5 ms·

This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 t

This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 this year. There are arguments that GA4 would fail the same requirements. Denmark hold that view but it hasn't been tried. Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. I find this argument objectively absurd considering how internet works but it possible that's how the law works. We wouldn't know before it has been tried though and I'd be sceptical about anyone claiming to know the result.

yunohn 3y ago
> Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. Agreed, this is absolutely ridiculous. And I say this as an EU resident! I’d rather NOT have websites start checking residency/citizenship to decide my data ownership.
- eek2121 3y ago
  They already do.
  - yunohn 3y ago
    I’ve literally never had to provide such proof, and I would say I use the internet quite a bit. Any example websites?
supriyo-biswas 3y ago
The result is the balkanization of the internet, although most folks in the EU want that for nationalistic reasons and to prop up their own industries, under a thin veneer of opposing US imperialism (but being unable to do anything with respect to the things which actually threaten the EU, such as an over dependence on Russia.)
- foepys 3y ago
  I don't want my data in the hands of the NSA as much as you don't want yours in the hands of the BND, FSB, or the People's Liberation Army.
  - supriyo-biswas 3y ago
    Fair enough, but this were actually the reason, simply adding a statement such as “if a non-EU member state wants to request data about an EU national and said data cannot be released to the law enforcement of the non-EU member without a MLAT being served to the EU national’s government” would have been enough. However, I don’t see that, and many Europeans do give “dominance of Americans” as the reason, so I simply go by the information available to me.
    - closewith 3y ago
      Are you aware of the history of this case and the CLOUD Act? The CLOUD Act requires US based companies to comply with US requests for data even when that data is stored exclusively outside the US. It's in direct conflict with the GDPR.
    - bryanrasmussen 3y ago
      Fair enough, but if this were actually sufficient then the US wouldn't have a law saying they can require US based companies to give them the data without regards to the laws of their countries the data is actually being taken from. However I don't see that, and thus Europeans familiar with the relevant cases give “dominance of Americans” as the reason.
    - pyrale 3y ago
      Someone has not heard about CLOUD act. The European Comission has repeteadly tried to figure out a framework that would let US providers access EU markets safely, respecting EU laws. Every single attempt has been broken because there is no way for an US company to respect EU law and also comply with the CLOUD act. The bit of law you suggest would essentially make it impossible for a company to respect both EU law and US law.
3np 3y ago
No need for travels - all you need is to use a VPN/proxy/tor. IP geolocation is not a reliable proxy for physical location (let alone residency - while citizenship doesn't enter the equation at all). I don't find it problematic that the law recognizes this.
- Semaphor 3y ago
  AFAIK it’s often accepted that the law does accept IP geolocation as a reasonable effort to detect EU residents. GPs point here is that Denmark does not hold that view. On the one hand, I kinda agree with DK, on the other hand that would bring on the fears of US-liberal HNers who lose all their freedom to sell user data.
- mattmcknight 3y ago
  Yet IP address is the "personal data" they are claiming falls under the law. It's somehow both personal and useless at identification.
  - 3np 3y ago
    Not so strange at all. The IP address _can_ be used to identify you (together with other data-points), which brings it into PII territory. That it can not be used to reliably determine your physical location is besides the point. Consider an online store shipping physical goods. It asks you for a shipping address. This shipping address is PII and must be treated as such. The facts that you may reside elsewhere and that multiple other people may be residing on that address are both irrelevant to the GDPR. https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/can-a-dynamic-ip-address-constitute-personal-data https://www.fieldfisher.com/en/services/privacy-security-and... https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
jhpacker 3y ago
My opinion is that this applies to GA4 as well. The decisions don't explicitly mention a version, they say these particular sites: "...shall cease to use the version of the Google Analytics tool used on 14 August 2020". They don't say if that's UA or GA4. The original complaints from NOYB refer to UA, but the issues cited in this decision would apply to GA4 as well. So when the DPA says "Companies must stop using Google Analytics", there's no reason to think they only mean the version that was already shut off when they published that post.
- jonasb 3y ago
  I guess they can't ban a product for all eternity. In the decision [1] they are a bit more specific: "This shall be done in particular by ceasing to use that version of the tool Google Analytics as used on August 14, 2020, if not sufficient protective measures have been taken." [1] https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-cdon.pdf https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

yunohn 3y ago

> Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. Agreed, this is absolutely ridiculous. And I say this as an EU resident! I’d rather NOT have websites start checking residency/citizenship to decide my data ownership.

eek2121 3y ago
They already do.
- yunohn 3y ago
  I’ve literally never had to provide such proof, and I would say I use the internet quite a bit. Any example websites?

supriyo-biswas 3y ago

The result is the balkanization of the internet, although most folks in the EU want that for nationalistic reasons and to prop up their own industries, under a thin veneer of opposing US imperialism (but being unable to do anything with respect to the things which actually threaten the EU, such as an over dependence on Russia.)

foepys 3y ago
I don't want my data in the hands of the NSA as much as you don't want yours in the hands of the BND, FSB, or the People's Liberation Army.
- supriyo-biswas 3y ago
  Fair enough, but this were actually the reason, simply adding a statement such as “if a non-EU member state wants to request data about an EU national and said data cannot be released to the law enforcement of the non-EU member without a MLAT being served to the EU national’s government” would have been enough. However, I don’t see that, and many Europeans do give “dominance of Americans” as the reason, so I simply go by the information available to me.
  - closewith 3y ago
    Are you aware of the history of this case and the CLOUD Act? The CLOUD Act requires US based companies to comply with US requests for data even when that data is stored exclusively outside the US. It's in direct conflict with the GDPR.
  - bryanrasmussen 3y ago
    Fair enough, but if this were actually sufficient then the US wouldn't have a law saying they can require US based companies to give them the data without regards to the laws of their countries the data is actually being taken from. However I don't see that, and thus Europeans familiar with the relevant cases give “dominance of Americans” as the reason.
  - pyrale 3y ago
    Someone has not heard about CLOUD act. The European Comission has repeteadly tried to figure out a framework that would let US providers access EU markets safely, respecting EU laws. Every single attempt has been broken because there is no way for an US company to respect EU law and also comply with the CLOUD act. The bit of law you suggest would essentially make it impossible for a company to respect both EU law and US law.

3np 3y ago

No need for travels - all you need is to use a VPN/proxy/tor. IP geolocation is not a reliable proxy for physical location (let alone residency - while citizenship doesn't enter the equation at all). I don't find it problematic that the law recognizes this.

Semaphor 3y ago
AFAIK it’s often accepted that the law does accept IP geolocation as a reasonable effort to detect EU residents. GPs point here is that Denmark does not hold that view. On the one hand, I kinda agree with DK, on the other hand that would bring on the fears of US-liberal HNers who lose all their freedom to sell user data.
mattmcknight 3y ago
Yet IP address is the "personal data" they are claiming falls under the law. It's somehow both personal and useless at identification.
- 3np 3y ago
  Not so strange at all. The IP address _can_ be used to identify you (together with other data-points), which brings it into PII territory. That it can not be used to reliably determine your physical location is besides the point. Consider an online store shipping physical goods. It asks you for a shipping address. This shipping address is PII and must be treated as such. The facts that you may reside elsewhere and that multiple other people may be residing on that address are both irrelevant to the GDPR. https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/can-a-dynamic-ip-address-constitute-personal-data https://www.fieldfisher.com/en/services/privacy-security-and... https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

jhpacker 3y ago

My opinion is that this applies to GA4 as well. The decisions don't explicitly mention a version, they say these particular sites: "...shall cease to use the version of the Google Analytics tool used on 14 August 2020". They don't say if that's UA or GA4. The original complaints from NOYB refer to UA, but the issues cited in this decision would apply to GA4 as well. So when the DPA says "Companies must stop using Google Analytics", there's no reason to think they only mean the version that was already shut off when they published that post.

jonasb 3y ago
I guess they can't ban a product for all eternity. In the decision [1] they are a bit more specific: "This shall be done in particular by ceasing to use that version of the tool Google Analytics as used on August 14, 2020, if not sufficient protective measures have been taken." [1] https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-cdon.pdf https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...