Italian watchdog bans use of Google Analytics
gpdp.it
gpdp.it
(We're tracking these cases on isgoogleanalyticsillegal.com along with details for each.)
Note that it's not illegal to use GA entirely, just illegal to use in its default state which transmits PII to the US.
Google should be the one doing the compliance work. If Italy bans some usage pattern in GA, it's Google that should make it impossible to configure it in non-conformant way.
The most difficult aspect is dealing with URLs. But a company that is large enough to be customizing URLs per user, is large enough to make a few JS changes to ensure they aren't sending those details to GA.
As I mentioned in a sibling comment, this is technically true but complying with GDPR takes more than unchecking a few boxes. I've never seen any GA set-up that would remotely approach compliance. At minimum, you need to mask IP's before they reach Google, which means standing up a non-Google server to proxy all the hits. That is more complexity than 99+% of GA installations.
For many clients I have set up a cookie compliance tool like Onetrust, which blocks loading of GA and other scripts with one of the consent popups. With this combined configuration (and having verified nothing sneaks through before someone gives consent) most company legal / compliance teams I have worked with have deemed this to be a fully compliant setup. Of course, this might not be actually compliant, but the company legal team has done some research and arrived at this as the most advantageous position currently available.
I think using a compliance based tool like Onetrust also gives a sense of legal security in that if our configuration is properly set up they are advertising that we then get compliance as part of their service, and so responsibility of a violation could potentially be passed to them in a legal setting.
ref: https://support.google.com/analytics/answer/2763052?hl=en
Every time I've seen a cookie popup from Onetrust, it was obviously illegal because "Reject all" was not the easiest option. It's fine if "Accept all" is as easy as "Reject all", but nothing is allowed to be easier than "Reject all". Have they fixed that yet?
The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. This information was found to be transferred to the USA. In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.
The IP-anonymization feature in Universal Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to Google Analytics.
As a side note, OneTrust has the worst of the worst cookie banners, to the point that I no longer even open websites that have that crap installed. It's also illegal by making it harder to reject tracking than to opt-in, there just haven't been any specific lawsuits about this party yet.
Google announced earlier this year that Google Analytics 4, its successor, does not log or store IP address at all.
I don’t know whether UA or GA4 service was the subject of the Italy case, but I would not be surprised if it was UA. Most sites have not switched over to GA4 yet.
So if I go to a website and it has me load code from Google's servers it's still got to send my IP address to them. I'm not sure why we'd take them at their word that they won't keep that data around (I'd like to see that independently verified). but it'll be sent to the server logs if nothing else. What does not storing the IP address even mean? Do they hash it and store that instead? Do they do a quick lookup and just flag your dossier logging the connection and when it happened before dropping the IP info?
If people care about their privacy I think it's probably best not to send information to Google in the first place. There are alternatives to google analytics after all.
There is no real alternative to Google Analytics for most companies because of the Google Ads integration. If you advertise with Google, you need to send them conversion data, which means the GCLID. Without Google Ads, switching would be simple. Most enterprises already pay for other analytics tools.
Thanks! I didn't know that was an option. I haven't noticed sites doing it yet at least, but I hope it catches on even for sites targeting US visitors! It'd be especially nice for government websites using GA.
The fact that it receives the IP address at all renders it illegal in Italy, and probably anywhere GDPR is in force. And IP address truncation doesn't get you anywhere; it's Google that does the truncating, so the whole address is actually sent to Goo, by which time it has departed from GDPR jurisdiction.
So the existence of Google USA makes Google Italia operation illegal.
Either US company get's the data from the Italian one, making the Italian operation illegal in Italy
Or
The US company doesn't get the data from the Italian one (despite ownership), making the US company illegal in the US.
I don't think anyone is under the illusion that the latter option is chosen when push comes to shove.
Companies can always choose to ignore a specific nation’s laws[1], they don’t still get access to that nations markets. At the borders the nation state is the one with the guns and firewalls
[1] unless you piss off a nation that can project global power, lol if you piss off China or America
Google, Facebook etc. being blocked in China.
etc.
Chinese and American police forces both operate abroad and like to flex their power. The NYPD was in a similar situation post 9/11 when they started trying to police nearby states and when they sent operatives to other countries even against their own federal government [1].
Russias also sent operatives overseas in some fairly public assassinations. It’s not really surprising that China does this, it appears to be the default operating procedure of powerful countries
[1] http://america.aljazeera.com/watch/shows/the-stream/the-stre...
https://en.wikipedia.org/wiki/CLOUD_Act
(God willing they repeal it, even if only for the international commerce implications...)
So this is very different than GA, but depending on the threat-model can be worse. Also very similar metrics can be gathered from the data as from a GA cookie (are they eating, cooking, showering, watching TV).
CloudAct would (or should) in this case also apply here or what am I missing?
Obviously they don’t have full range of services the big three have. But maybe just enough anyway.
It is a hot topic, here are a few: IONOS - https://cloud.ionos.com/ Onep Telekom Cloud - https://open-telekom-cloud.com/en
But if you want to do scale in Europe you have to go for OVH: https://www.ovhcloud.com/en/
This blogpost lists a few :
https://news.ycombinator.com/item?id=27393854
Also, even if no options were available, it's not like the law would care - the illegality of it has been advertised for years...
Alibaba has a sizeable cloud offering and has for years.
If anybody seriously thinks US authorities will quietly lose a key power after enjoying it for 21 years, I have a few bridges ready to be sold.
It's hard to express how impossible this is. It is very very strongly in the state's interest to keep powers like this. We're more likely to get communism...
The title of this post and a lot of the comments are projecting what they want GDPR to be (all non european online entities banned from doing business in the EU) vs how its being enforced.
https://support.google.com/analytics/answer/6366371?hl=en#zi...
Then there's an argument that the IP address still reaches Google servers before it's deleted. But that's just splitting hairs at this point. If Google doesn't process the data with IP the IP address I see no harm.
IP addresses are not something that you can choose to not send at all. It's kind of required by the TCP/IP stack. If that was the case users in EU could not access any website in the USA.
https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586...
https://www.cnil.fr/en/use-google-analytics-and-data-transfe...
https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...
https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
NOYB is the primary source tracking these cases and generally was also responsible for filing the complaints that led to them. All the details are available from NOYB's GDPRhub wiki, https://gdprhub.eu. GDPRhub attempts to provide information on all the European DPAs including how to file complaints. At the least it provides contact info for all the DPAs and English translations of DPA decisions.
As stated in 13 Jan 2022 announcement on noyb.eu, these decisions are generally the result of the "Max Schrems II" decision. After that decision, Schrems filed 101 complaints to DPAs, and now the chickens are coming home to roost.
Note that the "legality" of Google Fonts, under the default configuration, is also in question. Arguably use of Google Fonts is even more widespread than use of Google Analytics.
What exactly will happen me if I do not block Europeans from using my website?
> What exactly will happen me if I do not block Europeans from using my website?
My website is available to Europeans. They use it. They even pay me money for it. What's going to happen?
> The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022.
At least you removed "the only open source product analytics platform" and the Google fonts since the last time a Posthog employee posted it https://news.ycombinator.com/item?id=29994183
Send me a hello email at the address listed on my profile, would be happy to send out an invite when ready.
A privacy-conscious serverside GTM/GA implementation won't leak any personal data like IP address to Google, but there's no way to avoid sending the GCLID if you advertise.
A lot of companies are dependent on Google Ads for demand generation, so it's the reason they are sticking with GA even as the writing's on the wall.
You need consent for every kind of storage usage on client side if you create profiles to analyze the them for marketing goals. If not, and no PII is being processed, no consent is required. Eg you could easily aggregate your server logs without a consent.
But if you use the data for analytics purposes, you do need the users' consent for that, even if it's the same data that you use for operational purposes.
That's not correct; if you collect PII, even if you don't use it, you need consent. Actually, if you don't have a legitimate use for the data, you are prohibited from collecting it at all.
GDPR isn't an assault on online marketing; it's about privacy.
We're not. And that's exactly the point, because we don't want to track. I make a distinction between tracking, analyzing and stats. What we do is guess who are the unique visitors (and who are not), and I say guess because it's guesswork since the browser can spew out any kind of info.
Cookies you require for functionality (ie. login cookies, language settings) require no consent, but do require to be laid out in a cookie policy.
Printed newspapers are disappearing. Ad supported news sites need tracking for ad targeting otherwise there isn't enough ad revenue to support their business.
Supermarkets are a bad example here because they are a critical link in the distribution economy.
Google? Not so much
Processing of your users' personal data is legal only in the few exceptional scenarios outlined in Article 6.
So "exceptional" in the sense that they are exceptions to a more general rule, as of opposed to the sense of being extraordinary.
All digital startups are literally doomed without the indiscriminate collection of personal tracking data.
Side note: thank you modern adtech for consistently recommending me products I already bought days and weeks before. Very effective. Gullible companies just keep paying cold hard cash for these garbage recommendation systems because some sales rep talks fluffy about AI and machine learning, it's so mindblowing....
I don't see how it's more costly or less profitable. Judging by the amount of lawsuits per capita I think it's way more likely to get sued in the US than Europe. And guess what's more expensive or complicated for a European company?
I run Simple Analytics [1], which is a privacy-first analytics business from the Netherlands. I see a lot of business from the EU just because we are from the EU as well.
Out of the big cloud providers only Azure feels even remotely safe to use (if only because of the privacy reputation of Google and Amazon).
Because (NSA aside), they have been caught less often transferring private information and "stolen" company secrets to third parties ?
Microsoft's telemetry in end user products is known to tech savvy people but the company is mostly known for its operating system and office suite that most businesses already use. Additionally in Germany Microsoft used to offload its enterprise services to Deutsche Telekom (or T-Online I think) operating them for MS under the Microsoft brand, thus appearing even more trustworthy by effectively handing over control to a well-known German company. This changed but reputation sticks.
They continue to support the CLOUD act as a "first step":
https://blogs.microsoft.com/on-the-issues/2018/04/03/the-clo...
Side note, I'm slowly getting tired of people ignoring regulations and compliance simply out of laziness.
If I had to chose an analytics software for a customer's website, I'd chose someone in EU for the sole reason that it would be compliant in both EU and the rest of the World.
I self-host Plausible which is GDPR compliant and gives me all of the features that Google Analytics is actually good for. There is so much bloat in GA that provides absolutely no extra value.
I'm skeptical that this is a bad deal for EU citizens.
[EDIT] missing and
On my part, I'm not too concerned with that... they operate on a massive scale and no human is looking at my individual data. The result is me seeing fewer ads that are irrelevant, which is good for everyone (for example, no one benefits from showing me an ad for feminine hygiene products, and if Google and Facebook can make sure that doesn't happen, all the better).
If anything, EU startups could benefit from better control over the tools they use. One interesting halo effect of Google seeing that much data is also that US startup from ex-googlers get a head start on many insights.
These things have not been legal since the GDPR went into effect, and in some countries even before then.
To be compliant with the GDPR, the US needs data laws which only affects citizens on their own soil and not overreaching to EU citizens.
I’ve been following the cases with regard to privacy in the EU and it’s a complete joke. You have all these onerous rules against any web technology making it near impossible for startups to function without an army of lawyers. Think I’m exaggerating? Look up the provisions under GDPR for any business, big or small, to set up a website and then process a single user request for their data even without sign in.
The UK is sick and tired of this and has recently begun moving to ignore these onerous rules. All power to them.
First: GDPR is a compromise, so it's a bit uneven. That's partly due to lobbying by google and friends. Second, privacy very much needs protection. Even if you are perfectly fine giving up your privacy, other people aren't. Third: you can actually process user requests. Depending on how you do it, you don't even have to show a banner. Is that really too intrusive?
You’re taking pains to explain why GDPR is a compromise? Why? If it’s bad law, it’s bad law.
Nothing you said invalidates the assertions I’ve made. Unless you’ve directly experienced the onerous system of regulations in places like Germany, I’d urge you to do more research before the armchair dismissal.
Presumably it's your opinion that it's a bad law. The majority of Europeans think it's a good law - possibly the best regulation the EU has ever promulgated.
Ie, onerous toward regular businesses Ie, used to greatly expand bureaucracy and overhead Ie, used by unelected bureaucrats to wage battles of personal vendetta against specific companies instead of doing what laws do, which is set unambiguous standards for all
There's no "personal vendettas" going on; can you substantiate that allegation at all? The GDPR applies to everyone equally. And unlike some laws, it's fairly easy to read; it's meant to be understood. Don't bother reading some biased summary of the Regulation; read the GDPR itself. That's the best guidance on the intent, and the best guidance on how to comply.
/me: former data protection officer at a web development outfit.
And that's just ONE sub clause of a hundred or so.
The overhead is both in the arbitrary nature of the requirements (Good Laws are objective, not subjective) and the sheer lack of consistency in the enforcement is ridiculous for any European business. Consider the adequacy clause that's taken decades to litigate and is still fucking criminal as of this writing.
Answer this simple question: "Can I, as a small business use AWS services that may or may not have a compute instance located in the EU?". You know pretty well what the answer is there, so, basically every small business in the EU is in violation right now. And it's bureaucratic assholery that keeps this deliberately inconsistent so they can choose to enforce it at any point of their choosing (read, a negative PR cycle) - Monarchy, inconsistency, arbitrary and ambiguous rulemaking that has tossed out the interests of businesses.
The vendetta against Google is well documented and it's insulting for you to even say otherwise. Look at the most recent example of the CNIL (Frances privacy enforcement body, a part of the executive) choosing arbitrary standards and refusing to even elaborate on concrete standards for recommended analytics solutions that businesses may use. They have gone full psycho with not even wanting to give Google the opportunity to come into compliance with standards that they choose not to reveal and instead openly ask industry to turn Google Analytics off. Its ridiculous and bad for their own economies.
There's a difference between the way French and Germans write laws and the way we write them in the UK; I prefer the UK style, which leaves less room for interpretation.
> basically every small business in the EU is in violation right now
Only if they're handling personal data. Most small businesses don't.
Sure, if your business is collecting personal data, then GDPR is a problem for you; in the same way as the Road Traffic Act is a problem if you're determined to drive uninsured. If you want to sail close to the wind, then it's probably wise to lawyer-up.
And, of course, you don't have to use AWS.
> And it's bureaucratic assholery that keeps this deliberately inconsistent
That's not how I read it. The way I read it, GDPR is astonishingly lenient. Before they prosecute, they'll warn you; provide advice on how to come into compliance; and give you time to do it.
> choosing arbitrary standards
If GA involves depositing personal data in US jurisdiction, then you can't use GA in a GDPR jurisdiction. That's not vague or arbitrary. It may be - um - bold; But this law was flagged up years before it came into force. It's not as if the law came out of nowhere, and suddenly everyone's in violation.
> Its ridiculous and bad for their own economies.
Others have argued that GDPR is an attempt by the EU to steal Silicon Valley's breakfast, implying that it's good for European economies.
Interesting way of saying they are bad laws. If you cannot, as a business have certainty in your prediction of the regulatory environment, you're pretty fucked. I wouldn't expect a piece of the bureaucratic establishment such as yourself to understand the struggles of setting up and running a business. What was your role as DPO again? An ornamental peace offering to the burdens imposed by regulation? Not all businesses have the luxury of throwing money at legal resources.
> Only if they're handling personal data. Most small businesses don't.Sure, if your business is collecting personal data, then GDPR is a problem for you; in the same way as the Road Traffic Act is a problem if you're determined to drive uninsured. If you want to sail close to the wind, then it's probably wise to lawyer-up.
It must take a special kind of asshole to say this. In just another one of your recent comments here you mention that even the mere presence of an IP address that ISNT EVEN STORED would put a business in violation and liable to large fines. So you pretty much agree that all small businesses are in violation if they use AWS in any reasonable way to run their business but you don't want to say it explicitly here since it makes you look bad. Gotcha.
> And, of course, you don't have to use AWS.
And of course, the European people elected you their lord and savior to tell businesses which tech stacks they pick and choose because of your interpretation of arbitrary laws. See the problem here yet?
> That's not how I read it. The way I read it, GDPR is astonishingly lenient.
Is it? So why did other member states of the EU take offense at the decision of the Irish DPA ? The one stop provision clearly stipulates that the onus of enforcement falls to the one stop shop and instead, the arbitrary nature of the law as it stands, other member states and bureaucrats in Brussels seem to deem it necessary to impose their will and personal vendettas against the perceived soft touch approach of an entity fully within their rights to do so.
> If GA involves depositing personal data in US jurisdiction, then you can't use GA in a GDPR jurisdiction
Has there been any warnings against AliCloud for instance? Or all the analytics bundles shipped in Huawei phones?
I can't seem to recall any press release or webpage dedicated to a single company like the CNIL and now Italian authorities have adopted towards Google Analytics?
Is there any oversight to these agencies allowed where these decisions are up to public scrutiny such as the FOIA act in the US to assure the public that these highly paid public officials are not wasting all their time and money chasing personal vendettas as seems to be the case here? Of course fucking not.
Is Google Analytics perfect? Maybe not. But this is the crucial point . . THE LEGISLATURE CANNOT DISCRIMINATE AGAINST A SINGLE ENTITY THIS WAY. While turning a blind eye to practices by Huawei and other companies, it is simply against the rule of law.
> Others have argued that GDPR is an attempt by the EU to steal Silicon Valley's breakfast, implying that it's good for European economies.
A weasel through and through. What else did i expect from someone in your position?
So, illegal abuse of power by Government to target a company is fine by you, Mr. DPO ?
Good Lord, presumptions much?
I said I was DPO in my last job. I was also the main sysadmin, and as my main role a website developer. This was a company of 10 people including the bosses. Someone had to take on the role.
> It must take a special kind of asshole to say this.
It must take a special kind of asshole to say that, to someone you haven't met and know nothing about.
> but you don't want to say it explicitly here since it makes you look bad. Gotcha.
Not really; I've never evaluated AWS for compliance. The reason I didn't say that is because it's not something I know about. We didn't use AWS; I've used it, but in someone else's coding shop, where AWS compliance wasn't my concern.
May I suggest that you're a bit hasty with words like "clown", "asshole", "weasel" and "gotcha"?
> And of course, the European people elected you their lord and savior to tell businesses which tech stacks they pick and choose because of your interpretation of arbitrary laws. See the problem here yet?
How are things over there in Conclusions, where you seem to have jumped? I have never told anyone what tech stack they should use.
> THE LEGISLATURE CANNOT DISCRIMINATE AGAINST A SINGLE ENTITY THIS WAY.
Where in the GDPR is GA mentioned? Or AWS, for that matter?
For the sake of clarity, no legislature had anything to do with the GDPR; it was promulgated by the European Commission, an important part of the EU bureaucracy, and I have never worked for any part of the EU bureaucracy. In fact, I no longer even live in the EU.
> A weasel through and through. What else did i expect from someone in your position?
And what position is it, that you think I occupy? FTR, I'm a retired software developer. The position I occupy is sitting in an armchair.
> So, illegal abuse of power by Government to target a company is fine by you, Mr. DPO ?
Nope. In fact I'm also against legal abuse of power, whether by government or anyone else.
You seem to be very angry; perhaps social media is not for you.
ie, that any small or big business inadvertently sending even an IP address that isn’t even stored to touch a US based resource in something as innocuous as AWS.
Seeing your other recent comment here, it seems you’re just a moron with a nationalistic tendency to support your countrymen (and women). Oh well, objectivity dies and future generations on your continent suffer. Who cares, right? You’re retired.
If an IP address is sent to the USA, then whether it's stored or not ceases to be a matter that European courts can oversee. Since US courts and European courts are not in accord on these matters, Europeans are faced with either banning the export of IP addresses to the USA, or giving up on legislating privacy at all. We chose the former.
> it seems you’re just a moron with a nationalistic tendency
Oh, more name-calling, and more conclusions jumped to. If you can't make an argument, make a personal insult, and decorate it with insulting epithets based on nothing at all.
> future generations on your continent suffer
Ah, you're not from these parts! I thought not. But in the light of that fact, it's our concern, not yours, right? So why do you get SO angry about European law? If you want to trade in Europe, you have to comply with European regulations. Same wherever you want to trade.
I don't approve of the US trade environment. For example, about half the world is under US trade sanctions; but you don't get me marching around accusing USAians of being morons, weazels, assholes, and clowns.
Perhaps the truth is that it is you that is the nationalist?
You expect a business that's invested in the AWS stack to up and move overnight because some illiterate morons in Brussels decided that?
It has been my view for a long time that entrusting your infrastructure to the tender mercies of a firm like Amazon is reckless. Here we have a situation where the legal environment has changed; AWS hasn't changed to match; so those companies that chose to rely on a 3rd-party infrastructure provider appear to have made a mistake.
If I had been advising one of those companies, I would have advised them to bring critical infrastructure in-house. But there might have been other options, like using Europe-based infrastructure providers.
I've never been involved with budgets and so on. It's not my concern how much different solutions cost. I just think the principals of companies have a responsibility to avoid third-party risk - which is what you have, if you rely on a third-party for critical company infrastructure.
That's why I was able to persuade my employers to bring their email service in-house. It worked, and the bosses were pleased with the improved service and reliability. We also constructed our own in-house build and deployment train; that worked very nicely too.
Maybe the cost-benefits vary according to the type and size of business. I'm not a researcher, and I only know about the things I've looked into. But my guess is that AWS works well for companies that are after a quick buck (e.g. an IPO).
> unelected bureaucrats
Does the American elect the IRS or the FTC bureaucrat?
I have officials in the EU on the record that IP addresses are deemed personal information and if your business uses AWS and unintentionally passed IP addresses over to any resource in the US, you are technically in violation.
Will you be hanged for this today? Probably not. But all it takes is one negative press cycle for the idiots there to interpret and enforce this as they have shown the willingness to do in the past.
The point about unelected bureaucrats isn’t the unelected part. It’s the lack of oversight or consequence or clear demarcation of legislative power from the executive.
The bureaucrats have taken it upon themselves to issue multiple specific rules that go over and beyond the text of any law. See the case of the CNIL in France. They had a court ruling around their rules for cookies on Google go against them and they continued to insist that they would enforce said law. They issued an “FAQ” on their website that indicated threatening language against businesses that flouted their previous comments that were now deemed incorrect by a court of law and had the audacity to press on.
Like I said, the EU is an abusive monarchy
Of course, everybody knows that. You have to have good reasons to store people’s IP addresses (ie security logs, which must be disconnected from the tracking/telemetry system).
> Will you be hanged for this today? Probably not. But all it takes is one negative press cycle for the idiots there to interpret and enforce this as they have shown the willingness to do in the past.
If the regulator finds out that your analytics or recommendation system (which again is not the system where you store logs) is collecting and processing IP addresses without users’ consent, they will ask you to stop. If you don’t they will eventually fine you.
> The point about unelected bureaucrats isn’t the unelected part. It’s the lack of oversight or consequence or clear demarcation of legislative power from the executive.
GDPR has been made/negotiated by the European Parliament (which is elected directly), by the Council of the EU, which is composed by ministers of member states, and by the Commission (whose members are elected by the Parliament and the Council). These are the legislative and executive branches of the EU, not a bunch of unelected bureaucrats.
If you were referring to the regulator, well, all regulator bodies are made of “unelected bureaucrats” by design (that’s why they are referred to as “independent agencies”).
> The bureaucrats have taken it upon themselves to issue multiple specific rules that go over and beyond the text of any law. See the case of the CNIL in France. They had a court ruling around their rules for cookies on Google go against them and they continued to insist that they would enforce said law.
It seems that you are very agitated because the CNIL (some unelected bureaucrats) imposed a blanket ban on cookie walls and then the Council of State (some other unelected bureaucrats) held that such blanket ban could not be imposed. An honest observer would acknowledge that these things happen everyday (the Council of State wouldn’t otherwise exist), the matter is quite complex and that the gist of the matter hasn’t changed: “in order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information”. So one may still be fined for a cookie wall.
If what is upsetting you is instead a court case, the only one I could find is the recent 150mln€ fine that Google appealed on jurisdictions grounds and that was upheld, again, by the Council of State.
Either way, I wouldn’t get too agitated about complex court cases in foreign countries thousands of kilometres from my home and whose language I don’t speak.
> Like I said, the EU is an abusive monarchy
I will point to Proposition 7 of Wittgenstein’s Tractatus and I won’t indulge you further on this.
Lol. Thank you for agreeing. You're completely wrong about the fines part, it is discretionary. ie, if tomorrow, there is a negative press cycle, you will certainly be hit with any punishment of their choosing. The incremental warning and fines approach has no practical or legal basis.
If it does, get it in writing from __ANY__ entity entrusted with enforcing the GDPR, you will be laughed out of the room. Europe is a clown show. Ambiguity rules.
> These are the legislative and executive branches of the EU, not a bunch of unelected bureaucrats.
Oh really? Read my comment again. These assholes in the executive are directly changing the letter of the law. ie LEGISLATING.
They are further doing so with the stated objective of harming a single company. I can point you to the statements of a hundred or so elected officials, not least of all the president of the European Comission who said so in no uncertain terms when she was in the US for SXSW.
> It seems that you are very agitated because
I didn't ask you to diagnose anything, Dr. Phil. Sit the fuck down and read the comment again. The Council of State in France is who the CNIL reports to. They are the administrative justice Supreme Court.
When an agency goes fucking rogue against their oversight body while trying to kill a company, what else is it other than abuse of power? The very fact that you choose not to call this out makes me question your motives and judgement.
We have laws for a fucking reason. Not to print them out and hang them on the walls like ornaments but so there is discipline in the exercise of power entrusted in people with the power of Government. We can't have personal vendettas run through governmental office.
> I will point to Proposition 7 of Wittgenstein’s Tractatus and I won’t indulge you further on this.
Fancy. Should i be impressed? Does that disqualify all the abuse of power in your eyes?
Not any punishment of their choosing, but according to Art. 83, that defines the maximum fine and the criteria to determine it.
This is not different from what the FDA or the SEC do in the USA. Or do you think they define exact fines for all possible misbehaviours up to the second decimal point regardless of mitigating factors or negligence?
> The incremental warning and fines approach has no practical or legal basis.
The legal basis is GDPR, which is a regulation of the EU. Do you mean that it goes against some EU treaties or rulings of the CJEU? Or the problem is that this notion upsets you somehow and you are telling me because you think I should do something about it?
> If it does, get it in writing from __ANY__ entity entrusted with enforcing the GDPR, you will be laughed out of the room. Europe is a clown show. Ambiguity rules.
I don’t understand what I should get in writing. Art. 83 of GDPR?
> Oh really? Read my comment again. These assholes in the executive are directly changing the letter of the law. ie LEGISLATING.
The Commission has the right of initiative, that is they propose laws that are approved by the Parliament. I’m not sure I understand what is upsetting you here.
Who are “these assholes in the executive” you are referring to? Are they the Commission or CNIL or both or none? I don’t live in France, but I’m sure the CNIL is not making new laws. If it worries you, I can ask around.
> We have laws for a fucking reason. Not to print them out and hang them on the walls like ornaments but so there is discipline in the exercise of power entrusted in people with the power of Government. We can't have personal vendettas run through governmental office.
Which is why the Council of State blocked the CNIL and also why you should not get so upset.
> Fancy. Should i be impressed? Does that disqualify all the abuse of power in your eyes?
I won’t indulge you further on this.
To sum it up, you don’t seem aware of how the EU makes laws but yet you know enough to be very agitated. You are especially upset with French bureaucrats, because some of them made some mistake and other French bureaucrats corrected them. For avoidance of doubt we’ll certify that you are very upset with both groups and that you think something should be done about it.
We’ve established that there is presently different outcomes for the same actions under European law. Ie, if you send IP addresses today to AWS, you could be deemed to be doing something illegal overnight subject to 4% of global revenue or 20 million euro fines.
This isn’t about cents or decimals, jackass. You know very well this is about coverage.
Under the FDA or any US agency, you have an option to appeal to an independent branch of government whose decisions are binding. Here, we see the opposite take place in France. Lawlessness. Monarchy. Being run through the bureaucracy. You can’t even bring yourself to admit that the CNIL arrogantly brushed off effectively the SUPREME COURT OF ADMINISTRATIVE JUSTICE. You say it’s a “mistake”?? Are you fucking kidding me? Deliberately doing to opposite of what your oversight agency rules is abuse of power.
Can a European citizen simply ever say “yeah, fuck the GDPR, I know that’s a law, but I won’t follow it, doesn’t apply to me?” Of course not. So what gives the CNIL the power to ignore their responsibilities under French and European law?
Even after being blocked by the Council of state, they chose to target an individual company with the exact thing that they were instructed is legal and they should not be interfering with. Respect laws only when you like them?
Clear abuse of power, horrible precedent for democracies and rule of law everywhere and most European assholes connected to politics i speak to behave the way you do, try to brush it under the carpet? Anyone with half a brain will be aghast at what is happening is the EU and if you clowns think discourse that defends assholery from the bureaucracy wins you any favors or makes Europeans lives any better, you more stupid than I’m giving you credit for here.
If you are breaking the law, if a regulator finds out, you may be deemed to be doing something illegal overnight. Yes, that’s how everything works everywhere. What is worrying you now? The sound of a GDPR breach in a forest where nobody can hear it?
> Under the FDA or any US agency, you have an option to appeal to an independent branch of government whose decisions are binding.
Of course you can file an appeal, just use Google, you’ll find plenty, some successful and some not.
> Here, we see the opposite take place in France. Lawlessness. Monarchy. Being run through the bureaucracy. You can’t even bring yourself to admit that the CNIL arrogantly brushed off effectively the SUPREME COURT OF ADMINISTRATIVE JUSTICE. You say it’s a “mistake”?? Are you fucking kidding me? Deliberately doing to opposite of what your oversight agency rules is abuse of power.
You are getting fixated on a very minor case of French administrative law, that you didn’t even care to understand. The ICO made a minor mistake in considering all cookie walls illegal. The Council of State said that they can’t make a blanket ban, but that they should evaluate all cookie walls individually. No fine has been annulled and the ICO can still deem your cookie wall illegal. So still no monarchy for you.
> Anyone with half a brain will be aghast at what is happening is the EU
Anyone with a half brain will at least spend some time understanding the issue at hand before getting excessively agitated.
By admitting data flows to us resources are illegal, you’ve just said that what you’re doing right now can be construed as illegal activity on the part of the website you’re on. HN is indeed hosted on us resources. You touch Microsoft excel and guess what? Us resources get your personal data.
So you’ve just basically admitted that under GDPR, all regular internet activity is illegal if it touches a US server. Hence “coverage”. Hence, everyone living under really, the discretion of the monarchs.
Thanks for playing. Dumbass.
> guess what? Us resources get your personal data.
From posting to HN? AFAIAA, HN only gets your IP address. GA gets your search history, which is a bit different.
It doesn't matter post that statement what your conclusions are. You have opened up every business to a liability of 4% global earnings or 20 million Euros WHICHEVER IS GREATER. . .at the sheer discretion of some illiterate fucks like yourself in Brussels.
You don't seem to know what a monarch is. You're ranting about a French regulator; you don't seem to be aware that the French got rid of their monarchy before the American colonies did.
> if you clowns think discourse that defends assholery from the bureaucracy wins you any favors or makes Europeans lives any better, you more stupid than I’m giving you credit for here.
The value of your "credit" diminishes with each post you make. Apparently your view is that "Anyone with half a brain will be aghast at what is happening is the EU"; well, either Europeans are, in fact, aghast, or you're really referring to your own "countrymen", which I suspect is a rather small clique of USAian tech bros.
Have a chill-pill, dude. GDPR is European law, for Europeans. You don't have to come to Europe, and you don't have to trade here. If you stick to jurisdictions that don't, in your view, involve assholery, then everything's copacetic for everyone, right?
I have a strong sense that you want to trade in Europe, without having to comply with European law. That's not going to work.
Perhaps if you were to actually highlight the issues you claim to have highlighted, it might be easier for us and our "kind" (I don't know what "kind" I belong to). You rant about the European "monarchy", and the deficiencies of European bureaucracy; what about explaining your proposals for a reformed GDPR?
But I think you are opposed to any kind of privacy legislation. GDPR steams you up because it is privacy legislation that works. Well, that's fine; there are laws that USAians make that I'm opposed to. I'm not on-board with US lawmaking and judicial processes. That's fine too; I don't have to live or trade in the USA (and I did make a choice; I once lived in the USA).
I suspect that something about the GDPR must have bitten you quite badly - would you consider sharing what it was? It would be helpful if you avoided the "asshole", "weasel", "moron", "dumbass", "illiterate" language, and focused on what happened, and what the impact was.
NOTE: there are people here that don't seem to be good at spelling, but I don't think I've ever come across a post here that I would describe as "illiterate".
1. Toss it out. All of it. In the present form, it is worthless. 2. Make privacy regulation simpler, not ten million pages and bureaucrats who are RIGHT NOW, abusing the power that all Europeans have entrusted them with. 3. Enable independent oversight. Consultations with technical committees of technology companies, Judicial reform to ensure there is no legislating from the bench, independent whistleblower handling to investigate abuses of power such as the CNIL case. 4. Separate the legislative, executive and punitive functions with very tight rules. We have assholes in Brussels so married to the idea that all tech is bad that they rebelled against the moves by the European Parliament to codify data transfer laws between the EU and US during Bidens visit. I mean, there is a limit to short sighted thinking. 5. Stop the political uncertainty with the multiple changes and the sheer amount of idiotic bureaucracy with multiple conflicting regulations where EVERY SINGLE FUCKING THING is a crime and instead, pick the most pressing issues: Cybersecurity, Data Handling, Data Sharing etc. It's ridiculous that we have 10,000 people obsessing over cookie banners while malicious hackers pilfer 100s of millions of peoples data because of a lack of political will to focus on cybersecurity.
On privacy legislation, my biggest gripe with the GDPR is it HAS DONE FUCK ALL for privacy. Apple has done more with the changes to iOS than the entire fucking EU with GDPR.
I am advocating for MORE effective legislation, not more INEFFECTIVE, burdensome, regressive regulation that enshrines the concentration of powers and makes innovation impossible.
1. Enlarge the definition of privacy legislation to cover EVERYTHING! Do you realize that EUROPEAN Intel agencies are not covered by the GDPR right now? While American Intel agencies are and Chinese Intel agencies are not even mentioned or challenged? How is that good for privacy when Huawei is essentially taking much of European market share while being run by a Govt enslaving a million Muslims in Xinjiang? 2. Make it less reliant on pure punitive measures and more an incentive+punitive set of objective measures to give companies the opportunity to innovate towards solutions. Right now, the stance by Europe has made only investing in lawyers the most appropriate choice. That or leave. No middle ground, no consultations, simply make villains of tech companies and that is the legacy of many regulators there. 3. Term limits on regulators. Limits and regulation on the people enforcing privacy legislation to ensure a balanced mind. Right now, go on Twitter and see the deranged rants of many of the people in these agencies who delight at the market share loss of Facebook or openly express glee whenever there is a bad press cycle outside of privacy for any of the companies they're supposed to be entrusted with passing judgements on. This is not a democracy. It's shameful. 4. Incentives that MINIMIZE liability for companies that meet objective standards that are reasonable. Right now, the approach is to hit them with the biggest stick you can find and hope and pray that it works out.
Many more, but along the same lines.
>I suspect that something about the GDPR must have bitten you quite badly
I've seen people simply struggle to achieve success that other parts of the world take for granted. This is TODAY . . in EUROPE of all places. You need to realize that bad political decisions are bad for everyone. I don't have skin in the game other than the feeling of watching someone drive off a cliff. So many people i speak to/interview/engage with from Europe who are young as SO very bright and talented and it's amazing to see how the very people they elected piss away time, resources and money on depleting the economy that these kids are going to grow up into for personal vendetta.
No one in their right mind will argue that the GDPR does a great job. It is very flawed legislation that will set the privacy movement back decades.
I know, right. I mean obviously the world's most famous royal family (our British one) isn't really a monarchy so that doesn't count. And they certainly don't get previews and vetos on our laws, or given hundreds of millions from the licence fees for offshore wind farms, or own a notable percentage of the land.
As for GDPR, compliance is pretty straightforward provided you aren't being shady to begin with.
And the new UK proposals are much worse and if they go through as they stand will be a nightmare for anyone serving UK visitors.
Your comment started by saying that the EU (as a negative) has not shaken off monarchy and ended with a contrast with the UK (a positive comparison). My point was that the UK (I am British) is even more steeped in monarchy/tradition so that can't be the cause.
Then I addressed your complaints in the middle paragraph about the GDPR by pointing out that compliance is reasonably simple for sites already having good behaviour.
And finally as you started with the EU and ended with the UK I pointed out that the new UK proposals are more onerous than the GDPR ones (thanks to the verification requirement).
You're free to disagree, and again I apologise for not being clear enough, but those were my points.
I don't think so; the UK passed the Data Protection Act 2018 just 4 years ago, to bring GDPR into UK law. That is: the DPA is normal statute legislation, unlike the GDPR itself, which is a bureaucrat-made regulation. The DPA was passed by both houses of Parliament.
So what are these mysterious moves to ignore the law? The only such moves I'm aware of are some plans to remove the European Court of Human Rights from UK law (ain't gonna happen - the ECHR is written into the Good Friday Agreement), and the UK's decision to ignore the decision of the ICJ concerning the Chagos Islands.
The simple fact is that if you allow unrestricted export of personal data from Europe to the USA, then European law can no longer control what use is made of that data, because the US courts won't enforce European restrictions. Are you advocating for Europeans to submit to the wild-west regime in the USA?
By the way, if you don't care to read my posts, you can always just not read them; they are all tagged with my handle at the top.
This is wrong.
The Data Protection Act did not bring the GDPR in to UK law, GDPR became part of UK law as soon as it was passed because it's an EU regulation, and regulations have direct effect in all member states (which at the time it was passed included the UK).
The GDPR then became "retained EU law" by virtue of Section 3 of the European Union (Withdrawal) Act 2018, and was then modified (turning it in to the UK GDPR) by the The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. These regulations also amended the Data Protection Act, fwiw.
Russia's attack on Ukraine has no relevance at all to whether the EU is or isn't politically stable.
There may be other reasons you can cite, in which case fair enough, but that example is a non-EU third party attacking a non-EU third party. And the EU is not at war with Russia.
And yes, unfortunately it can't be allowed to persist in its current shape.
But I wouldn't call many EU countries very stable either. It can still be a win to not send private data to the US though, tracking has become far too precise and omnipresent.
"EU startups don't have to "catch up"..." then don't get surprised when EU talent is poached by US and Asian HRs for x2-x3 rates. And before you're gonna talk about all those "free" (taxpayer funded) services and how no European would ever move to Asia or NA, i'd like to remind you that we're in the remote work world now :)
It's unethical IMO to send personal data to countries that have weak privacy laws without making it absolutely clear to the user. Which is rarely the case with GA right now.
I switched most my projects to shynet, for me personally that's more than enough information and I have zero worries about tracking and know that some users appreciate my approach.
Edit:// even before GDPR became a thing I worked with several companies who had strict rules about hosting in Europe or even more explicit not hosting in the US.
These laws also apply to US companies offering their services to in the EU. Frankly, it's about time American companies get reigned in on their privacy abuses. US startup culture has been playing fast and loose with people's data for far too long to disastrous effects.
Yes it doesn't solve the startup problem, but honestly there also also a ton of other laws and regulations outside of data protection which make it hard for startups to prosper. Web Analytics seems a relatively minor problem.
It is illegal to use it in such a way that results in Personal Data being siphoned to the US.
Is it hard? Yes. Outright illegal? Nah.
So this could also apply to any company that sends PII to the USA?
GDPR also applies to EU based companies for all of their activities - so in addition to limiting US business in the EU, it limits EU businesses in the US.
So I guess you need to assume this applies for all visitors.
I strongly disapprove of extraterritorial legislation (a US specialty). But in the case of the GDPR, if you want to regulate internet activity, then you more-or-less have to go extraterritorial.
Read these as individual clauses; the Regulation applies if any one of them is met. An Italian company serving customers anywhere in the world is covered by the first clause.
If a competitor can't produce a quality product that people will pay for, consumers aren't being harmed by the prevalence of a free good-enough product.
In a consumer-protection world where a free and open source Linux had 98% market share in the OS market, Microsoft or Apple would have no leg to stand on to sue its developers over anti-trust. In a competitor-protection world, they would.
The US views anti-trust through a very consumer-focused lens[1], the EU sometimes views it through a more competitor-focused one.
[1] This doesn't mean I agree with it, and there are obvious problems with trying to prove harm in a court of law, if no alternative exists.
If you can't beat the free offering, then go home.
In the real world of physical goods, there are laws against this. But Google's a tech company, so anything goes.
Which is exactly my point.
"[Dumping] occurs when manufacturers export a product... at a price below the normal price with an injuring effect. The objective of dumping is to increase market share in... by driving out competition and thereby create a monopoly situation"
https://en.wikipedia.org/wiki/Dumping_(pricing_policy)
That's exactly what's happening here.
Google prices Analytics at $0 to prevent any competition from starting up.
While an argument can be made that Google doesn't need to charge money for the product because that cost is made up in other areas, there is no way of knowing that, because those costs are not public. We don't know if it's fully made up by other means, or partially made up by other means, or not at all.
Like you, IANAL, but it's my understanding that legally, it's not about the price, it's about the intent.
It's not dumping because, in the absence of any competition, the price hasn't changed. It just turns out the market price for this service is $0.
I think you can show Google has monopoly on search and search data and GA is the only analytics allowed to connect with that.
Is it dumping? Yes. They don’t intend to raise the price, but they get paid not in cash but in terms of increasing their monopoly by having so much data on us.
Now a lot of things are like this (anything where you give your email for a discount code). But they are not intended to get a global monopoly or make it impossible for anyone else to do business competing with you.
Now these days it would be ridiculous if your device or operating system didn't come with a browser.
> They get paid not in cash but in terms of increasing their monopoly by having so much data on us
Yes, and anyone else can do the same.
We now have genuine browser competition. I think Safari and Firefox are just enough to say Chrome is not a monopoly. I write this on FF right now (running on Ubuntu) because it is a viable alternative.
This is the case for now, might be different in 2023.
"X is free" is not enough to be a problem on it's own.
You can't come to this conclusion until you prevent Google from using the acquired data to improve their ad service.
The market should just create a better solution or find investors to call the bluff of the offending company and make even more money
In the U.S. most antitrust law is based on protecting what's best for the consumer, not protecting the competition from a free alternative.
- A French Ned Flanders, probably
I think you’d have a very good case against Amazon, and probably Uber/Lyft, and I’ve long wondered why no one sued them over it. But in Google’s case, Analytics is profitable for the same reason Youtube is profitable—Google makes money off the data they gather.
But I don't think it's predatory. It clearly worked for cloudflare and seems to work for Tailscale (they openly said they're using the same strategy). It would be predatory if others couldn't match that, but I'd argue many competitors could offer free plans for small websites if they wanted to.
The alternative offerings at the time were fairly awful compared to what google released.
A rough “how many came” is useful. At least to diagnose if the site had problems. Just talk to people and make your thing good!
Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any processing that Google does after collection is not considered to offer any protection, because American law enforcement can just tell them not to do that and they won't. Hence, the "Anonymize IP Address" setting in Google Analytics is not considered to have value for GA.
It might theoretically be possible to use GA compliantly by proxying data through an EU-owned service which obfuscates anything considered personal data, at minimum the IP address and various cookie values. This scenario hasn't been confirmed by anyone as compliant, but the regulators seem to always go out of their way to dance around it rather than just saying "GA is non-compliant, always, forever." Still, for the trouble to set up such a service you might as well just stand up a self-hosted first-party analytics solution.
This particular decision on GA is purely about the cross-border transfers, and doesn't seem to touch on whether using cookies for analytics requires consent. That's a separate issue (technically about a separate law).
This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.
Huge swathes of Google's architecture (especially its legacy architecture) have deeply-ingrained location-agnosticism assumptions. It turns out to be extremely complex and expensive to remove those assumptions given the way Google handles data once it hits their datacenter fabric.
(Not impossible, mind, just that this assertion that it wouldn't be that hard to do is in "I could build Twitter in a weekend" territory).
My prediction is that as things move forward, they're going to find it isn't worth their money to offer Analytics for European customers if the GDPR continues to make that more onerous (especially since the monetization story of Analytics for Google is so threadbare) and just offer it for customers in other countries while Europe does its own thing. Win-win.
its real name should have been privacy hole
The CLOUD Act expressly brings data stored by US-based companies anywhere in the world under the purview of US warrants and subpoenas.
"The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil."
Calling it spying is a little far-fetched I think, when the problem was the transfer ip addresses to US servers, not Analytics itself.
A company doing business with other companies might find themselves in a position where they can comply perfectly. Not every company needs to collect PII, though these days every company likes to pretend they do.
This seems to ban third-party analytics by any US company. The cynic in me feels this is a little convenient in how it advantages EU organizations over foreign ones...
“The Italian SA reiterated that an IP address is a personal data”
[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...
Collecting most if not all analytics is forbidden, for sure, but analytics and metrics aren't inherently required for businesses.
And as a European, I'm very glad that's the case. I know, we're still not close to compliance with GDPR, but it has changed the privacy discussion more than any other part.
How is that something that is essential to providing a service?
I suppose that it's somehow "commercially advantageous", but there are many other commercially advantageous techniques that are simply illegal - such as taking a customer's money, but supplying zero in exchange.
A company's profit needs are not an end-run around consumer protection laws (which is what GDPR amounts to).
Personal data, not PII. The GDPR does not care about PII (except to the extent that the set of things that are PII is a subset of things that are personal data).
Can someone comment if the Italian language text is clearer? Or ehat is in the judgement?
Data flowing to the US violates that, assuming Google US cannot refuse US gov requests, the headquarter having access to the data is also not accepted.
The law was absolutely useless because 99% of the websites have an illegal implementation and still added a major annoyance in the form of the popup / banner.
We don't have the same culture as Americans.
Don't get me wrong, you had a pretty bad deal as well: without much fanfare, your government grew up so much in the last 200 years that it became the largest employer in the world. You pay loads of taxes (even more than several EU countries) and get very little benefits.
And yet, I'm sure that if we will get to a political solution to the ever-growing cancers that governments are, that solution is more likely to appear in the states than in Europe.
Europe is a hopeless - albeit beautiful - land. The people gave up change 50 years ago.
Agree though that Europeans could do with more libertarianism and less trust in state; it's something that's been a big issue for me since at least CoVid hysteria.
As opposed to those who used to do whatever the private companies tell them?
Instead, the companies took their masks off and decided to beat us over the head with illegal consent popups to trick us into believing that a damaged user experience is the only possible outcome of the GDPR.
Sounds like a browser plugin would be best for this, then all links across the web could show it. Or you could just block it in uBO and not think about it again.
It's so much better! I can just use SQL to see what's going in and not get overwhelmed with 100's of visualizations and complicated dashboards.
To give people an option and pink something else over Google Analytics, I have built an alternative, Simple Analytics [2].
It doesn’t use cookies or any form of tracking and you get still the useful data that 80% of the website owners need.
[1] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch)
[1] https://docs.simpleanalytics.com/explained/unique-visits
On your general point, we're way past the point where a company is allowed to blindly use any random SaaS without caring about what it does with the data or where it goes. The pendulum is clearly swinging back.
I wonder how much of a difference this makes, if the DCs still belong to these american companies and this thing exists: https://en.wikipedia.org/wiki/CLOUD_Act
https://cloud.google.com/blog/products/compliance/how-google...
From memory, gov entities also have deeper customizations, and data centers might be separate from customers and the standard Google operation altogether.
What if I use a cdn that has points of presence in Italy and still pings my server with a head request and the end user ip?
Am I also now breaking Italian law by using google analytics?
> After introduction of the GDPR in EEA it became common practice for websites located outside EEA to serve HTTP 451 errors to EEA visitors instead of trying to comply with this new privacy law. For instance, many regional U.S. news sites no longer serve web browsers from the EU.
As the article specifically states:
The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. This information was found to be transferred to the USA. In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.
So, unless you are collecting EU citizens user data, transferring it to US and have the capabilities to enrich such data through additional information you hold, no.
So, if you have a personal blog that grabs IPs? Not illegal. If you start a merch shop for your blog (or put in ads/sponsored content, etc.), then the whole site needs to be GDPR compliant.
And you do business in the EU. If you have a merch shop, but don't serve EU users (no EU shipping, not accepting EUR as a currency, no EU specific languages (German, French...), ...) there is no problem.
If I run an export business from my own country, the only law I need to comply with are the export laws of my own country. It's the duty of whoever is buying it on the other end to make sure they are allowed to import and possess the goods.
The EU does not own the right to use languages. I can use German if I choose without ceeding an inch of soverignty to the EU.
The EU does not control what data I collect when running my website. I might be required by my home jurisdiction to collect details on controlled export goods, and I might be required not to tell the user.
The EU controls the Euro currency, but they cannot make it illegal to me to use it, or attach special conditions to its use. They could convince my own government to sanction me, or aid them in sanctioning me, but that would be my own government affecting me, not the EU.
Your countries laws stop at its borders. Stop trying to control other people who have no say or vote in the laws. It's anti-democratic.
Will ISPs be forced to cut off traffic from certain areas? Will centralized companies like Google and Reddit be forced to comply with regulations or cut off services in certain areas? Will governments set up firewalls? Will the buck of responsibility be passed upwards to service providers like GA, or downwards to individual site administrators?
Once the Europeans have to use a foreign proxy to see the regular internet, like the Chinese, then we will have a real discussion on online privacy.
> A website using Google Analytics (GA) without the safeguards set out in the EU GDPR violates data protection law because it transfers users’ data to the USA, which is a country without an adequate level of data protection.
> Upon expiry of the 90-day deadline set out in its decision, the Italian SA will check that the data transfers at issue are compliant with the EU GDPR, including by way of ad-hoc inspections.
This follows similar decisions by France [1] and Austria [2].
[1] https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo...
[2] https://iapp.org/news/a/far-reaching-implications-anticipate...
2018-202?: Data privacy
I wonder what the next trendy thing government officials will pretend to care about/fix in order to garner media attention. Something crypto related, maybe?
That gives you an indication of how invasive it is — that even Google doesn't want to handle the personal information, because it can't be made HIPAA-safe.
Naturally, the majority of healthcare web sites use Google Analytics, because nobody ever reads the Terms of Service.
You're missing a key part of the sentence you're remembering:
> If you are (or become) a Covered Entity or Business Associate under HIPAA, you may not use Google Analytics for any purpose or in any manner involving Protected Health Information unless you have received prior written consent to such use from Google.
Healthcare companies can absolutely use GA on their websites as long as the website isn't involving PHI or ePHI.
They can host locally the data and remotely query it.
What's important is the "intelligence" the data does provide: giving critical and unfair advantage for those who have the whole data.
For instance, microsoft has an unfair advantage almost anywhere because they have access to the whole linkedin database.
Previously, the EU exempted the USA through an "adequacy decision". That was later deemed illegal under EU law as American laws could not guarantee the privacy of EU citizens to the extend the GDPR prescribes. Then the EU tried again, and again such a decision was also overturned in court. The EU is working on another attempt at letting the USA track PII of EU users, but until they do that again (probably for another few years) it's illegal to share PII with American companies in almost all situations.
This is the third time a data processing agency has declared the use of Google Analytics illegal so it shouldn't really come as a surprise to those following tech news.
What's important is that the data is PII and that it's going to a place that can't guarantee privacy to an acceptable standard. Business advantage is irrelevant. The intelligence the data provides is also irrelevant. European privacy laws serve people, not businesses.
Additionaly, denying remote access is almost impossible to enforce. It would require a efficient and permanent deep monitoring of their servers.
linkedin should be illegal since this data should not be privately own.
That scenario has always been an option, and would be the most common case if Google didn't provide their own service for free or at cost. What's happening with the EU feels disruptive only because Google had such an unatural position in the market.
As long as they haven't died ...
in that case how can they ban anything and what does that mean?
The Italian SA is the Italian Data Protection Agency (DPA), one of the per-country European regulators https://ec.europa.eu/justice/article-29/structure/data-prote... . Which acts under the GDPR and predecessor data protection laws, and is very explicitly a governmental regulator.
For example:
https://www.theguardian.com/technology/2022/may/05/uk-watchd...
To those companies and people who find these EU decisions baffling or inconvenient: tough. If you had had respect for your users this would not be an issue. You would already not be spying on them.
To website visitors: if you see a cookie banner, the site is asking permission to spy on you. If that concerns you, close the tab.
“I don’t generally like unions. I’ve worked at both union and non-union plants. But anytime someone else complains about unions, I remind them that if they have a union at their plant, they earned it.“
There was a recent ACM article on this. They found there was a large number of sites that don't actually ask permission for anything, they are simply informing you of the spying. Not surprisingly, the ones that did allow modifying cookies were all setup in a predatory fashion which discouraged the disabling of tracking.
The whole system is broke at the moment.
If they were required to use specific wording, like for instance “injecting surveillance artefacts” people would probably care a bit more.
Nice idea in theory, but if it's too frequent the awareness will, at some point, just disappear.
Not surprisingly, the most effective banner they found was the one which had a single "disable all cookies" button. It was something like an 80% hit rate. So, people care, but not enough to dig into another prompt to uncheck a bunch of boxes. This is what the ACM writers referred to as predatory (abusing human nature).
Basically, what class of badness are Americans subjected to due to behind-the-times data protection laws, that Europeans are protected from?
The whole thing has always seemed overblown to me. Websites make much more money off targeted ads, allowing them to do things like allow anyone to upload a video of any length and quality for free. And view other videos people upload. In most cases it seemed to me like a fair trade to make. Yet as people point out all the time, technically a website isn't allowed to deny access to someone who refuses targeted ads (through the cookie pop-up), so they're essentially being forced to provide that user content at a loss. Untargeted ads are often worth 90% less or more than their targeted equivalent.
Privacy privacy privacy though, as if someone at Google is manually looking through your history laughing at you.
Part of the problem is that it seems more or less impossible to get large companies to keep their data secure. In fact Google stands out as maybe the only big tech company that has not been involved in a major breach.
Notwithstanding the legal and political issues that arise when (not if, but when) this data gets into the hands of law enforcement agencies.
And yes, there have been individual instances of employees misusing sensitive user data.
Privacy is security.
Generally I agree that content providers should be allowed to make money somehow, but this way has proven to be untenable and something needs to change.
More bluntly, you’ve decided that consumer-surveillance-as-a-service is harmless. I’m thankful that the European regulatory apparatus disagrees. Now if only we could remind the American federal government why regulation is a worthwhile effort.
The EU with the GDPR made an incentive to not use trackers, dont want that ugly tracker on your site ? Then stop selling data, that's why private analytics like Plausible and Umami have sprung to life. And also made it clear how much tracking is on the web.
There is also finally a movement to let the US host everything because really, the US isn't trust worthy.
So, the EU laws, gave better awareness about tracking, gave incentives to not use trackers, and is now working on improving the user experience by stopping the monopolization of social interactions.
BUT to answer the question directly, credit checks to the level they are performed in the USA sound like a horrifying thing and a total privacy breach for us EU citizens.
Or you know...count how many unique visitors they have and how to make the site more useful. Do you avoid using cookies on this site but still manage to log in?
how do track unique visitors without cookies, and how is that way less "disrespecting" of user privacy than a cookie?
I wrote "disrespecting" because using GA is exactly this for me. Website owners give a f** about your user privacy just to save them some work, without caring about any of your users' data.
[1]: https://goaccess.io
Isn't there an exception for authentication in the consent requirement, but not in the inform requirement?
Have I got news for you. Specifically at least 100 years of news.
> Yes I also do understand that the EU in general view privacy from the government as illegal rather then a right.
That is absolutely not true, at least not by enough people for anyone to be able to make that sort of blanket statement. I'd also wonder what reasons you have for thinking that, it seems to me like all of the 5-eyes used each other to spy on themselves (besides all of the things done by normal police, various levels of federal police, etc.)
https://appleinsider.com/articles/22/05/11/eu-plans-to-requi...
Can you point me to the part of the ban that says it's about protecting users from "spying in general" and not "protecting users from spying by US companies instead of EU companies that EU member states can obtain PII from at any time"?
I want to quantify this quote. Each EU country can spy on its citizens to similar extent as 3 letter agencies from the US, but in a less analytical/big meta data way (part of it being the US brain draining EU countries for those working in tech).
However, if EU country A wants to have access to its citizens user date on website X located in EU country B, is not an easy process; involving a strict judicial system between those countries.
Not spying ⇒ not using GA ⇒ this ruling moot.
I'd love to see how often people do anything besides click okay anyway (I'd be very surprised if it wasn't 99%+).
But they are probably fingerprinting my phone anyway through other means.
The US isn't "behind" it simply has no intention of moving in that direction, despite the 4th amendment making it really clear they're not allowed:
>The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
An open-source and privacy-friendly alternative to Google Analytics & Google Tag Manager :)
GA is simply not compliant...
there are a number of other office suites that are entirely adequate for bureaucratic organizations to build methodical processes around (which is what bureaucracies do). the capabilities of the underlying tools don’t matter much in this regard.
also, audits aren’t meant to prove anything (like security), but instead to shift liability.
GP never says that you’re naive, but the comment was.
This is, at best, a stretch.
https://www.statista.com/statistics/1233538/average-number-s...
I would love to see you replace all 100 of those with open source software.
Have you ever dealt with large technology migrations?
i'm not suggesting that governments can only use internally developed or open-source software, i'm saying corporate interests should be firewalled away from goverment. so a locally-installed office suite incorporating no surveillance tech doesn't have the ancillary corporate interests attached to qualify it for being firewalled.
Yes, I speak from experience, migrations and modernizations are kind of my job.
I can’t think of the name of the company now. But there is one company that manage the school lunch programs. Who is going to write the software and you have to replace all of the hardware throughout the state.
And they'll require renegotiation or hardware upgrades at some point, so use that as leverage to say no government entities will buy any more unless they meet certain rules about open sourcing and data storage.
But really, if a handful of things like that were the only examples that would be wonderful.
The beginning is any SaaS that started being used in the last 2-3 years. The immediate solution might just be going back to what they had before, if the top priority is privacy.
As far as open source, the existing companies could often be contracted, but if they don't want to open up then the government can put out bids or build a team. If entire countries want to buy something, they can make a market. And that's assuming there isn't already open source software that can do the job, because there often will be.
Now on the other hand, return offers for interns at my BigTech company is around $150K. The average salary for the superintendent of schools for larger cities is $167K. Where is the government going to get the money to compete with the private sector?
Or it can offer tens of millions of dollars for some software and see who bids.
Especially when the previous provider would probably like to get more money selling something to the government, even if they have to make changes.
The above poster was willing to pay "1% GDP" for the initial migration and for the US 200 billion dollars would pay for a lot of development work.
Do you really think the government has the competence to create software? How many decades has the US government been trying to modernize the IRS? Do you remember the original ACA website rollout?
Not only do you have to hire developers, you have to hire project managers, retrain employers, etc.
Are you going to also create data centers to create what’s available in the public cloud? You need to make those redundant across regions, are you going to force open sourcing of control plane software?
I think the main idea was to remove third party data storage? With some open source? You can contract both of those out, and when it's open source the company doesn't have the same kind of leverage.
> Do you really think the government has the competence to create software?
It's not like companies are usually good at it either, so shrug.
> Are you going to also create data centers to create what’s available in the public cloud? You need to make those redundant across regions, are you going to force open sourcing of control plane software?
At that scale, datacenters are cheaper than cloud hardware. As for making the cloud software, well, billions of dollars can buy a lot. Force shouldn't be necessary.
Google, Apple, Microsoft, SalesForce, Oracle, are not good at creating software?
Let’s say the government wanted to “leverage” open source, do you think they could make a better version of ChromeOS than Google?
You also just think throwing money at a problem can automatically create software that is better than private corporations?
The original poster said:
i’d support any legislation that booted google, fb, ms, adobe, salesforce, and a whole host of other surveillance tech companies from any and all levels of government. it’s literally as important as the separation of church and state. in fact, i’d love to see a constitutional amendment explicitly separating corporate interests from governmental ones, in all facets of civic life (e.g., campaign finance).
They don’t want any private company involved in government IT. That means the government has to build everything out themselves without using contractors.
Doesn't Netflix only run their metadata servers in the cloud? I'm not sure what those other two do.
> Google, Apple, Microsoft, SalesForce, Oracle, are not good at creating software?
Did I imply that?
Though we could debate Oracle...
> You also just think throwing money at a problem can automatically create software that is better than private corporations?
I never said better. But "good enough", in avoidance of horrible privacy violations, is a choice I'd approve of.
And open source software usually does quite well when given moderate funding.
> They don’t want any private company involved in government IT.
My interpretation is that if you get rid of the surveillance you solve the main problem, as far as outsourcing goes. If that's wrong then some of what I suggested isn't compatible.
I’m not trying to “appeal to authority”. But since we are taking specifically about AWS, I should disclaim that I work at AWS in the consulting department. That’s where my perspective about large scale migrations come from. I’m not necessarily saying everyone “should move to the cloud”. I’m more referring to how deeply ingrained the commercial sector has always been involved with government.
An ad hominem means using an insult as the basis for rejecting an argument, e.g. 'that is wrong because you are [attack]'. Saying an argument is naive and then explaining why is not an ad hominem.
if it had been starter, engine, and transmission, maybe you’d have a point, but instead it’s corroded battery, door handle, and tailpipe.
"You're European, so your argument is biased and wrong" is an ad hominem. "Your argument is naive, here's why I think that" is not. The latter is logically downstream of the argument, while the former is upstream.
see how those three sentences go together? that's a line of reasoning. the subject comment doesn't have that throughline. it's disjointed; the parts are only tangentially connected.
What on earth do you mean by "literal" here? Ad hominem refers to a specific fallacious style of argumentation. Being ignorant of the definition and then too stubborn to admit it is not pushing back against "overliteralism".
Especially because the rest of your comment (dismissing the rest of the argument due to "ad hominem") only makes sense if one assumes the correct definition!
Are they though? Do you know this for a fact? I mean, sure, MS Office is very popular in government settings, but does this really go beyond the possibility of just replacing it with LibreOffice if they so decided?
https://www.youtube.com/watch?v=xbQFTkFaYlo
or Box/DropBox/other cloud storage services, which is less convenient than proper collaborative in-pace editing, but you can still get the file at the link, edit it and upload it.
You've just identified one very good reason that they shouldn't be dependent on a single, proprietary vendor.
Really, I was surprised to find your original comment on Hacker News, especially with you ironically fronting it with calling other people naive.
[1]: https://larlesienne.info/2022/02/22/la-municipalite-de-carol...
In fact, I bet you that a major part of the delays in Government are because Tom from IT needs a sign off from three separate people to get a new Office 365 license for Brenda in accounting.
With Libre Office you make that a thing of the past.
Depends. When odf would be the standard maybe, but it isn't. Standard is microsoft office, and libre office is not 100% compatible. But you will still have to deal with lots of microsoft documents, from all the other agencies, ordinary people, companies, ..
Meaning, when Munichs government tried to switch to oss a few years ago, they did indeed lost a lot of time with broken documents, templates, layouts etc. so they ultimately switched back (direct microsoft lobbying with even Bill Gates getting personally involved might have played a role, too).
So I am all for an open standard, but this easier said, than done.
Then change it. By law if need be, and have all government departments go over to Libre Office at the same time.
Microsoft then tried to get their format ratified as an ISO standard. But everyone complained that their spec did not actually specify how to implement, instead it said things like "In accordance with output from Word 2007". So after a bit of back and forth MS realized that they did not want to _actually_ document what they were doing. The solution? Pack the committee with MS shills to vote yes on every proposal by MS. Urgh.
One of the negative flow on effects was that these new committee members only cared about voting for things that MS had instructed them to vote on - so other standards and issues stalled due to a lack of a quorum. It was super disappointing looking at this from the sidelines at the time.
Here is a link that explains a small part of the history: https://www.infoworld.com/article/2618153/how-microsoft-was-...
I would have defined Libre Office as the reference implementation. Other software is allowed to the extent it reads/writes those files formats correctly.
I would also have mandated open source.
What I have had more incompatibility issues with is Gsuite (or whatever Google is calling it these days) which a LOT of medium sized businesses and school are using now as an office alternative.
That's unlikely, and if so I doubt Libre Office would liberate Brenda. It may be the reverse. On-boarding or moving Brenda between functions would mean provisioning her for internal ID, identity, email/communication, security, network/group access and permissioning, physical device(s), etc. Various parts of Microsoft 365 would just be part of the checklist and deployment, an integral part.
Microsoft make the above very smooth. I don't think someone slapping Libre Office on a PC makes any of that a thing of the past. Any realistic alternative needs to be all the way down the stack.
Also, nature loves a bit of redundancy. And capitalism loves competition. You can't have competition under a monopoly.
And the govt. is the biggest monopoly of all.
Somehow, restrictions against US firms are praised but if US imposes restrictions that is condemned (e.g. TikTok).
By whom?
> if US imposes restrictions that is condemned (e.g. TikTok).
By whom?
I didn't say shut down the megacorps. Maybe they have use; I don't know. What I do know is they're unaccountable (like the shit bits of government).
If government had to use open systems, the quality of those open systems would improve and compete better with the similar commercial ones. The public (and companies and other countries) then have a choice between the tools from the megacorps and the open tools. The public also gains/improves a resource. More competition. Probably better for everyone.
I refuse to use the NHS here in the UK because of the widespread use of Microsoft everywhere.
terrible and more expensive is also a joke, but not as big, you still could got to ibm or oracle if you want to pay more for less, admitted
I disagree. It would be relatively straightforward to build such systems on Linux and open source.
> and more expensive to the tax payer
As a proportion of Italy's GDP, the cost would be negligible, especially given that this is a matter of national security, something governments tend to be keen to spend money on.
After how many failed rewrites that never deliver a working product?
The other undertone I'm getting from this thread is that people think America has a monopoly on building software, and that's simply not the case. It's not hard to find companies doing really good work outside of the US. There is also nothing special about Office 365, it doesn't have a technology moat, it just has a surmountable interoperability moat and a social moat.
Can the government purchase a car? Hire a private corporation to build a road? Hire a consulting company to check the security of their (now-free-and-without-a-support-contract FOSS?) computer setup?
The same applies to websites. If a government website uses Google analytics, it is essentially requiring you to do business with a specific company (in this case Google) in order to use a government service.
Of course some citizens are living over seas so we can provide a satellite uplink for them.
The gov. is using some service and therefore some citizen data is subject to the T&C's and that's it.
If Google were a German or UK company it would be the same thing - everyone subject to those T&C's.
But government can impose requirements, like TAA compliance (1) and SHB requirements (2) on its service vendors, forcing those vendors to purchase from a fairly constrained number of hardware providers.
https://www.dtra.mil/Portals/61/Documents/Business%20Docs/ev...
https://www.afcea.org/site/sites/default/files/files/2-ColLi...
If you open the door to a govt office, are you doing business with the company who installed the doors? If you use the toilet, are you doing business with the company that janitorial services are contracted out to?
When you visit a site with Google Analytics, they still have your data after you leave.
If those are sacrosanct, the choice of tools vendor matters far less.
I don't think you comprehend the scope of what you're suggesting.
I work for a school district and I'm currently migrating our system from using one commercial bus routing service to another... using Windows, SQL Server, Teams, etc. from Microsoft... using a laptop, dock, three monitors, keyboard, and mouse from HP... and today the elevator was broken so we called a repair company to come fix it... oh, and some company makes the school buses, and the networked phone on my desk, and the printer around the corner, and all of the paper in it... the fluorescent bulbs above me don't grow on trees...
you can't just expect governments, even at the national level, to roll their own everything without interfacing with corporations in any way—this is a hopelessly naïve view of the world. I am just as uncomfortable as you are with data being shared with corporations, but you're going to have to figure out a more realistic set of political goals than what you've outlined here.
but even if you just mean to say "government should not share citizens' data with corporations", well, there are presently two (until our license with one is up at the end of summer) separate corporations that both know where every kid in my school district lives, what their special ed needs are, what their parents names are, what their parents' contact information is, if they live between multiple households, and so forth, because that is the explicit purchase of their business, and that why we purchased their software. the same goes for another piece of SaaS we recently purchased a license to involving food service management for the school system. when designing the data export we opted to not follow the part of the schema that wants SSNs for the students (because why would they need that?!), but that might not be the case for other districts using the same software.
my point is there are a lot more interconnected corporate software services sharing citizen data at play in contemporary government systems than you probably think, and, once again, even though I agree with your position with regards to sharing citizen data with corporations... I think that ship might've pretty much sailed sometime in the past few decades.
but yes, i'm explicitly against governments sharing private data with corporations, no matter how convenient it might seem to be for workers. governments have run for centuries without those conveniences, so it's not a dichotomous choice of share all the data or not have schools (for instance). a lot of data sharing is driven by the misguided desire to control (that is, to centralize power), whether it be teachers, students, or administrators, not for actual educational outcomes, despite the latter being the nominal impetus.
I have yet to see this occur. instead, it's all about bureaucratic convenience. why hire more people for Student Transportation to keep bus routes straight, and deal with printing out & distributing paper passenger lists to bus drivers, etc. etc., when you could use a piece of software to handle it all for you? nobody at the bureaucratic levels we're talking about here care about hoarding personal information for power or centralization or anything like that, it's purely for convenience and streamlining of bureaucracy.
one might say, ok, sure, but why does it have to be a third-party SaaS that you're SFTPing data back and forth with, why can't it just be a traditional piece of software that you install and manage locally? again: convenience, for all involved. that's one less thing for our sysadmins to worry about dealing with, and when you get enough of these things then you'll need to hire and retain more sysadmins (who we're frequently cycling through as is due to failure to compete with corporate salaries). the software developers of the third-party bus routing software don't have to worry about platform compatibility if the platform they're targeting is the web. parents can easily log into the website to see their child's bus routes and if they're delayed or whatever (apparently this is a real thing real parents demand...). but also, hey, we're already using Office 365, so "what's a few more SaaS solutions to problems we have, at this point?"
what I'm getting at here is the rise of SaaS and the fall of self-hosted solutions to things like this is pervasive everywhere in the corporate world, so if you don't want your tax money "wasted" on even keeping school district student data in-house and secure, this is the world we have to live with now. I'm not saying it doesn't suck ass, another piece of software we replaced is all web-based (albeit locally-hosted) and strictly inferior to the end-of-life Java-based software it is replacing. software kinda just keeps getting worse, and the further stratification of everything into SaaS is definitely not good in the long run. but... that's the current state of things everywhere, so why should government be any different?
if this bothers you about public schooling in particular, then the solution (which I'll likely be doing, but not for this reason) is homeschooling your kids. then their data is only stored in the district database and only transmitted to and from the state and local governments, for reporting purposes.
but more broadly speaking, what's the use in calling out governments transmitting personal information to corporations when corporations are already taking so much of your data themselves? I bought my fiancée a hat with a soda logo on it last week and she was getting ads for that specific soda the next day. how it happened, I have no idea. shortly after I moved back to my hometown, I picked up some groceries for my mom using her credit card, including a can of Red Bull I got for myself, the first I'd had in months. later that day, ad for Red Bull on my social feeds, first I'd seen... in months. whenever I buy booze, I get (different) booze ads on Twitter for days—when I don't buy any booze for awhile, the ads stop.
there's already so much personal information being trafficked between corporations everywhere without our consent, what makes the government sending it to corporations for legitimate purposes so specifically offensive? maybe I'm being too cynical but it seems like the genie's just kind of out of the bottle now for personal data in general. TFA is sticking a finger in one of many finger-sized holes in the hull of a ship which is sinking mostly not due to the finger-sized holes but to the person-sized ones that we're just kinda ignoring.
homeschooling might fix the short term, but it helps no one else and probably not your kids' long term. speaking up, debating alternative solutions, supporting better legislation, even making your own job harder will help you and all your neighbors in the long run. we each need to call out governments and corporations for their misdeeds, all the time, whenever we see it. being a citizen is a responsibility, not a right.
(also, i don't see ads and don't give data willingly to the likes of google)
How is that possible, since corporations are, by definition, creations of government through law?
But it’s not that simple. What harms the public? Many would argue being able to use data google collects (legally through subpoenas or grey-legally through any of the number reports that have come out since Snowden) helps government agencies by increasing public security—thus the opposite of harm. Being
I get why google et al want it for their growth/sales, but they are a private entity not owning internet in any way, extremely foreign to Europe with no clear friendly intentions. One of few times I can say I am proud to be living on old continent.
living in europe doesn't much matter, given the reach of these companies and their interweaving into government systems, along with reciprocal surveillance agreements (however-many-eyes countries).
If government can literally fine/shutdown your business arbitrarily (as they do for lockdowns, permits, etc.), then they should have a voice in the government that could treat them so terribly.
Unless you mean to say that government should be so much smaller that it doesn't impose separate business taxes, import/export controls, require permitting and licensing and follow arbitrary regulations on those businesses, which I could get behind. Ideally, if there's no advantage or penalty to avoid by petitioning government, won't everyone stop paying attention to government? No gaming the game can happen then!
The problem is that we can't have it both ways, can't restrict a group from petitioning and then pose rules they MUST follow, without a say. That's not democracy at all.
Companies are just groups of individuals after all, and should have just as much voice as an activist group does, like ACLU or Americans for Tax Reform or whatever.
If you’re Italian, you do have a say, and if you’re doing international business in Italy then you accept the sovereign risk of dealing with a foreign state.
GDPR and these other regulations in the EU exist because EU cannot stomach the fact that they got beat on tech and instead of innovating they are regulating to try and even the playing field.
What tech is the EU missing out on?
All the recent "tech" I see from the US is all about novel ways to screw & exploit people for profit, at the expense of turning society into a dangerous wasteland full of outrage and saturated by advertising.
No thanks.
It may not be your intent, but defaults matter and what you're wishing for here is de-facto scuttling of the GDPR.
False premise.
Users simply aren't aware, but once they learn about it, they become concerned,
> If that's the case, isn't the regulation somewhat against the spirit of democracy?
That's a really weird argument.
Anyway, that's not the case.
You can't make exceptions based on what's convenient for some business.
Why should GDPR be opt-in but not the consumer minimum 2-year guarantee against faulty products?
> ? I don't see any valid reason a user might want to "opt out" of anti-fraud legislation
To commit frauds, for example?
I also believe that should be opt-in.
> To commit frauds, for example?
Fraud implies an unwilling party, a victim. Not comparable at all to what I'm suggesting.
But that is irrelevant, we European citizens are happy to have it.
And actually fought to have it.
It's a consumer protection law, what you want is consumers with less or no protections.
> Fraud implies an unwilling party, a victim. Not comparable at all to what I'm suggesting.
I'm quite sure the majority of users visiting a website that hosts GA are giving away their data unwillingly.
Would you opt-in theft too?
Yes, indeed. I don't believe the government should mandate specific protections consumers should receive, because it just serves to reduce consumer options. And this is also why I wish GDPR would have been opt in, giving more options to consumers.
For example, in a world with no government mandated "2 year warranty", some manufacturers would offer a product with "2 year warranty" and some other manufacturers would offer the same product "without warranty", but at a lower price.
Consumers would then be free to chose if they want to pay the cheaper price without warranty or the higher price with the warranty. There are two options for consumers in this world whereas in the world with mandated warranty, only the "higher price with warranty" option is available.
It's the same with GDPR, GDPR compliance has a cost. Some websites have started banning EU IPs for that reason.
Of course, the above assumes that consumers are not mislead and that transactions are voluntary. Therefore, I do think there should be laws against fraud, theft, misrepresentation, etc.
What you believe or not it's completely irrelevant.
In my Country consumer protection is in the Constitution, at article 41. [1]
So the government is duty bound to protect the consumers.
Thanks God I was born here and not in olalonde-land.
[1] Art. 41
Private economic enterprise is free. It may not be carried out against the common good or in a way that may harm public security, liberty, or human dignity.
The law determines appropriate planning and controls so that public and private economic activities may be directed and coordinated towards social ends.
> "some manufacturers would offer a product with "2 year warranty"
Or, realistically, all the manufacturers would offer zero days warranty and only luxury brands would offer life-long warranty to people who can afford their products (e.g. less than 1% of the population).
Example: Apple, which is not exactly a cheap brand, only offers one year warranty in the US, while it's 2 years mandated by the law in EU.
iPhone 13 Pro USA price: 999$
iPhone 13 Pro Italy price: 1250$
PS: In the US, you could probably get that extra year of warranty from Apple or from a third party (for like 20$). But you don't have to.
which anyone understands that is not the same thing.
You can also buy 2 of the same items for redundancy, I wouldn't call it "warranty" though.
> iPhone 13 Pro USA price: 999$
> iPhone 13 Pro Italy price: 1250$
The price on Apple's U.S. online store website is before taxes
But anyway that's a completely meaningless comparison:
Parmigiano Reggiano in Italy Euro ~10 / Kg
Parmigiano Reggiano in USA $ ~20 / pound AKA $ 44.4 / Kg
I don't.
On the contrary, I believe they should thank us for encouraging them to make better and more durable products.
If I am spending 12 hundred euros on an electronic device, the least the manufacturer can do is give me the warranty that it won't break on its own before 2 years of usage.
Anyway, Xiaomi makes perfectly valid products at 1/3 of Apple prices.
Maybe it's not the 2-year warranty the issue here...
A parallel anonymous-and-free-for-all-but-with-payments-included, smth. like Tor-but-powered-by-IPFSv9-and-Etherv7, will probably emerge in a couple decades done right after a couple failed iterations. Some techs need hardware to catch up to be cheap enough, and only after a few failed attempts they manage to grow a trend... and it will probably will last until it's used to finance a proper starting of WW3 and by then banning it will be too late.
Anyway, we'll enjoy the hell out of ourselves on the new patreons-but-for-snuff-p03n, so it will all have been worth it :)
And that once such tech becomes usable by a large percent of the general population (by eg. allowing "unsecure" websites to "do anything") and we make the mistake to add a truly functional and anonymous money transfer technology to this layer of information tech, we're royally screwed as a species.
I obviously don't want a lawless and free for all regular/default internet because on the regular internet we exchange real money and we have real identities. I'm perfectly OK with having lawless layer of information exchange and broadcasting (it's just a natural generalization and globalization of "free speech" and I think it's crucial for humanity) and even working to making them usable by the general population, as long as we don't allow any serious kind of money transfer and commerce to happen through them. Eg. A psycho posting a killing video once a decade is no biggie and would happen anyway, let's at least enjoy it / groups of psycho creating a market and industry for their "products", not ok. Two random guys planning to meet to exchange some guns for some money is no biggie and already happens anyway; trading weapons on scales to supply real wars not ok. Etc.
De-facto "having sites op-out of anti-fraud legislation" or of "human rights" protections is already happening, and is less obvious because of the centralized nature of our current internet. A less centralized internet will just allow it to happen in the open in theory. Only it won't because since they're already doing other more serious illegal stuff and don't want to draw attention.
PP's "Bizarre idea. Should websites be allowed" thinking was just funny and ridiculous at the same time: there's nothing bizzare, thing are already happening (naturally) like this, and ofc it's happening discretely (eg. having telegram or other messaging app groups instead of http websites but performing similar functions etc etc) and in the silence bc ppl doing them do even more illegal stuff and nobody wants attention from authority or ppl concerned with morality ...and I couldn't help make fun of it a bit. It's the kind of guys that argue against free speech and yell the "but think of the kids" argument at us all the time, and it's tiresome to have to trick them all the time since reasoning with them doesn't work...
So suggesting that maybe we should bring what's already happening anyway in the open, base it on more open standards technology, have it be indexable by search engines etc. :P I'd rather have a legal:any flag that I can add to a google search when I want to go off the beaten track then to have to switch the program/protocol I'm using (and the browser should make sure as hell I don't leak my identity and don't pay for anything on such unsafe sites), and that's the crux of it, the browser would know that a site is unsafe and needs total sandboxing simply because the site owner has decide to "opt out of the laws" - you realize that longer term when s settles down it's a win win situation for everyone if you just twist your mind out of the default narrative the current tech-corporate establishment is brainwashing you with...
(Or the "let's make a decentralized and truly free internet layer" into a real and usable thing... or the crypto-crimies will beat us to it and do a version that also has payments, generates obvious disasters/wars etc., and then is taken over by big gov and turned to a totalitarian nightmare with social credit tracking extra features" argument.)
cyberspace was about freeing the people and the flow of information between people, not the corporations that silo the data in their data centers for ptofit.
Maybe the laws & regulations you complain about are actually necessary because otherwise people will keep being greedy & nasty and eventually outnumber honest people?
This change would mean most website couldn't be used by privacy concious people anymore and that the websites in turn are free to track the sh*t out of everyone else. From my perspective that sounds a lot worse.
The web is a mandatory part of public live for most people by now and it's good and healthy that corporations get push back for not respecting privacy.
wouldn’t the market react?
The vast majority of people (some even on HN) have absolutely no clue how advanced the stalking actually is. You hear every so often these anecdotes about people suspecting Facebook of listening to them; it's actually more creepy that the tracking is advanced enough to successfully infer conversations without actually listening in.
The only people that have the work power to put equivalent alternatives in place are the big corporations, that will anyway find a loophole.
I run my small blog, and I can't spend days or even weeks to setup a subpar analytics solution. I won't even start talking about self-hosting an analytics solution which would probably double my monthly server cost for a website on which I earn 0€.
In 2030, if we continue on that trend, websites will be in two categories: belonging to huge companies, or running illegally. It's baffling that people are applauding the end of the free web.
GA doesn't tell you which terms they searched. They mostly stopped doing this in 2013.
Google Search Console _does_ tell you the search terms, and without any tracking on your website.
The GDPR effectively outlaws using personal data as payment which IMO is a good thing because unlike money, personal data is not a one-off transaction (the data can be valid long-term) and can be misused in all kinds of ways we might not even know about yet, thus the risk is too high.
This doesn't necessarily mean advertising is banned - targeted advertising is generally beneficial to the user (if you're going to see ads, you're better seeing something you're interested about) so they could offer the user a way to set their ad preferences manually (and thus sharing personal data freely with no coercion).
Keep in mind that regulation isn’t usually drafted in a vacuum and instead takes the real world into account.
If tech monopolies get broken up by anti-trust regulation it would be a good time to review the GDPR (as privacy-friendly competitors can now interoperate with existing social media networks) but until then I’m happy to have it.
> I run my small blog, and I can't spend days or even weeks to setup a subpar analytics solution.
tail -f /var/log/nginx/access.log