4 ms·

Technically, what is it that makes GA (likely) violating? I’m assuming no PII is transmitted or stored? Part of the issue is that data is transmitted outside

Technically, what is it that makes GA (likely) violating? I’m assuming no PII is transmitted or stored? Part of the issue is that data is transmitted outside the EU - but that seems easily fixable. Storing a unique user id also isn’t - in itself - a violation, unless enough other data is stored to make it possible to connect a physical person to the id.

di4na 4y ago
https://www.cnil.fr/en/qa-cnils-formal-notices-concerning-use-google-analytics https://www.cnil.fr/en/qa-cnils-formal-notices-concerning-us... Norway is not the first. The French DPA have banned using GA for months now.
- teddyh 4y ago
  More than that: https://isgoogleanalyticsillegal.com/ https://isgoogleanalyticsillegal.com/
- eastbound 4y ago
  What can’t the EU just attack Google itself and for the 4% fine? See, I get that it’s companies who shouldn’t put GA on their website, but it’s not a practically navigable response: - As a startup, - All marketing agencies start with nonchalantly setting up GA, - All marketing agencies know nothing else and deny that GA is illegal. Even if I know better, GA is THE standard. So, EU can attack every single company in Europe, as the data controller, and enforce law as it technically is, but that still doesn’t provide consumer protection. And in the end, it’s Google who’s sending the data to the US. Why can’t Google be attacked, not on behalf of being a data processor or data controller, but on the very initial crime of sending data to the US without permission?
  - di4na 4y ago
    Because they make you sign a contract when using GA that ask you to swear you are only going to use it to send data you are allowed to send to the US. To attack Google, you would need someone to use GA without agreeing to it, which is not possible.
cassianoleal 4y ago
> Part of the issue is that data is transmitted outside the EU - but that seems easily fixable. Not quite, since the CLOUD Act [0] was put in effect. This is the gist of the problem: The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. And this is under "International reactions": The European Data Protection Supervisor (EDPS) viewed the CLOUD Act as a law in possible conflict with the GDPR. The German Commissioner for Data Protection has warned against the use of US based Amazon Web Services for storing sensitive data for the Federal Police. [0] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- alkonaut 4y ago
  This only applies to PII though? If analytics contains PII it seems that’s already problematic. I get that GA is “worse” than others in that it potentially sends more data than necessary, potentially making it possible to bind pseudonyms to real identities. But hypothetically - if GA was properly pseudonymous (e.g client generated guide transmitted, no connection to browsing history, no entropy like detailed user agent data etc, and purely client side pseudonymization) would that remedy the situation? I guess the answer is “no one knows as it’s not tried”. But it’s an interesting question because if it isn’t, then no analytics would be compliant. For example using an analytics service like Ms App Insights for a mobile app.
  - generj 4y ago
    Correct, storing PII is against GA’s TOS. Which doesn’t at all mean it isn’t ingested somehow or another (and Google can trivially integrate it back to a person if they wanted to). PII is a very malleable term depending on the jurisdiction. So long as website operators are creating URLs and the data layers published into analytics there’s no way to ensure the data is truly anonymized. It just takes one slip up with a username being placed into a query string, or some other small mistake. In many organizations marketing runs the analytics, and they try to do as much as possible without developers who might notice these types of errors. It could be interesting to have browsers avoid sending user agents and otherwise minimize HTTP headers to a list of analytics domains.
RollAHardSix 4y ago
In one instance anonymized IP's were rendered PII by one of the European countries. Mostly it all comes back to the CLOUD act and US state surveillance. JDSupra and searching the other simpleanalytics posts on HN provides great reading to get up to speed quickly. France actually is forcing their governments to drop Microsoft 365 and instead only use on-prem Microsoft apps because even using a company with EU specific datacenters isn't enough. They put out a list of EU, specific data centers to use because using companies which are subject to only EU law and regulations is important to them.
- speedgoose 4y ago
  The Patriot act is also a problem. Many people using USA cloud providers claim that using USA cloud providers is legal, and will start to speak faster, more stressed, and aggressively once you mention Schrems 2. I believe you don’t need to be a lawyer department to understand that it can’t be legal in the current state of the law. I know people who prefer to ignore the problem. It’s a risk that they are willing to take and they think that they are going to be alright. I guess they may have a sound strategy.
openplatypus 4y ago
Here is why it is legally challenging https://wideangle.co/blog/is-google-analytics-illegal-under-gdpr https://wideangle.co/blog/is-google-analytics-illegal-under-...

di4na 4y ago

https://www.cnil.fr/en/qa-cnils-formal-notices-concerning-use-google-analytics https://www.cnil.fr/en/qa-cnils-formal-notices-concerning-us... Norway is not the first. The French DPA have banned using GA for months now.

teddyh 4y ago
More than that: https://isgoogleanalyticsillegal.com/ https://isgoogleanalyticsillegal.com/
eastbound 4y ago
What can’t the EU just attack Google itself and for the 4% fine? See, I get that it’s companies who shouldn’t put GA on their website, but it’s not a practically navigable response: - As a startup, - All marketing agencies start with nonchalantly setting up GA, - All marketing agencies know nothing else and deny that GA is illegal. Even if I know better, GA is THE standard. So, EU can attack every single company in Europe, as the data controller, and enforce law as it technically is, but that still doesn’t provide consumer protection. And in the end, it’s Google who’s sending the data to the US. Why can’t Google be attacked, not on behalf of being a data processor or data controller, but on the very initial crime of sending data to the US without permission?
- di4na 4y ago
  Because they make you sign a contract when using GA that ask you to swear you are only going to use it to send data you are allowed to send to the US. To attack Google, you would need someone to use GA without agreeing to it, which is not possible.

cassianoleal 4y ago

> Part of the issue is that data is transmitted outside the EU - but that seems easily fixable. Not quite, since the CLOUD Act [0] was put in effect. This is the gist of the problem: The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. And this is under "International reactions": The European Data Protection Supervisor (EDPS) viewed the CLOUD Act as a law in possible conflict with the GDPR. The German Commissioner for Data Protection has warned against the use of US based Amazon Web Services for storing sensitive data for the Federal Police. [0] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

alkonaut 4y ago
This only applies to PII though? If analytics contains PII it seems that’s already problematic. I get that GA is “worse” than others in that it potentially sends more data than necessary, potentially making it possible to bind pseudonyms to real identities. But hypothetically - if GA was properly pseudonymous (e.g client generated guide transmitted, no connection to browsing history, no entropy like detailed user agent data etc, and purely client side pseudonymization) would that remedy the situation? I guess the answer is “no one knows as it’s not tried”. But it’s an interesting question because if it isn’t, then no analytics would be compliant. For example using an analytics service like Ms App Insights for a mobile app.
- generj 4y ago
  Correct, storing PII is against GA’s TOS. Which doesn’t at all mean it isn’t ingested somehow or another (and Google can trivially integrate it back to a person if they wanted to). PII is a very malleable term depending on the jurisdiction. So long as website operators are creating URLs and the data layers published into analytics there’s no way to ensure the data is truly anonymized. It just takes one slip up with a username being placed into a query string, or some other small mistake. In many organizations marketing runs the analytics, and they try to do as much as possible without developers who might notice these types of errors. It could be interesting to have browsers avoid sending user agents and otherwise minimize HTTP headers to a list of analytics domains.

RollAHardSix 4y ago

In one instance anonymized IP's were rendered PII by one of the European countries. Mostly it all comes back to the CLOUD act and US state surveillance. JDSupra and searching the other simpleanalytics posts on HN provides great reading to get up to speed quickly. France actually is forcing their governments to drop Microsoft 365 and instead only use on-prem Microsoft apps because even using a company with EU specific datacenters isn't enough. They put out a list of EU, specific data centers to use because using companies which are subject to only EU law and regulations is important to them.

speedgoose 4y ago
The Patriot act is also a problem. Many people using USA cloud providers claim that using USA cloud providers is legal, and will start to speak faster, more stressed, and aggressively once you mention Schrems 2. I believe you don’t need to be a lawyer department to understand that it can’t be legal in the current state of the law. I know people who prefer to ignore the problem. It’s a risk that they are willing to take and they think that they are going to be alright. I guess they may have a sound strategy.

openplatypus 4y ago

Here is why it is legally challenging https://wideangle.co/blog/is-google-analytics-illegal-under-gdpr https://wideangle.co/blog/is-google-analytics-illegal-under-...