6 ms·

How can Europeans use Stripe when they can't use Google Fonts and Google Analytics on the grounds that sending even a single IP packet to a server under the con

by TekMol 4y ago

How can Europeans use Stripe when they can't use Google Fonts and Google Analytics on the grounds that sending even a single IP packet to a server under the control of a US company violates the GDPR?

Escapado 4y ago
Is that how it works? I thought as long as the user gives explicit consent to that happening it's fine. Most checkouts I have seen have a checkbox you need to check before being redirected to stripe/paypal and the likes which asks for explicit consent to the privacy policy rules.
- jon-wood 4y ago
  It's not even slightly how it works, and your interpretation is correct, so long as the customer has consented then you're fine. The issue with Google Fonts and Analytics is that the customer has very rarely consented to tracking (particularly with fonts), and in a great many cases even where there is a "I consent to tracking cookies" dialog the cookies were dropped before it was displayed.
  - deleted 4y ago
    [deleted]
  - smeagull 4y ago
    Sick of those stupid dialogs.
    - iso1631 4y ago
      Sick of sites tracking me
    - latexr 4y ago
      I find them to be good indicators of how bad a website/service is. The harder it is to dismiss the dialog while rejecting everything, the worse the service tends to be in other metrics. I think of those dialogs as big bright banners which advertise loud and clear how disrespectful a website is of its users. Noticing the pattern means I waste considerably less time on websites which aren’t worth it.
    - kzrdude 4y ago
      Yes, I can't believe we've created a system where those are the norm. But we also have real world cities plastered with billboards, so it's not like everything is clean, perfect and rational in our worlds.
    - parminya 4y ago
      Me too, I wish the companies would obey the law without putting in the consent banner. It's not like there's any law obliging them to put in the consent banners. They freely chose to piss us all off even though they had the alternative of behaving like perfectly profitable pre-internet businesses and ... not tracking us.
    - jeroenhd 4y ago
      You and me both, I wish websites would stop being so full of tracking crap so these stupid popups can finally disappear.
  - that_guy_iain 4y ago
    With Google Font decisions have been about consent. With Google Analytics it's been about the transfer of data to a US org when a US court can issue a FISA letter. Basically, a privacy lawyer from the Netherlands has been hammering Google in court repeatedly.
- that_guy_iain 4y ago
  The issue is, giving a US org data is considered a transfer of data to that the US since a US court can force a US org to turn over the data no matter where in the world it is located. US data laws are not compliant with GDPR. It's basically just down to the spy laws they have, for FISA letters I believe, without those they would be fine.
- TekMol 4y ago
  The issue is not related to consent but to "safeguards". GDPR requires that user data is guarded in certain ways, and European courts have ruled that no data can be sufficiently safeguarded if it is under control of a US company. Google "analytics gdpr safeguards" or see here for example: https://piwik.pro/blog/is-google-analytics-gdpr-compliant/ https://piwik.pro/blog/is-google-analytics-gdpr-compliant/ Especially the section "Does collecting visitors’ consent solve compliance issues with Google Analytics?".
trollied 4y ago
If anybody is wondering what the parent comment is referencing: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...
PeterisP 4y ago
One aspect of this is that data processing which is necessary to do what the customer explicitly requested is permitted (GDPR article 6.1.b). Making the payment for your purchase is such a thing and this processing is lawful, but doing analytics or tracking who viewed the site through fonts is not, and generally requires explicit opt-in consent.
that_guy_iain 4y ago
In theory, they can't. But no one is enforcing it because there is a plan to change the law.
- sgjohnson 4y ago
  No. Technically it's illegal to provide such service, not receive it. Fun fact, this very website is not GDPR compliant. I've never ever seen a cookie notice on HN, which is legally required. Of course, none of this is relevant, because AFAIK HN has no physical presence in the EU, but still, this site is not GDPR compliant, which just outlines how stupid GDPR actually is.
  - Semaphor 4y ago
    > I've never ever seen a cookie notice on HN, which is legally required. What for? The GDPR does not require consent for purely functional cookies, and the only data I see stored is my account cookie. So the existing privacy policy should cover them.
  - dgb23 4y ago
    Cookie notices are required if you for example use them to pass data to third parties. A login cookie that is just for auth is not that. It is specifically requested by the user and implies that the user's data is managed on that site and can be evicted. Same with analytics. The problem is not that you're doing analytics. It's that the user doesn't know that your doing it and that you're passing on that data to a third party.
    - Semaphor 4y ago
      It’s not just about third parties. I still need to consent to any PII you gather for your analytics, even if it’s completely first-party.
      - dgb23 4y ago
        Would have assumed that anonymous logging is fine? Generating usage data? Error logs? As long as it’s not sold, private data or used to identify the user? Highly doubt that kind of gathering is a problem. If it were you could close 95% of the web.
ptman 4y ago
Visa and MasterCard aren't in EU either. So you end up with US companies even when you use a local processor

by TekMol 4y ago

How can Europeans use Stripe when they can't use Google Fonts and Google Analytics on the grounds that sending even a single IP packet to a server under the control of a US company violates the GDPR?

Escapado 4y ago

Is that how it works? I thought as long as the user gives explicit consent to that happening it's fine. Most checkouts I have seen have a checkbox you need to check before being redirected to stripe/paypal and the likes which asks for explicit consent to the privacy policy rules.

jon-wood 4y ago
It's not even slightly how it works, and your interpretation is correct, so long as the customer has consented then you're fine. The issue with Google Fonts and Analytics is that the customer has very rarely consented to tracking (particularly with fonts), and in a great many cases even where there is a "I consent to tracking cookies" dialog the cookies were dropped before it was displayed.
- deleted 4y ago
  [deleted]
- smeagull 4y ago
  Sick of those stupid dialogs.
  - iso1631 4y ago
    Sick of sites tracking me
  - latexr 4y ago
    I find them to be good indicators of how bad a website/service is. The harder it is to dismiss the dialog while rejecting everything, the worse the service tends to be in other metrics. I think of those dialogs as big bright banners which advertise loud and clear how disrespectful a website is of its users. Noticing the pattern means I waste considerably less time on websites which aren’t worth it.
  - kzrdude 4y ago
    Yes, I can't believe we've created a system where those are the norm. But we also have real world cities plastered with billboards, so it's not like everything is clean, perfect and rational in our worlds.
  - parminya 4y ago
    Me too, I wish the companies would obey the law without putting in the consent banner. It's not like there's any law obliging them to put in the consent banners. They freely chose to piss us all off even though they had the alternative of behaving like perfectly profitable pre-internet businesses and ... not tracking us.
  - jeroenhd 4y ago
    You and me both, I wish websites would stop being so full of tracking crap so these stupid popups can finally disappear.
- that_guy_iain 4y ago
  With Google Font decisions have been about consent. With Google Analytics it's been about the transfer of data to a US org when a US court can issue a FISA letter. Basically, a privacy lawyer from the Netherlands has been hammering Google in court repeatedly.
that_guy_iain 4y ago
The issue is, giving a US org data is considered a transfer of data to that the US since a US court can force a US org to turn over the data no matter where in the world it is located. US data laws are not compliant with GDPR. It's basically just down to the spy laws they have, for FISA letters I believe, without those they would be fine.
TekMol 4y ago
The issue is not related to consent but to "safeguards". GDPR requires that user data is guarded in certain ways, and European courts have ruled that no data can be sufficiently safeguarded if it is under control of a US company. Google "analytics gdpr safeguards" or see here for example: https://piwik.pro/blog/is-google-analytics-gdpr-compliant/ https://piwik.pro/blog/is-google-analytics-gdpr-compliant/ Especially the section "Does collecting visitors’ consent solve compliance issues with Google Analytics?".

trollied 4y ago

If anybody is wondering what the parent comment is referencing: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...

PeterisP 4y ago

One aspect of this is that data processing which is necessary to do what the customer explicitly requested is permitted (GDPR article 6.1.b). Making the payment for your purchase is such a thing and this processing is lawful, but doing analytics or tracking who viewed the site through fonts is not, and generally requires explicit opt-in consent.

that_guy_iain 4y ago

In theory, they can't. But no one is enforcing it because there is a plan to change the law.

sgjohnson 4y ago
No. Technically it's illegal to provide such service, not receive it. Fun fact, this very website is not GDPR compliant. I've never ever seen a cookie notice on HN, which is legally required. Of course, none of this is relevant, because AFAIK HN has no physical presence in the EU, but still, this site is not GDPR compliant, which just outlines how stupid GDPR actually is.
- Semaphor 4y ago
  > I've never ever seen a cookie notice on HN, which is legally required. What for? The GDPR does not require consent for purely functional cookies, and the only data I see stored is my account cookie. So the existing privacy policy should cover them.
- dgb23 4y ago
  Cookie notices are required if you for example use them to pass data to third parties. A login cookie that is just for auth is not that. It is specifically requested by the user and implies that the user's data is managed on that site and can be evicted. Same with analytics. The problem is not that you're doing analytics. It's that the user doesn't know that your doing it and that you're passing on that data to a third party.
  - Semaphor 4y ago
    It’s not just about third parties. I still need to consent to any PII you gather for your analytics, even if it’s completely first-party.
    - dgb23 4y ago
      Would have assumed that anonymous logging is fine? Generating usage data? Error logs? As long as it’s not sold, private data or used to identify the user? Highly doubt that kind of gathering is a problem. If it were you could close 95% of the web.

ptman 4y ago

Visa and MasterCard aren't in EU either. So you end up with US companies even when you use a local processor