3 ms·
This feels redundant given that the current interpretation of EU privacy laws is that US companies can not be used under GDPR compliance because the EU-US Priva
by hnbad 4y ago
This feels redundant given that the current interpretation of EU privacy laws is that US companies can not be used under GDPR compliance because the EU-US Privacy Shield agreement has been killed by US courts ruling that federal agencies are allowed to access data stored on overseas servers. This also extends to EU subsidiaries of US companies but it seems that PostHog doesn't even try to make that distinction.
If your first thought is that this would render EU companies unable to use common cloud providers like AWS, Google Cloud or Azure, you're not wrong, although most EU companies are likely unaware of this as it's the outcome of a recent court case and not entirely settled.
As a EU resident I would advise EU companies to avoid all US service providers and their subsidiaries where possible, regardless of where their servers are located until the US legislature makes explicit guarantees protecting EU servers from being accessed by US law enforcement without going through the apropriate international channels (which would include notifying all affected EU residents of the access).
I realize this can't always be avoided but replacing Google Analytics with another US company over GDPR concerns seems a lot of effort for no effect when there are self-hosted and EU-based alternatives available.