Austria's data protection authority has found that Google Analytics is illegal

[1] https://blog.cloudflare.com/introducing-the-cloudflare-data-...

This means that as a business, theoretically you'd have to vet every single customer and supplier regarding their involvement with US-based companies.

Since realistically this would amount to most companies not being able to do any business at all anymore - and consequently the economy grinding to a halt - in most cases this doesn't have immediate repercussions.

However, such unpredictability caused by regulations such as GDPR is a huge problem because you can't ever be sure you won't be issued a - potentially crippling - fine simply because some local authority considered this a good idea.

In fact, this whole case is exactly about that. Some Austrian website tried to use Google Analytics and just added another disclaimer in their cookie banner. Now they are facing the consequences.

So regarding your question, I guess the answer would be: A European website makes use only of services, which are not in danger of the US (or other countries from outside Europe) ordering the company to grant them access to the data. I guess this means, that you cannot use any services, which are offered by companies, which store data in the US and possibly even if they store it elsewhere, but fall under US law.

I'd guess a "European website" stands for a website that safeguards EU users by being compliant with GDPR.

Are the any alternatives that offer the same kind of thing as Google?

But seriously: Google just needs to move the problematic part of their EU business into EU and start complying.

In the article it points out that there are similar suits across the EU by the same organization, so it's not too unlikely that there will be similar reults in some or all of the cases.

It seems Google was sued in Austria and they have found it to violate the GDPR so yes, it applies to the whole EU.

GDPR is a set of minimum standards that are common between countries in EU, some have even more drastic laws.

So that means the current status is that's precedent a court in another EU country would strongly consider but technically could come to a different decision on and in either case the losing party has the option of appealing to the EU level.

The court has not arbitrarily declared GA illegal, it just follows what the GDPR mandates - and came to the (quite obvious) conclusion that GA is not compatible with the GDPR.

Consequently it is illegal everywhere where the GDPR applies. This doesn't mean that there are immediate consequences for those who use GA on their websites in any other country, but it is very likely that other EU countries' courts will decide the same way.

From the article:

> This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.

This article is addressing a specific case which follows from a previous judgement (known as Schrems II) which determined that Facebook could not transfer data from Ireland to the US under the US 'Privacy Shield' framework, as it no longer meets the GDPR's adequacy requirement due to CLOUD Act.

This finding by the Austrian court just reaffirms that the Schrems judgement also applies to Google Analytics.

As the article mentions, this is the first of 101 cases ongoing brought by Schrems, and I expect them all to end in more or less the same outcome.

https://www.europarl.europa.eu/RegData/etudes/ATAG/2020/6520...

China is doing this model for years. Just with a different motive I guess.

They tried this also with Telekom Germany for the Azure cloud but stopped doing it

(the data Google collects about you outside of your account activities still might, though).

As a European, I welcome this wholeheartedly! It makes my daily job harder (as a programmer), but it’s needed to stop this insane industry of using private information as a currency. Most people seem to don’t care, but that is mostly because they don’t understand the consequences of this.

GDPR isn’t really that hard to understand. If you need to gather PII, you need the proper approval from the end user to do so. If you don’t have the proper approval, you can’t store it. Also, don’t gather information you don’t need. If you only need page views, don’t store IP, resolution, localisation and all these things in addition. This is common sense, not science. In fact, you should be happy to have these restrictions, because it lowers the risks in case of data breaches.

The real problem with GDPR is that we’re so used to violate peoples rights that we have completely forgotten how we should behave.

I work for a European company that is already being impacted by this ruling. Our first step is to replace Google Analytics, but I believe we are also looking through all cloud usage for any traces of PII.

I think this is a huge opportunity for European companies to get a foothold in the Analytics/Ads/Cloud/Office spaces. Perhaps also an opportunity for good open source alternatives, like Matomo Analytics, to get adopted.

There is the law, and then there is enforcement of the law, and the latter has not fully happened yet.

Yes, because of CLOUD Act. If GA would create a deployable agent that proceses user data on your server before sending it in aggregate/anonymously to central GA, that would make it usable

> Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned.

It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...

The GDPR covers the privacy of individuals residing in the EU. That means you don't need to track which user has which nationality, you can just make decisions based on the location of your users. If you're an American company targeting American customers then you don't need to worry about Europeans passing by on their holidays. If the request comes from the EU, don't load your personal data collection code, internal or external, if you're unsure about the legality.

That said, if you don't offer any services (free or paid) to the EU and one of your customers happens to use your service on a business trip, you don't need to worry either. This mostly applies to contracts and data procession, much less to actual websites and web services reachable from anywhere, but it's an exemption that'll save a lot of data hoarding companies that track Americans, Asians, etc. through indirect means.