Consent, GDPR and Google Analytics
cunderwood.dev
cunderwood.dev
> At a certain point EU privacy regulators will realise: When an EU citizen requests a US internet resource, they provide a US server with their IP address; An IP address is PII; The CIA could record that; Therefore it is illegal to provide any internet resource to anyone in the EU
Source: https://twitter.com/benedictevans/status/1492102034409066504
PS: saying this a German citizen…
It's also legally difficult to provide bank accounts to Americans: https://www.thelocal.fr/20210924/why-americans-are-finding-i...
Then there was the whole incompatible court orders in re Azure: https://www.theverge.com/2018/4/5/17203630/us-v-microsoft-sc...
Really the only workable outcomes are a global agreement on internet-touching governance (which the US will never accept on principle) or Balkanization. Or I suppose an eternal chasing into new as yet unbanned services.
"This website is in a territory not subject to EU regulations governing privacy, security, and content. Do you wish to proceed?"
> Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.
https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...
Kind of like the current US government blaming inflation on... also the companies. Not the money printing.
It’s not the EU law that’s broken. It’s intentional that if you want to sell someone’s firstborn you need actual approval and not a clause hidden in the ToS
The idea is great, but shady websites make it so you hate it, so that you hate privacy laws instead of the shady companies tracking your children.
Cookie banners is akin to letting browser extensions create their own permission requests.
It'll be hilarious if European nations decide pursuing GDPR cases is intractable when so many services Europeans use are fully outside the country (and beyond EU enforcement of jurisdiction) and they decide a firewall is necessary to protect their citizens from American surveillance. It would prove China was just ahead of the curve.
That's not to mention all of the other, non-legally justified analytics performed by the NSA/CIA etc.
Or maybe I've read too many Neal Stephenson novels.
There's going to be a cycle of "web3 gets big money", "big money fraud in web3", "SEC enforcement against web3", and then the launch of "web4" in 2030.
The issue is if a person visits a resource from a company in the EU, they should be able to expect that that information won’t be passed along to any third party that’s not absolutely necessary. Especially not to foreign governments.
You wouldn’t expect a visit to latimes.com to leak your information to the Chinese Party either.
I wouldn't necessarily expect the CCP to be involved unless Internet routing is having a very bad day, but I'd expect the American government to be involved when hitting an American server.
Presumably you don't expect the american government to get involved after your request has reached latimes.com though?
Old-school me would not have expected that to happen. Post-Snowden? It's a definite possibility.
And... Is that a "favorable" (hope that's the right word, non-native here) thing?
If I walk into a store and buy some gum, my face is on their security camera. If the cops are hunting for a murderer, they can pull that camera feed. Is this favorable? shrug. I like my privacy but I also like catching murderers. And I have no expectation of privacy when I step in someone's store; similarly, once I've shipped 1s and 0s to someone else, my expectation is they'll use them as they will, and if I don't like it I'll stop shipping 1s and 0s to them.
This is probably just my American sensibilities talking, but growing up in a culture where I was building a credit score before I knew what that was, I'm not surprised services like Google Analytics are e-gossiping on my preferences (any more than I'd have been surprised if two BBS owners, back in the day, gossiped about their users).
Does it have to be a company in the EU? I thought the GDPR covered any website an EU citizen, resident, or visitor might use, in which case US-based websites might have contradictory obligations to the GDPR and US law.
https://gdpr-info.eu/art-3-gdpr/
Just because a website exists and may be visited by a EU resident, does not mean that the site automatically has to comply.
It could be argued that such an act "falls outside the scope of Union law;" but that seems to be a matter of contention.
1. They are the legal justification for legislating; The EU is not sovereign, so it cannot legislate of its own accord, the EU must show that the legal powers flow from the treaties. So recitals set out which provisions of the treaties apply, and why the legislators think the law is necessary under them.
2. They are an aid to interpretation; the main body of the law should be read "in the light of" the recitals to understand the legislators' intent and to help ensure there is a consistent application of the law between all of the different courts and tribunals in the EU. These recitals are, of course, not part of the actual legal text and are thus not binding, but they're not inoperative.
Even if it came to a point where the EU decided that the only for to keep its citizens safe from US intelligence monitoring were to cut out all access between EU and USA internets, the problem would be the US intelligence framework, not the EU.
Turn off Google analytics and you can still provide the service.
bit of voyeurism as well
Will they start sueing every US company that doesn't comply with GDPR? Of course not. The EU is doing this to build pressure against the US and their surveillance fetish. And it's good that they are, because otherwise, who will?
The US government has proven time and over again that they do not care about their citizens' privacy and straight up lie to their faces. And then there is the CLOUD act, which now starts to affect non-US citizens, too.
Context matters. IP address along with other information could be considered PII.
The recent German ruling about loading Google Fonts without prior consent explicitly mentioned these rulings and made them a core part of their own conclusions.
[0] The most important ruling is the Breyer ruling (C‑582/14), that found, answering question one, that "dynamic" IP addresses are PII. Further rulings have regularly found that "static" IP addresses are PII, and that you cannot really know what is a "dynamic" and a "static" IP address with reasonable certainty anyway.
"Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person."
https://curia.europa.eu/juris/document/document.jsf?text=&do...
They are personal data because they are a fact about an identifiable person and thus fall under the GDPR's processing requirements esp. relevantly when transferring to third-parties; but they are not per se PII.
https://www.fieldfisher.com/en/services/privacy-security-and...
But Google Analytics is the kind of thing the Law was created to stop, it's not an unreasonable unintended effect.
Forget that. An EU user visiting an EU site might have their packets routed through an entity outside the EU anyway, without their intent and certainly without their explicit consent.
It’s always PII for static IPs, and together with a timestamp it’s also PII for dynamic IPs...
There’s a whole bunch of legal precedent for that in the EU.
https://gdpr-text.com/read/article-49/#para_gdpr-a-49_1_1b
> In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, [...] a transfer [...] of personal data to a third country or an international organisation shall take place only on one of the following conditions:
> [...]
> (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request
> [...]
GDPR does not forbid providing internet resources to EU users, that is simply a lie. All it requires is that data handling happens in the best interest of the user.
Diagnostic logging (e.g. apache logs) is probably okay as long as the organization can show that these logs are destroyed in a reasonable timeframe, but FAFAIK even that is legally a gray area (in the sense that it isn't explicitly forbidden nor allowed).
If the CIA required web sites to explicitly include a privacy invading snippet, even then it is dubious since it is under duress. And in any case, exactly the sort of stuff you would want laws like GDPR to hinder.
The problem is when websites in EU, which are expected to follow GDPR, randomly leak information to businesses outside EU.
Business outside the EU, interacting with users in the EU are bound by the GDPR. There might not really be a way (currently) to impose penalties on those businesses for violations, but they are certainly bound by them.
- When an EU citizen requests a US internet resource, they provide a US server with their IP address
- An IP address is PII (well, personal data as far GDPR is concerned, but that's a nitpick)
- The CIA could record that
I don't think how you would go to a conclusion from those that "it is illegal to provide any internet resource to anyone in the EU".
First, it's worth noting that GDPR only applies to companies that specifically target its services at individuals in the EU. Targeting means having an EU office, using an EU domain, providing EU languages such as Polish or allowing payments in EU currencies. If your service makes no effort to provide service specifically for European users there is no need to worry about GDPR - even if you are in the US.
Second, while US services targeting individuals in the EU are legally problematic, this doesn't affect other countries - so I see no reason to say "any" here. For example, a Japanese server is free to provide services at individuals in the EU provided they comply with GDPR as EU has an adequacy decision for Japan.
Also, I would like to point out you can replace US with North Korea in this argument. I think it would be ridiculous to say that if European Union were to disallow sending personal data to North Korea (including IP address) then it would mean that it's illegal to provide any internet resource to anyone in the EU.
Nope. There's only a single requirement: having EU users.
> In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
In general; we hold that "ignorance of law is no excuse", yet in contract law _capacity_ is a key construct, and ignorance very much _does_ play a part. It's not just minors, the mentally-ill, or those incapacitated by drugs or alcohol, discombobulated or bamboozled by other means, who cannot give consent in a contractual relation. In an age where most lawyers and judges, like everyone, mindlessly click-through "agreements" and shrink-wrap EULAs, there's a strong and growing argument to be made that non-expert adults lack genuine capacity to understand technologically mediated relations.
In other words, it's the contract law that underlies this stuff that's coming up for revision, not the surface interpretations. The important matter now is not deliberating whether the letter of the law creates "consent" on this or that occasion, but whether the spirit of the law allows for consent even in principle, given societal standards of digital literacy and the complexity of modern digital interactions.
That's an interesting problem. I'm a little disappointed that the route we've gone is having courts decide that this or that bit of EULA isn't binding, but people are still expected to read them and be somehow bound by them. It's kind of difficult for the common man to find out which parts of an EULA are or can be legally binding, so why should they ever be read?
For a while now I've been thinking that EULAs should also be made simple and clear and understandable, kinda like they're forced companies to do now with consent dialogs. No walls of text, no small print, no legalese, and definitely no tons of obviously unenforceable but chilling terms (that the poor reader might think are enforceable).
It does not feel right that people are "agreeing" to something they didn't read anyway (and which if they did, most people wouldn't really understand anyway), and they can only find out what their rights are after the fact.. so maybe we should just say that such agreements are not okay, stop it. It should be easy to understand exactly what you are agreeing to (or possibly we could just have the terms in law and stop this silly game altogether).
I think the silly interpretation of copyright law (that any transient copies made by your computer when you install or run a program constitutes copying and thus require the copyright holder's permission) should be undone. You shouldn't need a license to use a program any more than you need a license to listen to a music disk or read a book or watch a movie or painting. I think that interpretation of copyright law is fully based on a technical gotcha and not in line with the spirit of the law.
But it's just too much and too overwhelming and most of it is just completely cookie cutter legal babble which I can't waste my time with. I recently bought a video game to play for fun and when I first started it I was asked to sign off on a ridiculously long legal text followed by five(!) revised versions of it from various updates. What am I to do? Spend a few evenings reading and comparing those instead of playing the game I'd bought? Realize that I couldn't play the game I'd bought and ask for a refund? Or just scroll through, click to make it go away and enjoy my game without thinking more about it.
https://blog.cloudflare.com/keep-analytics-tracking-data-in-...
https://cunderwood.dev/2022/01/30/tag-management-is-no-longe...
I would like to see an article regarding Google Recaptcha. I am currently considering Recaptcha during a login process as a means of protecting against credential stuffing and password brute forcing. But I do not know if this counts as "legitimate interest" as defined by GDPR. And if it doesn't, there really isn't any way to ask for consent in this case, because "denying" consent sidesteps the entire security measure...
Please don't, think about your users. Just use normal rate limiting instead of forcing me to select more god damn street signs.
Spam bots can be slow yes, but this is about credential stuffing, that can not be done slowly or else it'd take years.
If you let attackers have like 10 attempts per ip per minute and you're a site where a bunch of people have accounts then you're gonna become an instant favorite for testing stolen creds.
Captchas don't really work, the only things they do is let google track more people and annoy humans. You let your users train their AI for little to no protection agains a willing attacker. I'll admit captchas protect against many scriptkiddies that buy passwords. I'd rather teach my users to use a password manager or support passwordless login than let them click on cars for "security".
The users above are referring to opting in/out of the tracking rather than the blocking of the tracking - so GA on Firefox by that standard is opt-in, even though in a Firefox specific context the setting is opt-out.
Obviously the EU wouldn't be cool with "but a competing browser with a small market share blocks us by default anyway".
What I meant to say: third-party tracking is still opt-out, since you need to actively enable the content blocking to avoid being tracked. The blocking of said content trackers is opt-in of course, but that's not what I was referring to.
It's not really an importance distinction in the end though.