - erik_seaberg 4y ago
      Didn’t Google add a hop so the Referer header no longer provides the actual search URL?
      - exikyut 4y ago
        Ooooooh that's why search results redirect to /url?... I thought it was just for click tracking on my end. Ha!
      - kurikuri 4y ago
        Breaking standards to protect a moat Ew
      - that_guy_iain 4y ago
        Yea but plausible integrates with the search console. Google probably has to provide some intergration ability which is why it’s possible.
- adrr 4y ago
  Are they free?
  - giuliomagnifico 4y ago
    Some yes, some not. Im using https://umami.is/ https://umami.is/ that is free (but I’m hosting it DigitalOcean VPS for few $/month). Better than pay a fine for using Google Analytics.
    - criddell 4y ago
      If there is some value in analytics, then paying for it shouldn’t be a problem. If the amount you are willing to pay is zero, then the value is so low that collecting the data probably doesn’t make any sense.
    - _a9 4y ago
      And for those that don't want to dive in to VPS/Dedis there are services like PikaPods[1] that spin up services for a good price. I've been running a Matomo instance for a couple months and didn't have to do any backend command line stuff On some apps they also give a percentage back to the developer so you'd be supporting them. [1] https://www.pikapods.com/apps#analytics https://www.pikapods.com/apps#analytics
  - cgraf 4y ago
    Here is a good list of European alternatives to Google Analytics. The products with free plans are marked as such in case you are specifically looking for them: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy... There are also some that are open source and can be self-hosted. Those are marked with an "open source" flag.
V__ 4y ago
> This has been particularly relevant as Google, following the first Austrian decision, has begun to provide additional settings in relation to what data can be collected by the tool. However, our conclusion is that the tool cannot, without more, be used lawfully. Even though Google has branches in Europe, again the website owners will get in legal trouble and not Google for offering a product which cannot be used legally. Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?
- googlryas 4y ago
  You can use google analytics legally in all of these areas that have deemed it illegal, because they're just saying it is illegal for common public-facing internet usage. You can still use google analytics for, say, corporate intranet sites in Denmark if you'd like.
  - Xylakant 4y ago
    I doubt you can. If the data collection is illegal under the GDPR (or it’s incarnation under danish law), then it won’t help if you don’t use it in a public facing context. The GDPR doesn’t make any difference between subjects that are employed by the entity collecting the data and others.
  - V__ 4y ago
    Sure, but that is not what Google is advertising, and it should be Google's responsibility to inform users about that. Exaggerated example: If I would buy a car which by design isn't road legal, and this design flaw would cause an accident killing someone. Normally the carmaker would be responsible. The carmaker couldn't say, well technically, it's only for use in your backyard, but you have to be a lawyer to know that, and our advertising isn't reflecting that at all. Somehow, Google get's away with such logic.
- stickfigure 4y ago
  > Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer? Pretty much all of them? Let's say you buy a humble walkie-talkie. It is your responsibility to operate it in regions where the specific RF bands it uses are legal.
aurora72 4y ago
- kmeisthax 4y ago
  No, the specific problem is that Americans can't comply with GDPR because they are American. This will be the state of EU law until America either repeals the CLOUD Act and shuts down the NSA, or copypastes GDPR into local law. I would prefer either to be honest.
  - Deukhoofd 4y ago
    The CLOUD act is one thing, but Section 702 of the Foreign Intelligence Surveillance Act is a far bigger problem. Allowing the FBI, CIA and NSA full access to all data regarding every non-American without a warrant required on every US internet service is a massive breach of privacy, and will always be a GDPR breach.
  - dataking 4y ago
    I'm not sure this is correct. The EU and US agreed "in principle" on a new privacy shield in the spring of this year [0]. Maybe third time is the charm? (I think this is the third attempt.) [0] https://www.politico.eu/article/privacy-shield-data-deal-joe-biden-ursula-von-der-leyen/ https://www.politico.eu/article/privacy-shield-data-deal-joe...
    - trasz 4y ago
      Hopefully not. EU has nothing to gain here.
- deleted 4y ago
  [deleted]
endisneigh 4y ago
I wonder if the conclusion of these sort of laws is just a segregated internet
- zeruch 4y ago
  It's already here. (Web3 will exacerbate it). Seriously, in terms of a 'segregated' network, we already see giant walled gardens and their pseudo-kin everywhere, and web3's sole focus seems on monetization of anything online, which won't help that one iota.
- throwaway5920 4y ago
  It is inevitable. The only question is to what ends. EU is very focused on a maximalist vision of privacy. US is focused on security with a touch of woke censorship. China couldn’t care less about privacy but is obsessed about keeping out foreign influence and heavily censoring cultural and political content.
  - bee_rider 4y ago
    Hopefully European VPN providers can capitalize on this. Even if it is just a tiny boost to the local economy, always nice when a populace is rewarded selecting reasonable politicians.
  - spookie 4y ago
    I wonder who is in the right here
  - dmitriid 4y ago
    > US is focused on security with a touch of woke censorship. The US couldn't care less about security. Their approach is "we buy and sell your data and if you are in the US the government can use any and all data at any point for any reason". European view isn't maximalist in the least. Europe, thankfully, still still remembers lessons learned from data exposure to Stasi police.
- npteljes 4y ago
  Segregation is the easiest path here, similar to how centralization is simpler than a peer-to-peer system. But it's just an incentive among the many, so there's no reason to reach that extreme. For example with GDPR, some American news sites just flat-out deny serving the pages to European IPs, but not all of them - many show a different presentation (like NPR), or otherwise tailor the website to make it compliant.
wazoox 4y ago
I removed GA from all my websites a few months ago. It didn't provide any interesting information anyway. I actually get better data with Webalizer and a couple of custom scripts.
- djbusby 4y ago
  Care to share these script?
lwn 4y ago
>> One possible technical measure that may be relevant when using Google Analytics is pseudonymisation. Under GDPR pseudonymisation is considered to be reversible and therefor still falls within the scope of personal data. [source: https://ec.europa.eu/research/participants/data/ref/h2020/grants_manual/hi/ethics/h2020_hi_ethics-data-protection_en.pdf https://ec.europa.eu/research/participants/data/ref/h2020/gr... ]
- lmkg 4y ago
  Whether it's personal data is not the issue. The issue is whether US law enforcement has unrestricted access to the data. They are considered to have unrestricted access to any data on Google's servers (even their EU servers). But if re-identification requires a piece of data which only lives outside of US jurisdiction, and accessing that data requires going through appropriate channels, then the data is considered safeguarded.
skybrian 4y ago
And yet, has anyone ever been harmed by Google Analytics? How would we know?
- spookie 4y ago
  This has been answered in the thread, but the tl;dr is that it compromises European rights. Poor Google :'(
  - skybrian 4y ago
    How important can these rights be if compromising them harms nobody? You could have the right to name an asteroid, but it's not an important right.
    - criddell 4y ago
      Do you think Google has ever been served a court order requiring them to share information on a user and not inform the user? If so, then probably some people have been harmed.
      - skybrian 4y ago
        That doesn't follow, and it seems doubtful whether it ever happened. Google has received court orders about other user data like Gmail, but have they ever gotten a court order about Google Analytics? That data isn't associated with Google accounts, and I doubt law enforcement would know what to ask for.
        criddell 4y ago
        If GA cannot be associated with an individual, why do you think the Danish Data Protection Agency cares?
- belorn 4y ago
  We know from scandals and leaks that google has access to citizens sensitive data from multiple nations, with privileged access that handles medical, military, political, commercial, and legal information. No one should hold that much power.
RileyJames 4y ago
GA4 seems to be a big shot in the foot too. I’m sure it’s powerful, but by default it doesn’t show me what I need to know. The old GA did. And now I’ve moved to paid, but basic products (plausible) which do show me those important details, instantly. Traffic trends, sources, referrers, goals.
- geoduck14 4y ago
  Serious question: If I'm getting traffic data from my load balancer, what will GA or Plausible offer me that I don't already have?
bigwindow1 4y ago
I recently removed Google Analytics from my websites and set up the self-hosted umami (https://umami.is/ https://umami.is/) analytics. One of the best things about it is how fast it opens, while GA is so laggy.
- djbusby 4y ago
  Can't tell from the demo - has ability to track 404s?
  - mcao 4y ago
    Yes, if you display a custom 404 page.
- jdthedisciple 4y ago
  Umami seems perfect! Thank you Ive been looking for something good other than GA to use on my clients WP site.
- throwandway123 4y ago
  Is there something like umami, except it does collect valuable data about users? I would actually like self hosted analytics so that it's on my domain and effectively not blockable, and also to know valuable insights about them.
  - tpxl 4y ago
    > valuable insights about them An important question to ask yourself: _what_ insights? Want to know which of your pages are popular? Server logs will tell you that. Want to know how the users move across your website? Server logs can tell you that, albeit in a limited fashion. Want to know where your users come from? Server logs. For more advanced use-cases, you may need javascript on the frontend (which you can serve from your own domain, making it harder to block, but still needing to be GDPR compliant, if you serve to GDPR affected users).
dom96 4y ago
I keep seeing these and wondering why Google isn't doing anything about this. Surely it should at the very least tell Google Analytics users based out of the EU that they need to stop using its services? Isn't Google in hot water here for not doing this?
- Bakary 4y ago
  So far the fines have been laughable compared to their revenue
  - openplatypus 4y ago
    In case of GA be aware that Google is merely a Data Processor. You, the website operator are the Data Controller in this relationship. If you use GA for web analytics it is website operator problem, not Google's.
- anothernewdude 4y ago
  More people that actually use GA, the less bad it will be. If everybody does it, it becomes De Facto legal, and makes it clear how little authority the Danish government has. Laws that aren't enforced, or that have little bite, aren't really laws.
- deleted 4y ago
  [deleted]
- SpicyLemonZest 4y ago
  Google's position (https://blog.google/around-the-globe/google-europe/its-time-for-a-new-eu-us-data-transfer-framework/ https://blog.google/around-the-globe/google-europe/its-time-...), which broadly aligns with my own understanding of the situation, is that this is a proxy battle and the only real solution is to negotiate a new EU-US privacy shield. The premise of these decisions isn't that Google itself has any known privacy or security issues, but that any servers which are physically located in the US can't be trusted under EU privacy laws.
  - deleted 4y ago
ghostpepper 4y ago
Do they say why it cannot be used lawfully or what "more" would be required to make it lawful?
- openplatypus 4y ago
  Why: ShremsII ruling in essence. Any operator under the influence of US authorities requires additional measures to secure data. More: add additional measures beyond those provided by GA. Hosting a proxy and anonymizing the data before it reaches GA might be an option. At this point, it is easier and cheaper to find GDPR compliant alternative.
basquiyacht 4y ago
Using Simple Analytics here. Not self-hosted but privacy-friendly and cookieless by design.
AdriaanvRossum 4y ago
For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. In February 2022 The Data Protection Authority of France (CNIL) followed [5] 6. In June 2022 the Data Protection Authority of Italy (Garante) followed [6] 7. Now, September 2022, Denmark – after already banning Google Workspace for municipalities [7] – considers Google Analytics unlawful as well [8] This is a sound decision, but not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact. PS: I'm the founder of Simple Analytics [9] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://blog.simpleanalytics.com/will-google-analytics-be-banned-in-the-eu https://blog.simpleanalytics.com/will-google-analytics-be-ba... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... [6] https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782874#english https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... [7] https://www.simpleanalytics.com/blog/denmark-bans-google-workspace-for-municipalities https://www.simpleanalytics.com/blog/denmark-bans-google-wor... (includes translated version) [8] https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... (this thread) [9] https://www.simpleanalytics.com/ https://www.simpleanalytics.com/
- dataking 4y ago
  Thanks for you summary! I, for one, needed it. Can you comment on why the BSB found that anonymized IP addresses are personal data (3rd point). Is it because the anonymization is too weak? Edit: seems GA only masks the last octet of an IP4 address.
senko 4y ago
I'm a happy Plausible (https://plausible.io/ https://plausible.io/) paying user. Simple to use (few features compared to GA, but exactly those I need), respects privacy, and has fair pricing.
userbinator 4y ago
GA is probably among the oldest entries being blocked in my HOSTS file.

312 points by ZacnyLos 4y ago

There are tons of alternatives: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy...

deleted 4y ago

[deleted]

giuliomagnifico 4y ago

Stop using GA in Europe. There’re lots of other analytics services, don’t gift European data to Google.

wombarly 4y ago
>There’re lots of other analytics services Not really. The only actual competitor to GA is Matomo Analytics, the rest are just copies of each other with the same very basic feature set.
- yakkomajuri 4y ago
  Actually there's a broad spectrum of alternatives out there covering different bits of functionality. GA4 particularly is a much broader product than the original Google Analytics. We keep a list here: https://isgoogleanalyticsillegal.com/alternatives https://isgoogleanalyticsillegal.com/alternatives
- that_guy_iain 4y ago
  Yea but most of us only need a very basic feature set. Therefore all these other competitors you say aren#t actual competitors are competing and taking users away from Google.
- drukenemo 4y ago
  Adobe Analytics is a fantastic web analytics platform. You seem to be misinformed.
  - Kye 4y ago
    I'm always wary of a price of "Get in touch." At least give me a range so I know if it's worth getting in touch. https://business.adobe.com/products/analytics/compare-adobe-analytics-packages.html https://business.adobe.com/products/analytics/compare-adobe-...
- cgraf 4y ago
  Here is also a good list of european alternatives that can be used instead of Google Analytics: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy...
closewith 4y ago
Google Analytics is outclassed by many other tools, but it has two features that make it essential (along with its brethren, Google Ads tracking) for most enterprises. One is the Search Console integration, which is the only way to see what Google search queries led people to your site. The second is Google Ads conversion tracking and remarketing, which is de facto required to advertise with Google because it can easily 10x your Return On Advertising Spend, which is a key metric for digital marketing teams. Without those two features, Google Analytics would be easy to drop. Many big companies already have other first- or third-party analytics tools they prefer.
- that_guy_iain 4y ago
  > One is the Search Console integration, which is the only way to see what Google search queries led people to your site. Don't most analytic tools have this? I know Plausible has Search Console Integration. The Google Ads conversion is the killer feature Google Analytics has in my opinion. But the reality is, most use it because it's defacto and free.
  - erik_seaberg 4y ago
    Didn’t Google add a hop so the Referer header no longer provides the actual search URL?
    - exikyut 4y ago
      Ooooooh that's why search results redirect to /url?... I thought it was just for click tracking on my end. Ha!
    - kurikuri 4y ago
      Breaking standards to protect a moat Ew
    - that_guy_iain 4y ago
      Yea but plausible integrates with the search console. Google probably has to provide some intergration ability which is why it’s possible.
adrr 4y ago
Are they free?
- giuliomagnifico 4y ago
  Some yes, some not. Im using https://umami.is/ https://umami.is/ that is free (but I’m hosting it DigitalOcean VPS for few $/month). Better than pay a fine for using Google Analytics.
  - criddell 4y ago
    If there is some value in analytics, then paying for it shouldn’t be a problem. If the amount you are willing to pay is zero, then the value is so low that collecting the data probably doesn’t make any sense.
  - _a9 4y ago
    And for those that don't want to dive in to VPS/Dedis there are services like PikaPods[1] that spin up services for a good price. I've been running a Matomo instance for a couple months and didn't have to do any backend command line stuff On some apps they also give a percentage back to the developer so you'd be supporting them. [1] https://www.pikapods.com/apps#analytics https://www.pikapods.com/apps#analytics
- cgraf 4y ago
  Here is a good list of European alternatives to Google Analytics. The products with free plans are marked as such in case you are specifically looking for them: https://european-alternatives.eu/alternative-to/google-analytics https://european-alternatives.eu/alternative-to/google-analy... There are also some that are open source and can be self-hosted. Those are marked with an "open source" flag.

V__ 4y ago

> This has been particularly relevant as Google, following the first Austrian decision, has begun to provide additional settings in relation to what data can be collected by the tool. However, our conclusion is that the tool cannot, without more, be used lawfully. Even though Google has branches in Europe, again the website owners will get in legal trouble and not Google for offering a product which cannot be used legally. Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?

googlryas 4y ago
You can use google analytics legally in all of these areas that have deemed it illegal, because they're just saying it is illegal for common public-facing internet usage. You can still use google analytics for, say, corporate intranet sites in Denmark if you'd like.
- Xylakant 4y ago
  I doubt you can. If the data collection is illegal under the GDPR (or it’s incarnation under danish law), then it won’t help if you don’t use it in a public facing context. The GDPR doesn’t make any difference between subjects that are employed by the entity collecting the data and others.
- V__ 4y ago
  Sure, but that is not what Google is advertising, and it should be Google's responsibility to inform users about that. Exaggerated example: If I would buy a car which by design isn't road legal, and this design flaw would cause an accident killing someone. Normally the carmaker would be responsible. The carmaker couldn't say, well technically, it's only for use in your backyard, but you have to be a lawyer to know that, and our advertising isn't reflecting that at all. Somehow, Google get's away with such logic.
stickfigure 4y ago
> Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer? Pretty much all of them? Let's say you buy a humble walkie-talkie. It is your responsibility to operate it in regions where the specific RF bands it uses are legal.

aurora72 4y ago

kmeisthax 4y ago
No, the specific problem is that Americans can't comply with GDPR because they are American. This will be the state of EU law until America either repeals the CLOUD Act and shuts down the NSA, or copypastes GDPR into local law. I would prefer either to be honest.
- Deukhoofd 4y ago
  The CLOUD act is one thing, but Section 702 of the Foreign Intelligence Surveillance Act is a far bigger problem. Allowing the FBI, CIA and NSA full access to all data regarding every non-American without a warrant required on every US internet service is a massive breach of privacy, and will always be a GDPR breach.
- dataking 4y ago
  I'm not sure this is correct. The EU and US agreed "in principle" on a new privacy shield in the spring of this year [0]. Maybe third time is the charm? (I think this is the third attempt.) [0] https://www.politico.eu/article/privacy-shield-data-deal-joe-biden-ursula-von-der-leyen/ https://www.politico.eu/article/privacy-shield-data-deal-joe...
  - trasz 4y ago
    Hopefully not. EU has nothing to gain here.
deleted 4y ago
[deleted]

endisneigh 4y ago

I wonder if the conclusion of these sort of laws is just a segregated internet

zeruch 4y ago
It's already here. (Web3 will exacerbate it). Seriously, in terms of a 'segregated' network, we already see giant walled gardens and their pseudo-kin everywhere, and web3's sole focus seems on monetization of anything online, which won't help that one iota.
throwaway5920 4y ago
It is inevitable. The only question is to what ends. EU is very focused on a maximalist vision of privacy. US is focused on security with a touch of woke censorship. China couldn’t care less about privacy but is obsessed about keeping out foreign influence and heavily censoring cultural and political content.
- bee_rider 4y ago
  Hopefully European VPN providers can capitalize on this. Even if it is just a tiny boost to the local economy, always nice when a populace is rewarded selecting reasonable politicians.
- spookie 4y ago
  I wonder who is in the right here
- dmitriid 4y ago
  > US is focused on security with a touch of woke censorship. The US couldn't care less about security. Their approach is "we buy and sell your data and if you are in the US the government can use any and all data at any point for any reason". European view isn't maximalist in the least. Europe, thankfully, still still remembers lessons learned from data exposure to Stasi police.
npteljes 4y ago
Segregation is the easiest path here, similar to how centralization is simpler than a peer-to-peer system. But it's just an incentive among the many, so there's no reason to reach that extreme. For example with GDPR, some American news sites just flat-out deny serving the pages to European IPs, but not all of them - many show a different presentation (like NPR), or otherwise tailor the website to make it compliant.

wazoox 4y ago

I removed GA from all my websites a few months ago. It didn't provide any interesting information anyway. I actually get better data with Webalizer and a couple of custom scripts.

djbusby 4y ago
Care to share these script?

lwn 4y ago

>> One possible technical measure that may be relevant when using Google Analytics is pseudonymisation. Under GDPR pseudonymisation is considered to be reversible and therefor still falls within the scope of personal data. [source: https://ec.europa.eu/research/participants/data/ref/h2020/grants_manual/hi/ethics/h2020_hi_ethics-data-protection_en.pdf https://ec.europa.eu/research/participants/data/ref/h2020/gr... ]

lmkg 4y ago
Whether it's personal data is not the issue. The issue is whether US law enforcement has unrestricted access to the data. They are considered to have unrestricted access to any data on Google's servers (even their EU servers). But if re-identification requires a piece of data which only lives outside of US jurisdiction, and accessing that data requires going through appropriate channels, then the data is considered safeguarded.

skybrian 4y ago

And yet, has anyone ever been harmed by Google Analytics? How would we know?

spookie 4y ago
This has been answered in the thread, but the tl;dr is that it compromises European rights. Poor Google :'(
- skybrian 4y ago
  How important can these rights be if compromising them harms nobody? You could have the right to name an asteroid, but it's not an important right.
  - criddell 4y ago
    Do you think Google has ever been served a court order requiring them to share information on a user and not inform the user? If so, then probably some people have been harmed.
    - skybrian 4y ago
      That doesn't follow, and it seems doubtful whether it ever happened. Google has received court orders about other user data like Gmail, but have they ever gotten a court order about Google Analytics? That data isn't associated with Google accounts, and I doubt law enforcement would know what to ask for.
      - criddell 4y ago
        If GA cannot be associated with an individual, why do you think the Danish Data Protection Agency cares?
belorn 4y ago
We know from scandals and leaks that google has access to citizens sensitive data from multiple nations, with privileged access that handles medical, military, political, commercial, and legal information. No one should hold that much power.

RileyJames 4y ago

GA4 seems to be a big shot in the foot too. I’m sure it’s powerful, but by default it doesn’t show me what I need to know. The old GA did. And now I’ve moved to paid, but basic products (plausible) which do show me those important details, instantly. Traffic trends, sources, referrers, goals.

geoduck14 4y ago
Serious question: If I'm getting traffic data from my load balancer, what will GA or Plausible offer me that I don't already have?

bigwindow1 4y ago

I recently removed Google Analytics from my websites and set up the self-hosted umami (https://umami.is/ https://umami.is/) analytics. One of the best things about it is how fast it opens, while GA is so laggy.

djbusby 4y ago
Can't tell from the demo - has ability to track 404s?
- mcao 4y ago
  Yes, if you display a custom 404 page.
jdthedisciple 4y ago
Umami seems perfect! Thank you Ive been looking for something good other than GA to use on my clients WP site.
throwandway123 4y ago
Is there something like umami, except it does collect valuable data about users? I would actually like self hosted analytics so that it's on my domain and effectively not blockable, and also to know valuable insights about them.
- tpxl 4y ago
  > valuable insights about them An important question to ask yourself: _what_ insights? Want to know which of your pages are popular? Server logs will tell you that. Want to know how the users move across your website? Server logs can tell you that, albeit in a limited fashion. Want to know where your users come from? Server logs. For more advanced use-cases, you may need javascript on the frontend (which you can serve from your own domain, making it harder to block, but still needing to be GDPR compliant, if you serve to GDPR affected users).

dom96 4y ago

I keep seeing these and wondering why Google isn't doing anything about this. Surely it should at the very least tell Google Analytics users based out of the EU that they need to stop using its services? Isn't Google in hot water here for not doing this?

Bakary 4y ago
So far the fines have been laughable compared to their revenue
- openplatypus 4y ago
  In case of GA be aware that Google is merely a Data Processor. You, the website operator are the Data Controller in this relationship. If you use GA for web analytics it is website operator problem, not Google's.
anothernewdude 4y ago
More people that actually use GA, the less bad it will be. If everybody does it, it becomes De Facto legal, and makes it clear how little authority the Danish government has. Laws that aren't enforced, or that have little bite, aren't really laws.
deleted 4y ago
[deleted]
SpicyLemonZest 4y ago
Google's position (https://blog.google/around-the-globe/google-europe/its-time-for-a-new-eu-us-data-transfer-framework/ https://blog.google/around-the-globe/google-europe/its-time-...), which broadly aligns with my own understanding of the situation, is that this is a proxy battle and the only real solution is to negotiate a new EU-US privacy shield. The premise of these decisions isn't that Google itself has any known privacy or security issues, but that any servers which are physically located in the US can't be trusted under EU privacy laws.
- deleted 4y ago

ghostpepper 4y ago

Do they say why it cannot be used lawfully or what "more" would be required to make it lawful?

openplatypus 4y ago
Why: ShremsII ruling in essence. Any operator under the influence of US authorities requires additional measures to secure data. More: add additional measures beyond those provided by GA. Hosting a proxy and anonymizing the data before it reaches GA might be an option. At this point, it is easier and cheaper to find GDPR compliant alternative.

basquiyacht 4y ago

Using Simple Analytics here. Not self-hosted but privacy-friendly and cookieless by design.

AdriaanvRossum 4y ago

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. In February 2022 The Data Protection Authority of France (CNIL) followed [5] 6. In June 2022 the Data Protection Authority of Italy (Garante) followed [6] 7. Now, September 2022, Denmark – after already banning Google Workspace for municipalities [7] – considers Google Analytics unlawful as well [8] This is a sound decision, but not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact. PS: I'm the founder of Simple Analytics [9] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://blog.simpleanalytics.com/will-google-analytics-be-banned-in-the-eu https://blog.simpleanalytics.com/will-google-analytics-be-ba... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... [6] https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782874#english https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... [7] https://www.simpleanalytics.com/blog/denmark-bans-google-workspace-for-municipalities https://www.simpleanalytics.com/blog/denmark-bans-google-wor... (includes translated version) [8] https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... (this thread) [9] https://www.simpleanalytics.com/ https://www.simpleanalytics.com/

dataking 4y ago
Thanks for you summary! I, for one, needed it. Can you comment on why the BSB found that anonymized IP addresses are personal data (3rd point). Is it because the anonymization is too weak? Edit: seems GA only masks the last octet of an IP4 address.

senko 4y ago

I'm a happy Plausible (https://plausible.io/ https://plausible.io/) paying user. Simple to use (few features compared to GA, but exactly those I need), respects privacy, and has fair pricing.

userbinator 4y ago

GA is probably among the oldest entries being blocked in my HOSTS file.