Austria's data protection authority has found that Google Analytics is illegal

https://tutanota.com/blog/posts/google-analytics/

by caaqil • 5 years ago

304 200 5 years ago

tutanota.com

vegai_• 5 years ago

The article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?

jacquesm6• 5 years ago

Privacy law in the EU is harmonized.

JumpCrisscross8• 5 years ago

Privacy law in the EU is harmonized

In theory. Reality is quite far from that, as anyone on the ground can attest.

suction4• 5 years ago

Yes, but not automatically and immediately as far as I know.

raesene9• 5 years ago

The legislation that is relevant here is GDPR which is EU wide (each country has it's own implementation but they should be overall similar).

In the article it points out that there are similar suits across the EU by the same organization, so it's not too unlikely that there will be similar reults in some or all of the cases.

RealStickman_• 5 years ago

Austrian Data Protection Authority strikes the same chord as the European court when declaring Privacy Shield as invalid: It has decided that the use of Google Analytics violates the General Data Protection Regulation (GDPR).

It seems Google was sued in Austria and they have found it to violate the GDPR so yes, it applies to the whole EU.

NLMichel• 5 years ago

Not Google, a company. Because not GA on it's self is illegal. The use of GA is illegal.

grezql• 5 years ago

such individual court decisions are usually a precursor to what will be implemented EU-wide

jacquesm6• 5 years ago

The other way around: the GDPR was the precursor to this lawsuit, this is the implementation of the directive by a local court which found that, indeed, using GA violates the GDPR.

Xelbair• 5 years ago

If something is illegal under GDPR it is illegal in whole of EU.

GDPR is a set of minimum standards that are common between countries in EU, some have even more drastic laws.

Macha3• 5 years ago

EU laws come in a couple of variants. The most common is a directive which is basically "Your country needs to pass a law to achieve X, Y, Z", and this is where you get larger country to country differences in interpretation. The GDPR is instead a regulation. That means it's literally the same law (and theoretically, the same standards) that applies EU wide. So the US equivalent would be a court in Texas finding something to be illegal under a federal law. What does that mean for the same action in california? It's probably illegal there too, but it could still be tested if someone wanted to try their luck.

So that means the current status is that's precedent a court in another EU country would strongly consider but technically could come to a different decision on and in either case the losing party has the option of appealing to the EU level.

d1sxeyes3• 5 years ago

That's not quite right. This ruling is not the precedent, the Schrems II ruling is the precedent. This is just a court determining that Schrems is in fact relevant precedent in this specific case, and finding based on that.

curiousfab• 5 years ago

I think if you view it from this angle it becomes clearer:

The court has not arbitrarily declared GA illegal, it just follows what the GDPR mandates - and came to the (quite obvious) conclusion that GA is not compatible with the GDPR.

Consequently it is illegal everywhere where the GDPR applies. This doesn't mean that there are immediate consequences for those who use GA on their websites in any other country, but it is very likely that other EU countries' courts will decide the same way.

d1sxeyes3• 5 years ago

The ruling which led to this conclusion was made back in July 2020.

From the article:

This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.

This article is addressing a specific case which follows from a previous judgement (known as Schrems II) which determined that Facebook could not transfer data from Ireland to the US under the US 'Privacy Shield' framework, as it no longer meets the GDPR's adequacy requirement due to CLOUD Act.

This finding by the Austrian court just reaffirms that the Schrems judgement also applies to Google Analytics.

As the article mentions, this is the first of 101 cases ongoing brought by Schrems, and I expect them all to end in more or less the same outcome.

https://www.europarl.europa.eu/RegData/etudes/ATAG/2020/6520...

geewee10• 5 years ago

Yeah, I also expect that after these 100+ cases we'll have a pretty clear consensus in most european countries about this.

scarab92• 5 years ago

To be clear, the transfer of EU citizen's data to the US was deemed against the GDPR. This decision does not mean that Google Analytics itself is illegal.

darkwater• 5 years ago

I think the syllogism comes from the fact that currently GA does transfer EU data to the US by default (and probably currently there is no way to prevent that?). But I'm not a GA expert at any rate so I can be totally wrong.

smoe• 5 years ago

As I understood it, data location is not even the problem, but the US CLOUD Act, that allows their authorities to request data from US companies no matter where it is stored. So even if Google Analytics would store data from EU citizens in Europe, they would still violate GDPR, because US authorities can access the data without the users consent.

brnt• 5 years ago

But, due to American intelligence agencies explicit access to overseas data (Schrems II), any such service by an American company can't meet the requirements set forth by the EU, and thus can be considered illegal for any practical purpose.

bryanrasmussen2• 5 years ago

As I understand the ruling though this pertains to the fact that data is transferred to the U.S, it may be that if they changed to just using servers in the EU it would still be declared illegal but a new case would have to go through to make this declaration?

sschueller3• 5 years ago

The CLOUD Act itself is the issue. Don't use MS Office 365 or any other US based service even if their servers are in Europe as they can not guarantee that your data is not accessible by the US.

Amazon and Cloudflare are all great service but your data is under US jurisdiction.

lnsp• 5 years ago

You can control locality for some parts of Cloudflare's offering [1], so I guess if you want to comply with the privacy shield stuff, you would have to ensure that the data is stored on a server within a EU country.

[1] https://blog.cloudflare.com/introducing-the-cloudflare-data-...

dismalpedigree• 5 years ago

Doesn’t work that way. This issue is that CloudFlare is a US company and can be compelled to disclose information to US Govt regardless of where they hold the data.

znpy4• 5 years ago

If one stops and thinks about this point of view, most of the services used globally are under US jurisdiction... Which is less than ideal.

frockington14• 5 years ago

Can you think of a good alternative other than outlawing Microsoft 365? I want these services to be spread out however this particular idea would make the EU even more sluggish than it already is

frockington14• 5 years ago

So the entire EU is going to be forced to use Open Office or some other equivalent? Non tech people will hate this and it will cripple many businesses that rely on Microsoft Excel. You'd be surprised how much of the world economy is based on emailing Excel sheets back and forth

JumpCrisscross8• 5 years ago

You'd be surprised how much of the world economy is based on emailing Excel sheets back and forth

How would Excel being run locally, with its work product being emailed back and forth, be impacted by this?

2Gkashmiri3• 5 years ago

Why not now force the EU to heavily invest in libreoffice so that it becomes a drop replacement to excel? I'm sure the European union can spare some euros to make it possible and this isn't even a utopian dream that can't be achieved. It just needs a good push

Kbelicius3• 5 years ago

Is Microsoft no longer making a desktop version of their office suite?

jeroenhd4• 5 years ago

You can use MS Office without putting everything on the cloud. Excel doesn't need to go, and you can still use Excel online for calculations that don't include personal information, which should suffice for most businesses.

Just don't upload that CSV containing all of your customers to Microsoft, that shouldn't be too hard.

sschueller3• 5 years ago

This is a good thing. It means Europe will be forced to invest in improving open office, pay for development etc.

denton-scratch2• 5 years ago

You are assuming that these businesses are using online versions of Excel (or whatever) that store the data under US jurisdiction. If they have committed to using online services that rely on US storage, then they have made a bad mistake - that is not allowed, and this case just reaffirms that.

stef255• 5 years ago

The EU institutions (that came up with this crap) are so bad at managing their hard & software (2 years in to the pandemic, their employees are still WFH on MS tablets with VPN connections that are super unstable).

I can't wait to see the clusterfuck of them trying to migrate away from MS.

whiteboardr• 5 years ago

What are solid european alternatives?

schleck8• 5 years ago

For servers, there is countless providers. Not nearly as big as the hyperscalers, but certainly sufficient.

Netcup, xTom, Hetzner, OVH, Scaleway just off the top of my head

sschueller3• 5 years ago

Co-locate run your own hardware, Hetzner, Exoscale etc. There are many alternatives just not as large as Amazon. Many ISPs also offer DDoS protection.

ognarb• 5 years ago

Nextcloud would be a solid European alternative for office365. It's a file sync, groupware, office and xhat solution all in one. It's open source, self hostable and has enterprise support.

Disclaimer: I work at Nextcloud so I'm a bit biased

synchrone• 5 years ago

https://www.onlyoffice.com/saas.aspx - very decent compatibility with Office and speed; is a European company; much of the functionality is open source.

blueflow• 5 years ago

The US-style "depending on cloud services for everything" is generally frowned upon in the companies i work with (germany). I see much self-hosting.

p_l• 5 years ago

Interestingly, Google afaik did some funky business with SAP where they swap jurisdiction around so that when faced with US request they can at some point say "send it to SAP AG and see if they care" - or so it seemed few years ago (source: notification of contract change wrt GCP)

AniseAbyss• 5 years ago

Obviously if the EU actually grew some fucking balls and start to enforce the rules corporations would take steps to comply. But when was the last time a US CEO was dragged of a private jet?

JumpCrisscross8• 5 years ago

Can’t this be solved by providing zero-knowledge encrypted services? Won’t work in all cases. But could work in some.

kenniskrag• 5 years ago

maybe use something like goatcounter or selfhost the analytics.

amelius3• 5 years ago

How does the consumer know it is zero-knowledge?

geewee10• 5 years ago

Technically maybe but in practice using zero-knowledge encrypted services if you want to calculate aggregates or do large-scale calculations isn't really technically feasible.

BjoernKW4• 5 years ago

The problem with EU legislation in that regard - or rather the current lack of pertinent agreements since the EU–US Privacy Shield has been declared invalid - is that it doesn't just apply to US-based services and US companies. Having a US subsidiary or even just a US-based supplier is enough for an entire company to theoretically be considered in violation of EU laws and GDPR in particular.

This means that as a business, theoretically you'd have to vet every single customer and supplier regarding their involvement with US-based companies.

Since realistically this would amount to most companies not being able to do any business at all anymore - and consequently the economy grinding to a halt - in most cases this doesn't have immediate repercussions.

However, such unpredictability caused by regulations such as GDPR is a huge problem because you can't ever be sure you won't be issued a - potentially crippling - fine simply because some local authority considered this a good idea.

albertopv2• 5 years ago

The problem is USA jurisdiction outside of USA, I'm not a lawyer but how can this be legal under international laws? How is it possible that EU citizen data is under USA jurisdiction?

matsemann• 5 years ago

NOYB's article itself discussed here: https://news.ycombinator.com/item?id=29918496

bertman• 5 years ago

I really hope this will have consequences that shake up ad tech, but the cynic in me says: They're just going to add another disclaimer in their cookie banner and exactly nothing will happen.

Macha3• 5 years ago

Well part of the ruling is that the "standard contractual clauses", basically an attempt to contract away the regulation is not valid. From the article, it seems to be just conceptually, which gels with my understanding of the GDPR, so it's not going to be just adjusting/appending the legal wording in the TOS to fix that.

kazen44• 5 years ago

"standard contractual clauses", basically an attempt to contract away the regulation is not valid.

how is this suprising? This has been the case in Civil law since atleast napoleonic times.

Contracts do not declare laws or rights invalid, unless these exceptions are defined in said law.

dotancohen• 5 years ago

That's what is great about the GDPR. Just adding another disclaimer in a cookie banner absolves them of nothing.

In fact, this whole case is exactly about that. Some Austrian website tried to use Google Analytics and just added another disclaimer in their cookie banner. Now they are facing the consequences.

laurent123456• 5 years ago

You either pay with your data, or you pay with clicks on stupid cookie banners. Or both, if you click on the wrong button.

catfishx3• 5 years ago

The problem is that most people just dont read cookie banners and just click "Accept all"

amelius3• 5 years ago

The real problem is that ignorant people drag the rest of us with them into the abyss.

me_me_me• 5 years ago

The real problem is that there is no standardised cookie banner format mandated in EU.

There should be accept all, accept necessary, reject all options.

The cookie banner anti-patters are most infuriating game of gotcha since tiny moving X button on pop-up ads.

boshomi• 5 years ago

previous discussion: »Austrian DSB: EU-US Data Transfers to Google Analytics Illegal« ( https://news.ycombinator.com/item?id=29918496)

triska• 5 years ago

Thank you Max Schrems for everything you do to preserve EU citizens' privacy and compliance of companies to European law!

robin_reala• 5 years ago

Remember that you can support his organisation – NOYB – financially, if you want to see more of this sort of thing: https://support.noyb.eu/join

ascar• 5 years ago

As far as I understand it, it's not Google Analytics per se that is illegal, but the data transfer to the US. If Google Analytics would use servers on European ground it should be fine.

Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? But I can't imagine that to be the case, as it would effectively mean that any business where an American company stores user data is illegal.

sjogress3• 5 years ago

As far as I can tell this ruling means that transfering PII to any company/service controlled by an American company is illegal per the GDPR.

I work for a European company that is already being impacted by this ruling. Our first step is to replace Google Analytics, but I believe we are also looking through all cloud usage for any traces of PII.

I think this is a huge opportunity for European companies to get a foothold in the Analytics/Ads/Cloud/Office spaces. Perhaps also an opportunity for good open source alternatives, like Matomo Analytics, to get adopted.

toyg3• 5 years ago

The various shields for EU->US datatransfer, agreed before and after GDPR, have been found incompatible with GDPR even if only potential. It's just that nobody has sued anybody yet, as the industry silently scrambles to look for alternatives.

There is the law, and then there is enforcement of the law, and the latter has not fully happened yet.

mhitza• 5 years ago

Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US?

Yes, because of CLOUD Act. If GA would create a deployable agent that proceses user data on your server before sending it in aggregate/anonymously to central GA, that would make it usable

d1sxeyes3• 5 years ago

From the Schrems II judgment:

Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned.

It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...

Kbelicius3• 5 years ago

I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...

They can. If I remember correctly Microsoft refused FBI request for some data that was stored in Ireland so the Cloud Act was created.

j16sdiz• 5 years ago

guess this meant EU company can't do business with Chinese either.

kapsteur2• 5 years ago

It's time for EU services to shine.

iqanq• 5 years ago

They haven't shined in 25 years. We will just be forced to use inferior products.

toyg3• 5 years ago

Come on mate, you're likely listening to music via a EU service (Spotify) and you were calling people with a EU service (Skype) before a US corporation bought it and ruined it.

znpy4• 5 years ago

Well this might open a HUUUGE market for Analytics in the EU. We might see some competition rise and a good (better?) product emerge.

kapsteur2• 5 years ago

Ahah, of course during a period of time. Look at DuckDuckGo https://duckduckgo.com/traffic they benefited a lot from the changes imposed on their competitors.

wongarsu• 5 years ago

Hetzner is the best hosting provider for dedicated servers (if you care about price). Gridscale is pretty good. The original Skype was a very solid product. Spotify still owns the digital music market.

Tade0• 5 years ago

I'll take that in exchange for better privacy.

frockington14• 5 years ago

Based on the results of GDPR, it'll probably just result in more annoying sites that users will avoid due to all of the pop up banners. Hopefully I'm wrong, I wish there was strong competition from Europe

sjogress3• 5 years ago

An optimistic take would be that this forces European companies to think through their analytics/ad needs again, perhaps resulting in less invasive solutions and thus fewer popups/banners and improved privacy.

At least that is what I'm hoping for, however unrealistic it might be.

nabla92• 5 years ago

We have IRC and it shines bright!

But seriously: Google just needs to move the problematic part of their EU business into EU and start complying.

Kbelicius3• 5 years ago

If I'm understanding this correctly there is nothing google can actually do. The problem is the US Cloud Act as the linked article mentions, which is in direct violation of article 44 of GDPR.

johannes1234321• 5 years ago

it is not so easy for Google. The US side will always demand stuff from them. At least for having the ability.

Microsoft once had the right™ offering: Deutsche Telekom running the Azure data center, so it's the same software etc., but legally fully separated. Didn't get many customers (I don't know what kind of restrictions there were)

b3lvedere• 5 years ago

I think it's time to make good backups of some google accounts.

catfishx3• 5 years ago

takeout.google.com really helps for this

loceng2• 5 years ago

Why so?

toyg3• 5 years ago

I guess parent fears that Google will blanket-disable access to all Google services in the EU, as retaliation. Unlikely imho, but it's true that Analytics was a big loss - it's only one step down from their core product, Adsense, and if GDPR enforcement comes for Adsense then they will have to go nuclear.

jacquesm6• 5 years ago

Even Google is not too big to fail and cutting off 40% of your income stream isn't a very wise thing to do for any executive that wants to hold on to the pluche.

tremon4• 5 years ago

Why? If you have a Google account, you have a direct business relationship with Google, and the data in that account doesn't violate the GDPR in any way.

(the data Google collects about you outside of your account activities still might, though).

sixhobbits• 5 years ago

I guess Plausible.io and similar are going to be drowning in cash in the next few months.

znpy4• 5 years ago

I really hope they do.

brabel3• 5 years ago

Looks great! But I feel that $9/month (up to 10k views) is a bit much for my personal website... I pay that much to Google now, but I get a whole suite of tools besides analyticsm, like email addresses (for my whole family under our surname as a domain, which is cool), my own domain (via GogoDaddy, but I got that via Google and pay Google only) and all the small business office tools they offer (though I think those are free?).

Are the any alternatives that offer the same kind of thing as Google?

yosito2• 5 years ago

Why do you need analytics for your personal website?

arnvald• 5 years ago

Oh, it seems they raised their prices. I think I'm still on the old plan, cause I pay $48/year.

Still, it looks like the cheapest option out there. Matomo costs €19/month, Fathom - $14/month (or $140/year), Piwik Pro has a free option, but they're very enterprise oriented, not sure if they're good for small sites

skinkestek• 5 years ago

For your personal webpage you can always use whatever piwik is called today. (I still can't remember after all these years.)

Or you can rely on server logs.

Luckily for everyone but simultaneously sadly for the curious ones among us I think the referer header is broken so the thing I always wanted to know - where users came from - is a lot less useful these days.

rhn_mk1• 5 years ago

Does Recaptcha use similar technology as Google Analytics? I would happily see it burn.

tilolebo3• 5 years ago

Thank God we have very capable cloud providers in Europe that will rise to the challenge and offer a viable opportunity to the US major cloud providers!

heartbeats• 5 years ago

Hetzner, OVH, Leaseweb, Scaleway. How many cloud providers do you need?

tilolebo3• 5 years ago

Please remember me for how long OVH was down when they lost an entire "DC"? And how much customer data did they lose?

spaniard892773• 5 years ago

None of them compares to Amazon. The only kinda similar competitor in Europe is... Yandex Cloud.

The reality is that we don't have the same ability of popping companies up and funding them.

jeroenhd4• 5 years ago

We definitely do have all of those. For some reason, IT managers prefer to teach themselves the AWS/Azure/GCloud configuration clusterfuck rather than the portable OpenStack configuration clusterfuck, but that's suffering we're all bringing on ourselves.

Jenz• 5 years ago

Where can i see an official statement of this? The linked website seems dubious…

skilled• 5 years ago

It's pretty ridiculous how much bloat there is in Google Analytics anyway. Their interface hasn't gotten any better over the years. Sorting through behavioral visits will sometimes crash the browser tab. A lot of open-source platforms can do super specific analytics while also remaining privacy-friendly.

jerrygoyal• 5 years ago

I've heard Google is working on a new cookie-less version of GA just like plausible and other privacy-focused GA alternatives. Wondering if this cookie-less GA would still come under the ban.

geewee10• 5 years ago

It almost certainly would. This isn't about cookies, this is about sending PII (which IP's are) to GA. I have a hard time imagining some safeguards that'll allow you to use GA, without ever hitting a GA server.

Nextgrid• 5 years ago

GDPR is about sharing personal data and tracking users. It doesn’t matter if it’s done via cookies or some other way.

singingwolfboy• 5 years ago

https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...

epalm• 5 years ago

What does it mean these days to be a “European website” (or a “Canadian website”, etc)? The server is located in Europe? The domain name is owned by a company registered in Europe? What if a CDN serves the site from another location? What if the site is served in an iframe on a site in another location?

geewee10• 5 years ago

Basically the GDPR considers anything that's accessible or marketed to EU residents (not citizens) under its jurisdiction. In practice this is (probably) pretty much every side that isn't a local business or specifically blocking visitors from the EU.

zelphirkalt• 5 years ago

As far as I understand the decision is about US being able to order companies inside the US, to give them any data, even when that data origins from overseas.

So regarding your question, I guess the answer would be: A European website makes use only of services, which are not in danger of the US (or other countries from outside Europe) ordering the company to grant them access to the data. I guess this means, that you cannot use any services, which are offered by companies, which store data in the US and possibly even if they store it elsewhere, but fall under US law.

libertine• 5 years ago

It's about the user, not the website.

I'd guess a "European website" stands for a website that safeguards EU users by being compliant with GDPR.

denton-scratch2• 5 years ago

Therefore, the data of European citizens may not be transferred across the Atlantic.

That is different from the headline. GA is still legal; the judgement is that it remains illegal to transfer PII from the EU to the US. That's not new; that's GDPR. This judgement is just upholding GDPR.

It's just data traders grumbling about a law they don't like in a place they don't live in.

sprkwd• 5 years ago

I’m guessing this does not include UK based websites these days?

What about people viewing from the EU?

All very confusing.

jeroenhd4• 5 years ago

IANAL, but the UK has kept (for now) an implementation of the GDPR, and judges may opt to take into account the GDPR their law was based upon when it was drafted. However, there's no guarantee they'll consider that with too much weight, because they're no longer bound by the EU legislation. For the UK, I'd say the current state is "probably just as illegal, until the law changes, but it's not been tested in court so you may risk it".

The GDPR covers the privacy of individuals residing in the EU. That means you don't need to track which user has which nationality, you can just make decisions based on the location of your users. If you're an American company targeting American customers then you don't need to worry about Europeans passing by on their holidays. If the request comes from the EU, don't load your personal data collection code, internal or external, if you're unsure about the legality.

That said, if you don't offer any services (free or paid) to the EU and one of your customers happens to use your service on a business trip, you don't need to worry either. This mostly applies to contracts and data procession, much less to actual websites and web services reachable from anywhere, but it's an exemption that'll save a lot of data hoarding companies that track Americans, Asians, etc. through indirect means.

suction4• 5 years ago

I am not aware of an automatic and immediate adoption of an EU member state's rulings for the whole EU. Headline seems wrong, but maybe what it means to say is that such an adoption is 100% sure?

geewee10• 5 years ago

This is true - but courts have been going in this direction for a while now, and noyb has filed 100+ similar suits. Expect most of the legal landscape to agree with this in the not-so-distant future.

Kstarek2• 5 years ago

we out here saying fuck Europe

evancoop• 5 years ago

Seems to raise a couple profound questions: 1. Is there a credible alternative (comparable ease of access and implementation)? 2. Does the absence of such a tool hinder business operating efficiency?

If the answer to #1 is no, then any assertions that Google is not operating as a monopoly in the space are undercut. If the answer is #2 is no, then there are quite a few BI/Analytics/Strategy personnel who might find their value more difficult to justify!

oaiey• 5 years ago

Well Microsoft just needs to found a company owned 51% by a European entity /shareholders and operated by Europeans. Like that, the cloud act cannot be enforced. MS licenses the Azure/Office/whatever to this company so it will grap the majority of revenue. They can make fancy auditing agreements making sure that this company never steals anything from them.

China is doing this model for years. Just with a different motive I guess.

They tried this also with Telekom Germany for the Azure cloud but stopped doing it

geewee10• 5 years ago

The writing's been on the wall about this for a long time, and anyone following the space has seen this coming. I'm glad that we're starting to see some judgements now, so people have something to point to when arguing to not send PII to america.

sanitycheck• 5 years ago

Maybe someone more knowledgable can provide some insight here? The problem seems to revolve around transmission of PII:

"Based on this data, Google was able to deduce who he or she was."

Presumably the PII didn't come from the data transmitted to GA by the site, more that GA was able to cross-reference the client ID from the cookie and determine the identity of the user.

So if one was to disable GA cookies and/or override the client ID being sent from one's own site, would that be a workaround?

benja1232• 5 years ago

I maybe in the minority here, but I believe that this is not good for the average European and definitely not good for the European tech scene. Europe is already a more complicated place to launch a new company as you have to support multiple languages, countries etc. just to get to the potential market size you have in the US. Strict regulations are that are complicated to implement means that more new companies will choose to launch and build themselves up in the US first. By the time they come to Europe they will already be big and established and can afford to implement the complicated infrastructure that is necessary to support cross continent data storage (or ignore the regulation and pay the fines) while eating up all the small startups that were trying to capture the EU market while dealing with masses amounts of regulation and red tape.

Now to be very clear! I am not against most of GDPR. But some of the interpretations of it have gone too far and it will hurt Europeans in the long run.

This is actually one of the best things that can happen to companies like google and Microsoft as they can afford to develop the infrastructure to support easy geo based cross continent data storage - and they can then sell it as part of their cloud offerings.

geewee10• 5 years ago

Geo-based cross continent data storage isn't enough. The fact that the parent company is a US entity still makes it illegal, no matter where the data is stored.

benja1232• 5 years ago

True, forgot about that. Makes it harder and more expensive for a small business to support Europe unless they are based in the EU from day one.

stef255• 5 years ago

As a European, frankly this is ridiculous.

I'm as concerned as anyone about privacy issues but GDPR has just gone too far in the sense that nobody really understands it (I've undergone trainings with 2x previous employers and everyone just kind of shrugs that it doesn't make sense and we'll do our best bla bla bla ...) and that now they're trying to make an actual useful piece of software illegal? And that for reasons that the very people they're trying to protect will completely fail to understand.

So many marketing departments depend on it, how can they realistically enforce this law?

I'm saying this as someone who's not a fanboy, GA can be a pain to use and overly complex, maybe Matomo is even better.

This is typical EU over reaching bs.

vijaybritto2• 5 years ago

They are only making transferring data outside of Europe as illegal right? I'm not getting what's over reaching in this

stef255• 5 years ago

What will it solve?

timeon2• 5 years ago

I as EU citizen am happy about it. I do not care about any marketing department that is lazy to move from cross site voyeurism.

stef255• 5 years ago

Nobody understands this, apart from us techies. Try explain to the average user that storing his screen resolution on a server in the US could mean he's being profiled by the NSA. Reaction will be "oooo you spooky hacker". It frustrates me that people react like this, don't get me wrong.

bendiksolheim• 5 years ago

Changes are always difficult, no matter how small or large they are.

As a European, I welcome this wholeheartedly! It makes my daily job harder (as a programmer), but it’s needed to stop this insane industry of using private information as a currency. Most people seem to don’t care, but that is mostly because they don’t understand the consequences of this.

GDPR isn’t really that hard to understand. If you need to gather PII, you need the proper approval from the end user to do so. If you don’t have the proper approval, you can’t store it. Also, don’t gather information you don’t need. If you only need page views, don’t store IP, resolution, localisation and all these things in addition. This is common sense, not science. In fact, you should be happy to have these restrictions, because it lowers the risks in case of data breaches.

The real problem with GDPR is that we’re so used to violate peoples rights that we have completely forgotten how we should behave.

pieter_mj• 5 years ago

Great victory. I bet firebase crashlytics is illegal as well in EU.

The reason I uninstalled the hacker news app 'Materialistic' is because it regularly crashed and was probably unvoluntarily siphoning off pii data through the crashlytics module.

ironman1• 5 years ago

Luckily there are alternatives right... we're using Simple Analytics. Quite happy with. GDPR compliant out of the box and good ux

capr• 4 years ago

Google should just return HTTP 451 to all EU see how quickly these unelected EU officials would change their minds. And I say this as an EU citizen.

Austria's data protection authority has found that Google Analytics is illegal

Related Stories