EU government websites have undisclosed adtech trackers from Google and others

Businesses that only make sense financially if they can gobble up user data without their consent and sell it to third parties should not exist, just as businesses that can only work financially by not paying their workers should not exist.

What of this is crazy?

Their cookie disclosure regulation IMO has collectively wasted perhaps millions of hours of users' and website designers' time.

===

Article 6.1.e "in the exercise of official authority vested in the controller;" - Wide open door.

Article 9.2.d - exception to prohibition on racial profiling for political parties on their own membership.

Article 9.2.g "processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued" - The "anything we declare acceptable" biometrics exception.

Article 9.2.h - The "no opting out of online medical records" clause.

Article 17.3.b "or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller" - The "if we say it's in the public interest not to delete it then we don't have to delete it" clause.

Article 23.1 - The laundry list of cases where any EU government can throw out all rights the GDPR establishes. Includes the following: "other important objectives of general public interest of the Union or of a Member State" as if that's not a goalpost a mile wide.

Article 49.1.d - Allows transfers of data to countries with inadequate data protections to take place if they are declared to be "in the public interest".

===

Pretty much everything in the GDPR document is untested at this point, and whether government or corporation, quite a lot of cases are going to have to be argued before the courts.

However, this document leaves open many arguments for governments that are not open for others. There is no definition for what might be "in the public interest" in GDPR, nor are there guidelines for interpreting when someone is "exercising official authority". One could argue that police departments are doing that 24/7 and thus large chunks of GDPR don't apply to them at all because processing is always lawful as a result.

By leaving themselves so many fruitful avenues of arguments to present to courts that have not been granted to others, the collective EU governments have created a law that holds others to a higher standard than themselves. Hence, hypocritical.

If you agree with them then it’s an issue. Google clearly tracks data that is GDPR personal.

Why?

Filling the coffers is just a nice bonus on top of dispensing some much-needed slap-downs.

I’ll take the hit though.

It’s not just pageview logs, but GA has great tools to analyze those logs, do reporting on some decent set of actions and to bring it all together in a simple to use interface.

You can take your server logs and then what will a non technical person do with them? Not much.

That said, you can deploy GA while opting out of behavioral data and ad network features, and even fuzz ip addresses.

Analytics has the stigma of ad networks because they historically existed to validate ad spend. We’re past that point and they are often used with strict first-party intent.

There’s nothing preventing us from imagining all the malicious things any analytics tool could do, and imaginations run wild.

Disclosure: I work for an analytics company that doesn’t want to own your data, but I understand why folks have a knee jerk reaction to analytics of any kind.

https://support.google.com/analytics/answer/6004245

That includes siphoning money from your account.

Do you mean loading the UI which displays the graphs etc...?

That being said, ultimately it's a frontend on a MySQL database, so there's lots of ways it could theoretically be slow -- MySQL isn't configured/tuned properly, the database server isn't resourced appropriately for the amount of data it's hosting, etc. But this is going to be the case for any self-hosted solution.

I mean, this is always going to be the case with modern computers. No one writes EVERYTHING themselves, so they have to trust someone else. You are trusting the microcode on the CPU, the system calls on your OS, your compiler/interpreter, your standard library.... I get that this is a different sort/level of trust than trusting a third party metrics system, but it isn't fundamentally different. It is all about trusting someone else's work.

It's security-by-obscurity, maybe (as all public "secret token" URLs are) but it's better than what you're implying.

The business argument for Google: they still have the information, and can use it in their analytics, and potential competitors or customers don't have it.

Setting up such a "content farm / honeypot" and making it reach the top results of Google/Bing/Yandex/etc... used to be simple but is nowadays probably successful in only very few cases (as search engines are nowadays more and more context-aware), and Google/Bing/Yandex/etc... can still see & use "how to deal with my XXX infection", but whoever doesn't use directly their services cannot.

What I mean is that, in my opinion, the privacy measures in this case centralized even more power in the hands of few companies with very little added/improved privacy.

In my case, running a small techy website, the search keywords were very useful because they allowed me to understand e.g. which keywords forwarded the users to my website by mistake or correctly, to then correct appropriately the contents of my articles to make it more clear what my articles were talking about, or to see that the users had a very specific problem that I did not take into consideration when I wrote a certain article, etc... . Now I cannot see those infos anymore without using Google Analytics which I don't want to use (or, by using the plugin mentioned above, which is good, but for which I would still have to pay $/year, which is bad as it increases fixed costs).

Why not? How else are you going to 1) provide information on dealing with an XXX infection, or 2) recognize enough people are landing at your site looking for advice on their XXX infection that you should provide some answers?

I'm not saying that we always have to use them, but there are cases where they can be useful.

Do you have an understanding of "Chapter 2 of Title V of the TEU"? My reading of it is "the members are responsible for the security of the union, yada yada..." so it sounds like the typical exception that governments have, but I am am not quite certain of my interpretation.

Jeez, the EU institutions are really good at being inscrutable :(

Yes, that would bother me. I prefer to make my own choices about what I can and cannot access on the internet. Why would I want my ISP doing that for me?

As far as implementing this on a national level goes - I would trust the government much less than I would trust my ISP with that kind of power. At least I can switch to another ISP if mine started abusing it.

There are limited instances were congress has waived immunity through legislation.

I did not dispute this. I merely said enforcement is usually not accomplished via fines when targeted against government bodies, because those are inherently expected to comply without the necessity of threats.

Skimming two of the linked pdfs, these did not mention fines.