Hacker News Reader

Comment by beberlei | Hacker News Reader

It is not illegal to track users only if they opt out, by citing legitimate interest as the ground for processing not consent. That is how all privacy policy generators and lawyers handle google analytics, facebook pixel, even self hosted solutions like piwik/matomo. We will need to sit out what legimitate interests really mean, but at least in germany there are some state privacy agencies that put forth this approach where you allow to opt out.

View on HN

While I think it may be easy to argue that use of Matomo is legitimate for the purposes of improving your service (and as a corollary, this can legitimately be outsourced), I think it is a stretch to conclude that it is legitimate for the third party to assemble a dossier of an individual by tracking them across multiple sites for which analytics are outsourced to the third party.

This seems obvious since the third party is not going to expose details about the data subjects use of the other sites so it cannot be of legitimate interest to the primary controller. If they did share such data with the primary controller, the privacy violation is so egregious it cannot hope to pass a balancing test to be considered legitimate.

So while something like piwik may be allowed to be opt out, I think google may be treading on thin ice.

I agree, and Google is probably well aware that they tread on thin ice and they will probably fight their version of legimitate interst up to the European Court of Justice.

I doubt that user tracking for personalized ads is a legitimate interest, especially in the case of Google search. Tracking users without consent also contradicts Google's own privavy policy. From https://policies.google.com/privacy?hl=en#enforcement

> For example, we ask for your consent to provide you with personalized services like ads.

No, they apparently don't.

Reply on news.ycombinator.com