The businesses have had more than enough time to comply with the law.
Now is the time to start enforcing the law enough to make them actually care.
Now is the time to start enforcing the law enough to make them actually care.
it's far from 'required for the operation' it's just convenient.
i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
Why would those cloud services be required to run a business?
We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies.
Its's possible, although Google etc. will of course tell you otherwise.
Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf?
If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
- https://www.ovhcloud.com/en/datacenters-ovhcloud/
and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses
With Cloudflare R2, this will cost roughly $16. With upcloud, this will cost roughly $10,000.
You see how this can easily be the difference between a business being viable and... not?
Though I agree that neither ovh nor upcloud have an offer tailored to that use (I think in that case using a CDN instead may be the more adapted). That offer may or may not exist on the EU market but I'm too lazy to search for it
On a sidenote, I didn't know about r2, thanks for the tip
The closest you can get is renting servers with unmetered 1-10gbit connections and serving it yourself, but because you don't have the economy of scale that Cloudflare does, it will still be much more expensive than R2. You can't balance out your costs against those of hundreds of other customers that don't serve as much data, or against customers serving data at different times where your unmetered bandwidth would be wasted.
Starting up a service with pricing like R2 is only really possible at Cloudflare scale too, so it's not like it's possible for someone like us to see this gap in the market and... fix it?
1. Everyone is using US based web browsers and operating systems.
2. Those systems do a variety of "phone home" tasks like phishing checks, OCSP checks, translations, search auto predictions etc.
What happens when CNIL follows its own logic further and bans Chrome, Android, iOS, Windows and macOS?
Regarding browsers and operating systems, the companies selling them will be fined until they either comply with the law (ie. either by removing any "phone american home" task, or by using any of the alternatives provided by article 6 paragraph 1) or stop doing business in the EU.
So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision.
That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.
Wat.
You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
And even then, advertising without tracking worked just fine without internet.
If you get consent, you can also set a longer-lived cookie to determine if a user converts in a future visit.
> And even then, advertising without tracking worked just fine without internet.
There is even now a form of online advertising without any tracking (except in the most opt-in form of a discount code) which is sponsorships of videos, podcasts, articles, etc.
However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic.
It's not unusual for B2C companies in the EU to make 80%+ of their online revenue from forms of ads that require conversion tracking, so it's impossible to expect businesses to refrain from online advertising unless all their competitors are required to also.
This all relies on getting consent as a lawful basis for processing, and is currently acceptable under the GDPR except that the major networks are all US companies who could be compelled to transfer the data to US authorities.
Even now, it is much more likely that a US CLOUD carve-out or other work-around for an adequacy decision with the US will be made than the CNIL interpretation will be followed to its logical conclusion, which is that EU businesses process personal data with any US-controlled vendor, even if it occurs in the EU.
> However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic.
1. Can you not track conversion in aggregate by running X number of ads and checking how much extra traffic you got? It's obviously noisy and you can't run multiple campaigns at the same time, but conceptually I don't see why it wouldn't work?
2. I'm assuming you put links in your ads, so if you run ads for lander.example.com, can you not put the URL in google/facebook as lander.example.com?src=g and src=fb? Or, if you can't use query params, g.lander.example.com and fb.lander.example.com? Tracking stats for those and seeing how much ads you ran should give you conversion, similar to 1. but better?
> 1. Can you not track conversion in aggregate by running X number of ads and checking how much extra traffic you got? It's obviously noisy and you can't run multiple campaigns at the same time, but conceptually I don't see why it wouldn't work?
You can and many companies will have a first-party (or partly first-party, feeding into PowerBI or Tableau or something) system for this kind of reporting completely independent of the ad networks (to independently verify the numbers the ad networks claim, to include other data that a company would never share with Google, and for fraud detection).
However, without conversion tracking, Google Ads' "Smart Bidding" and "Remarketing" targeting features don't work. For a lot of businesses, being unable to, for example, stop advertising to existing customers or to use a certain bidding strategy means that the Return On Advertising Spend (ROAS - the big metric for enterprise marketing departments) goes below 1.
> 2. I'm assuming you put links in your ads, so if you run ads for lander.example.com, can you not put the URL in google/facebook as lander.example.com?src=g and src=fb? Or, if you can't use query params, g.lander.example.com and fb.lander.example.com? Tracking stats for those and seeing how much ads you ran should give you conversion, similar to 1. but better?
Companies often do this, with Google Analytics-compatible UTM parameters, custom source IDs, and very often unique marketing landing pages for each ad campaign.
As above, though, reliable reporting of conversions/revenue isn't the difficult part. It's being able to reliably target the ads/campaigns without conversion tracking.
Right now, targeted search and display advertising can be 10-100x more effective (in terms of Return On Advertising Spend) than keyword- or context-only targeting. That's not an advantage a company can forgo unless the entire market is forced to simultaneously.
What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020.
> What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
Companies have already been successfully sued over it.