7 ms·

Finland is the latest EU country to crack down on Google Analytics

deleted 4y ago
[deleted]
granzymes 4y ago
This is happening over concerns that the US government could require Google to hand over data, but the EU and the US are reasonable actors who realize that data sharing between the continents is necessary for free trade and are incentivized to come up with a solution. Doubtful this ends up mattering. Case in point, the article acknowledges the new Trans-Atlantic Data Privacy Framework (https://cdp.cooley.com/european-commission-approves-trans-at https://cdp.cooley.com/european-commission-approves-trans-at...) signed in December which will (attempt to) cure the deficiencies under the current agreement. You should expect that the EU and the US will keep pumping these out until one of them sticks. No one is going to ban Google Analytics, and the fact that this article was written by a competitor did not go unnoticed.
- atoav 4y ago
  > No one is going to ban Google Analytics. The fact that this article was written by a competitor did not go unnoticed. It is already non-compliant with the GDPR according to EU data privacy regulators for precisely that reason after the Austrian data privacy regulator declared it illegal. I had customers scrambling to remove google analytics because they feared visitors/lawyers suing them for that GDPR violation. Also fines up to 4% of the concerns world wide sales volume might not be a joke to your company. So yeah technically nobody is going to ban google analytics, because they already did..
  - granzymes 4y ago
    You should tell your clients that there are still compliant ways to integrate Google Analytics even assuming the new legal framework doesn't stick. But the Trans-Atlantic Data Privacy Framework was signed in December, so the current GDPR rulings are a moot point since those were about Privacy Shield. Should take another few years to find out what the courts think of the latest agreement. Eventually one of them will work.
    - stiray 4y ago
      And NOYB is already preparing to take it down, like it did with previous agreement. https://noyb.eu/en/open-letter-future-eu-us-data-transfers https://noyb.eu/en/open-letter-future-eu-us-data-transfers I just dont understand why would you dangle left and right with your businesses. Why don't you just set up a local analytics (there are bunch of oss alternatives) and get rid of google analytics?
      - hakre 4y ago
        Also I don't get it. People sometimes seemed to be obsessed by analytics that much they forget making their website. And then replace doing the real work with decisions by numbers they get out of "Analytics". And all that on the cost of the privacy of the customer. Often only for negative gain.
    - atoav 4y ago
      What I tell my clients is that it is their responsibility to care about their customer's data and that I as a customer certainly feel better about brands that treat me well.
    - wkat4242 4y ago
      I doubt one of them will really work. The US and EU have a very different concept of privacy. Not just for government espionage (US citizens have good protection but everyone else is fair game) but also for commercial purposes. For us in the EU everything should be opt-in, a bit like Apple does on iOS but Google refuses to implement on Android. It's really telling that the politicians have no recourse but to try the same thing over and over again instead of just coming up with a real solution. There probably isn't one.
    - hakre 4y ago
      alternatively you could also tell your clients about how costly that is, which cheaper and more user-friendly alternatives exists. also if you stop using analytics and do this right, you gain performance and visits and keep your site on the right track. but that's an art, not a product to sell, sorry.
- rado 4y ago
  Isn't it already banned in these 5 countries, or the ban isn't being followed? https://www.isgoogleanalyticsillegal.com https://www.isgoogleanalyticsillegal.com
  - granzymes 4y ago
    Privacy Shield was invalidated in 2020, which didn't make Google Analytics illegal but increased the burden of implementing it. If you aren't making use of more advanced features, you could be non-compliant. That site is, hilariously, also a product of a Google Analytics competitor. The new Trans-Atlantic Data Privacy Framework replaces Privacy Shield and so for the moment out of the box Google Analytics is fine again. This is what I meant by my comment above. The US and the EU will find a way to make data sharing work, no matter how many agreements it takes.
    - mananaysiempre 4y ago
      “This new [framework] is very closely modelled on the old [framework], isn’t it?” That is, the CJEU says that people ought to be able to sue the host country regarding their privacy rights, the US says no way foreigners have privacy rights (that they can sue the US over, in something that is actually part of the judiciary), US and EU diplomats set up some sort of agreement and announce it loudly, privacy activists sue, half a dozen years pass, the CJEU says the agreement hasn’t actually fixed anything about the US system, rinse and repeat for the last two decades. This is starting to seem like a deliberate stall, honestly, and I’m not sure how it could be prevented.
- david_draco 4y ago
  "No one is going to ban Google Analytics" -- no need to explicitly ban individual products, the rules are written down in GDPR
- stiray 4y ago
  It is already banned in Austria, France, Italy and recently Denmark and this is only rolling further.
tofflos 4y ago
Good for them! Citizens should be able to interact with government without being tracked. I'm not against the idea that government uses analytics, or even outsources analytics operations, as long as there is enforceable regulation preventing that data from being used for other purposes and a reasonable amount of money is being exchanged. When you pay nothing, or next to nothing, it becomes obvious that the underlying business model is, at least partially, based on selling ads or personal information.
- mike_hock 4y ago
  There's no enforceable regulation regarding what happens to data after it has disappeared in a black box. And paying money doesn't remove the underlying mechanism that made the "free" model viable in the first place. The incentive to use it on top of charging for the service is still there. (That's how you get microtransactions and pay-to-win in games that you've already paid for, for example.)
AdriaanvRossum 4y ago
For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. In February 2022 The Data Protection Authority of France (CNIL) followed [5] 6. In June 2022 the Data Protection Authority of Italy (Garante) followed [6] 7. September 2022, Denmark – after already banning Google Workspace for municipalities [7] – considers Google Analytics unlawful as well [8] 8. Now, February 2023, Finland rules against the use of Google Analytics [9] This is a sound decision, but – as others pointed out – not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact when it happens per country. PS: I'm the founder of Simple Analytics [10] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://www.simpleanalytics.com/blog/will-google-analytics-be-banned-in-the-eu https://www.simpleanalytics.com/blog/will-google-analytics-b... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... [6] https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782874#english https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... [7] https://www.simpleanalytics.com/blog/denmark-bans-google-workspace-for-municipalities https://www.simpleanalytics.com/blog/denmark-bans-google-wor... (includes translated version) [8] https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... [9] https://www.simpleanalytics.com/blog/finland-is-latest-eu-country-to-crack-down-on-google-analytics https://www.simpleanalytics.com/blog/finland-is-latest-eu-co... [10] https://www.simpleanalytics.com/ https://www.simpleanalytics.com/
KronisLV 4y ago
For anyone curious about viable alternatives, personally Matomo Analytics is good. You can anonymize IP addresses, go fully cookieless, but also use GeoIP if needed (at least for rough locations, depending on how much of the original address you choose to leave). I've been using it for a few years, it also seems to be fairly easy to run and has most of the features that I'd expect: https://matomo.org/ https://matomo.org/ For something simpler (less focus on page transitions, device and performance metrics etc.) I've also heard good things about Plausible Analytics which advertise being cookieless and compliant with various legislation as well: https://plausible.io/ https://plausible.io/

deleted 4y ago

[deleted]

This is happening over concerns that the US government could require Google to hand over data, but the EU and the US are reasonable actors who realize that data sharing between the continents is necessary for free trade and are incentivized to come up with a solution. Doubtful this ends up mattering. Case in point, the article acknowledges the new Trans-Atlantic Data Privacy Framework (https://cdp.cooley.com/european-commission-approves-trans-at https://cdp.cooley.com/european-commission-approves-trans-at...) signed in December which will (attempt to) cure the deficiencies under the current agreement. You should expect that the EU and the US will keep pumping these out until one of them sticks. No one is going to ban Google Analytics, and the fact that this article was written by a competitor did not go unnoticed.

atoav 4y ago
> No one is going to ban Google Analytics. The fact that this article was written by a competitor did not go unnoticed. It is already non-compliant with the GDPR according to EU data privacy regulators for precisely that reason after the Austrian data privacy regulator declared it illegal. I had customers scrambling to remove google analytics because they feared visitors/lawyers suing them for that GDPR violation. Also fines up to 4% of the concerns world wide sales volume might not be a joke to your company. So yeah technically nobody is going to ban google analytics, because they already did..
- granzymes 4y ago
  You should tell your clients that there are still compliant ways to integrate Google Analytics even assuming the new legal framework doesn't stick. But the Trans-Atlantic Data Privacy Framework was signed in December, so the current GDPR rulings are a moot point since those were about Privacy Shield. Should take another few years to find out what the courts think of the latest agreement. Eventually one of them will work.
  - stiray 4y ago
    And NOYB is already preparing to take it down, like it did with previous agreement. https://noyb.eu/en/open-letter-future-eu-us-data-transfers https://noyb.eu/en/open-letter-future-eu-us-data-transfers I just dont understand why would you dangle left and right with your businesses. Why don't you just set up a local analytics (there are bunch of oss alternatives) and get rid of google analytics?
    - hakre 4y ago
      Also I don't get it. People sometimes seemed to be obsessed by analytics that much they forget making their website. And then replace doing the real work with decisions by numbers they get out of "Analytics". And all that on the cost of the privacy of the customer. Often only for negative gain.
  - atoav 4y ago
    What I tell my clients is that it is their responsibility to care about their customer's data and that I as a customer certainly feel better about brands that treat me well.
  - wkat4242 4y ago
    I doubt one of them will really work. The US and EU have a very different concept of privacy. Not just for government espionage (US citizens have good protection but everyone else is fair game) but also for commercial purposes. For us in the EU everything should be opt-in, a bit like Apple does on iOS but Google refuses to implement on Android. It's really telling that the politicians have no recourse but to try the same thing over and over again instead of just coming up with a real solution. There probably isn't one.
  - hakre 4y ago
    alternatively you could also tell your clients about how costly that is, which cheaper and more user-friendly alternatives exists. also if you stop using analytics and do this right, you gain performance and visits and keep your site on the right track. but that's an art, not a product to sell, sorry.
rado 4y ago
Isn't it already banned in these 5 countries, or the ban isn't being followed? https://www.isgoogleanalyticsillegal.com https://www.isgoogleanalyticsillegal.com
- granzymes 4y ago
  Privacy Shield was invalidated in 2020, which didn't make Google Analytics illegal but increased the burden of implementing it. If you aren't making use of more advanced features, you could be non-compliant. That site is, hilariously, also a product of a Google Analytics competitor. The new Trans-Atlantic Data Privacy Framework replaces Privacy Shield and so for the moment out of the box Google Analytics is fine again. This is what I meant by my comment above. The US and the EU will find a way to make data sharing work, no matter how many agreements it takes.
  - mananaysiempre 4y ago
    “This new [framework] is very closely modelled on the old [framework], isn’t it?” That is, the CJEU says that people ought to be able to sue the host country regarding their privacy rights, the US says no way foreigners have privacy rights (that they can sue the US over, in something that is actually part of the judiciary), US and EU diplomats set up some sort of agreement and announce it loudly, privacy activists sue, half a dozen years pass, the CJEU says the agreement hasn’t actually fixed anything about the US system, rinse and repeat for the last two decades. This is starting to seem like a deliberate stall, honestly, and I’m not sure how it could be prevented.
david_draco 4y ago
"No one is going to ban Google Analytics" -- no need to explicitly ban individual products, the rules are written down in GDPR
stiray 4y ago
It is already banned in Austria, France, Italy and recently Denmark and this is only rolling further.

tofflos 4y ago

Good for them! Citizens should be able to interact with government without being tracked. I'm not against the idea that government uses analytics, or even outsources analytics operations, as long as there is enforceable regulation preventing that data from being used for other purposes and a reasonable amount of money is being exchanged. When you pay nothing, or next to nothing, it becomes obvious that the underlying business model is, at least partially, based on selling ads or personal information.

mike_hock 4y ago
There's no enforceable regulation regarding what happens to data after it has disappeared in a black box. And paying money doesn't remove the underlying mechanism that made the "free" model viable in the first place. The incentive to use it on top of charging for the service is still there. (That's how you get microtransactions and pay-to-win in games that you've already paid for, for example.)

AdriaanvRossum 4y ago

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. In February 2022 The Data Protection Authority of France (CNIL) followed [5] 6. In June 2022 the Data Protection Authority of Italy (Garante) followed [6] 7. September 2022, Denmark – after already banning Google Workspace for municipalities [7] – considers Google Analytics unlawful as well [8] 8. Now, February 2023, Finland rules against the use of Google Analytics [9] This is a sound decision, but – as others pointed out – not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact when it happens per country. PS: I'm the founder of Simple Analytics [10] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://www.simpleanalytics.com/blog/will-google-analytics-be-banned-in-the-eu https://www.simpleanalytics.com/blog/will-google-analytics-b... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... [6] https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782874#english https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... [7] https://www.simpleanalytics.com/blog/denmark-bans-google-workspace-for-municipalities https://www.simpleanalytics.com/blog/denmark-bans-google-wor... (includes translated version) [8] https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... [9] https://www.simpleanalytics.com/blog/finland-is-latest-eu-country-to-crack-down-on-google-analytics https://www.simpleanalytics.com/blog/finland-is-latest-eu-co... [10] https://www.simpleanalytics.com/ https://www.simpleanalytics.com/

KronisLV 4y ago

For anyone curious about viable alternatives, personally Matomo Analytics is good. You can anonymize IP addresses, go fully cookieless, but also use GeoIP if needed (at least for rough locations, depending on how much of the original address you choose to leave). I've been using it for a few years, it also seems to be fairly easy to run and has most of the features that I'd expect: https://matomo.org/ https://matomo.org/ For something simpler (less focus on page transitions, device and performance metrics etc.) I've also heard good things about Plausible Analytics which advertise being cookieless and compliant with various legislation as well: https://plausible.io/ https://plausible.io/