Hacker News Reader

Comment by suddenclarity | Hacker News Reader

This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 this year.

There are arguments that GA4 would fail the same requirements. Denmark hold that view but it hasn't been tried. Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. I find this argument objectively absurd considering how internet works but it possible that's how the law works. We wouldn't know before it has been tried though and I'd be sceptical about anyone claiming to know the result.

View on HN

> Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers.

Agreed, this is absolutely ridiculous. And I say this as an EU resident! I’d rather NOT have websites start checking residency/citizenship to decide my data ownership.

They already do.

I’ve literally never had to provide such proof, and I would say I use the internet quite a bit. Any example websites?

No need for travels - all you need is to use a VPN/proxy/tor. IP geolocation is not a reliable proxy for physical location (let alone residency - while citizenship doesn't enter the equation at all). I don't find it problematic that the law recognizes this.

AFAIK it’s often accepted that the law does accept IP geolocation as a reasonable effort to detect EU residents. GPs point here is that Denmark does not hold that view.

On the one hand, I kinda agree with DK, on the other hand that would bring on the fears of US-liberal HNers who lose all their freedom to sell user data.

Yet IP address is the "personal data" they are claiming falls under the law. It's somehow both personal and useless at identification.

Not so strange at all. The IP address _can_ be used to identify you (together with other data-points), which brings it into PII territory. That it can not be used to reliably determine your physical location is besides the point.

Consider an online store shipping physical goods. It asks you for a shipping address. This shipping address is PII and must be treated as such. The facts that you may reside elsewhere and that multiple other people may be residing on that address are both irrelevant to the GDPR.

https://www.fieldfisher.com/en/services/privacy-security-and...

https://commission.europa.eu/law/law-topic/data-protection/r...

My opinion is that this applies to GA4 as well.

The decisions don't explicitly mention a version, they say these particular sites: "...shall cease to use the version of the Google Analytics tool used on 14 August 2020". They don't say if that's UA or GA4. The original complaints from NOYB refer to UA, but the issues cited in this decision would apply to GA4 as well.

So when the DPA says "Companies must stop using Google Analytics", there's no reason to think they only mean the version that was already shut off when they published that post.

I guess they can't ban a product for all eternity. In the decision [1] they are a bit more specific:

"This shall be done in particular by ceasing to use that version of the tool Google Analytics as used on August 14, 2020, if not sufficient protective measures have been taken."

[1] https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

The result is the balkanization of the internet, although most folks in the EU want that for nationalistic reasons and to prop up their own industries, under a thin veneer of opposing US imperialism (but being unable to do anything with respect to the things which actually threaten the EU, such as an over dependence on Russia.)

I don't want my data in the hands of the NSA as much as you don't want yours in the hands of the BND, FSB, or the People's Liberation Army.

Fair enough, but this were actually the reason, simply adding a statement such as “if a non-EU member state wants to request data about an EU national and said data cannot be released to the law enforcement of the non-EU member without a MLAT being served to the EU national’s government” would have been enough. However, I don’t see that, and many Europeans do give “dominance of Americans” as the reason, so I simply go by the information available to me.

Are you aware of the history of this case and the CLOUD Act?

The CLOUD Act requires US based companies to comply with US requests for data even when that data is stored exclusively outside the US. It's in direct conflict with the GDPR.

Fair enough, but if this were actually sufficient then the US wouldn't have a law saying they can require US based companies to give them the data without regards to the laws of their countries the data is actually being taken from.

However I don't see that, and thus Europeans familiar with the relevant cases give “dominance of Americans” as the reason.

Someone has not heard about CLOUD act.

The European Comission has repeteadly tried to figure out a framework that would let US providers access EU markets safely, respecting EU laws. Every single attempt has been broken because there is no way for an US company to respect EU law and also comply with the CLOUD act.

The bit of law you suggest would essentially make it impossible for a company to respect both EU law and US law.

I would rather the NSA get my data than the BND though. But GDPR doesn't protect me from the latter. The intelligence agency at home is always a bigger threat to you than any foreign actor.

> although most folks in the EU want that for nationalistic reasons and to prop up their own industries

Sources for this extraordinary claim, please.

As an EU citizen I'm interested in the EU protecting my privacy, not for nationalistic reasons, not to prop up EU's industries. I care that my data isn't willy-nilly given away under some opaque mechanisms controlled by large corporations, because as many here on HN like to remind me: capitalism is amoral, this is some regulation instilling morals into the system.

I want to be aware and protected about where my data is being used, for what purposes, and I want to have the power to control how corporations can use my data, or if they can use it at all. This kind of data can be modeled into a version of what a system sees as "me", through the interactions I had with it, building a profile of what moves, and interests me, I want to be able to know and control who can know, and to what degree, who I am.

If you are against that, please explain why.

I don’t object to the consent requirements for marketing, however, please see [1] for the justification behind my stated position.

[1] https://news.ycombinator.com/item?id=36584739

Your citation is... your own still-unsupported opinion? It's not really responsive is it :-)

The EU has a fundamentally different viewpoint on data privacy to the USA. And they are entitled to it. The EU has roughly as many citizens as the USA under a single governance; why should they not collectively argue?

Many Europeans do, also, think the USA is mad on other issues and are unwilling to see a situation where the USA's chosen solutions to things are the de facto solutions. They see data privacy as one of the last opportunities to resist that.

(Alas here in the UK we decided we didn't want to be part of that solidarity, and we are apparently desperate to capitulate.)

As a side note, why is it only ever non-American states that are said to "prop up" their own businesses? It's a two-way street.

The best and only real way to protect your data is to not give it away in the first place. But that would require you a browser that doesn't leak data like a firehose or not using the website.

The regulation just makes sure Europe stays unimportant in tech. We will always be a secondary market that services get taken to once they've become successful elsewhere.

It's not even about any specific regulation anymore. Just the fact that they've been so trigger happy with regulations is enough to chase away investors and startups.

I would also like to remind people that the EU did adopt the Data Retention Directive in the past that forced ISPs to keep logs of every website people visited. That kind of soured any belief I had of EU politicians caring about our privacy.

>According to the Data Retention Directive, EU member states had to store information on all citizens' telecommunications data (phone and internet connections) for a minimum of six months and at most twenty-four months, to be delivered on demand to police authorities.

https://en.wikipedia.org/wiki/Data_Retention_Directive

EU is much more threatened by an over dependence on USA.

Reply on news.ycombinator.com