[HN Gopher] Italian watchdog bans use of Google Analytics
___________________________________________________________________
Italian watchdog bans use of Google Analytics
Author : giuliomagnifico
Score : 897 points
Date : 2022-06-23 17:27 UTC (1 days ago)
(HTM) web link (www.gpdp.it)
(TXT) w3m dump (www.gpdp.it)
| current_thing wrote:
| ottime notizie. vietare google e monetizzare le bellissime
| spiagge, e mangiare pasta autentica.
| nonsapreiche wrote:
| e w la fica
| ciarcode wrote:
| You do maybe
| ciarcode wrote:
| I don't think you're really Italian ahahah
| sfifs wrote:
| So reading the English text it is not clear what exactly is the
| unlawful part. Is the fact that data is flowing to US based
| servers (which I assume is trivially managed by changing GA
| server location to Europe) or the fact it is flowing to an
| American Headquartered company, regardless of where the data is
| flowing to?
|
| Can someone comment if the Italian language text is clearer? Or
| ehat is in the judgement?
| makeitdouble wrote:
| There's a bunch of steps, but jumping to the extreme, a foreign
| gov having access to the data is the awful part.
|
| Data flowing to the US violates that, assuming Google US cannot
| refuse US gov requests, the headquarter having access to the
| data is also not accepted.
| bradgessler wrote:
| I've slowly started ripping Google Analytics out of my Rails
| projects and replacing it with https://github.com/ankane/ahoy.
|
| It's so much better! I can just use SQL to see what's going in
| and not get overwhelmed with 100's of visualizations and
| complicated dashboards.
| nathan_f77 wrote:
| I use Ahoy too, but I don't have very good visibility into the
| data. I should spend more time building queries and creating
| charts. I should probably set up blazer as well:
| https://github.com/ankane/blazer It would be really nice if
| Ahoy came with a web UI that covered all the basics.
| bradgessler wrote:
| Agreed. It would be a really great open source project to
| have a dashboard with all the basics in addition to standard
| Ahoy event captures.
| mrkramer wrote:
| Google is sucking in so much data that at the end it will be
| outlawed everywhere.
| dclusin wrote:
| Suppose I run a website in the us and a user in Italy connects to
| it. Does this mean I'm now breaking the law serving them the
| website? My connection logs now have pii.
|
| What if I use a cdn that has points of presence in Italy and
| still pings my server with a head request and the end user ip?
|
| Am I also now breaking Italian law by using google analytics?
| kmlx wrote:
| https://en.m.wikipedia.org/wiki/HTTP_451
|
| > After introduction of the GDPR in EEA it became common
| practice for websites located outside EEA to serve HTTP 451
| errors to EEA visitors instead of trying to comply with this
| new privacy law. For instance, many regional U.S. news sites no
| longer serve web browsers from the EU.
| Nicksil wrote:
| https://en.wikipedia.org/wiki/HTTP_451
| peoplefromibiza wrote:
| > Does this mean I'm now breaking the law serving them the
| website?
|
| As the article specifically states:
|
| _The Italian SA found that the website operators using GA
| collected, via cookies, information on user interactions with
| the respective websites, visited pages and services on offer.
| The multifarious set of data collected in this connection
| included the user device IP address along with information on
| browser, operating system, screen resolution, selected
| language, date and time of page viewing. This information was
| found to be transferred to the USA. In determining that the
| processing was unlawful, the Italian SA reiterated that an IP
| address is a personal data and would not be anonymised even if
| it were truncated - given Google's capabilities to enrich such
| data through additional information it holds._
|
| So, unless you are collecting EU citizens user data,
| transferring it to US and have the _capabilities to enrich such
| data through additional information you hold_ , no.
| curiousllama wrote:
| IIRC, it basically only applies if you're actively doing
| business in the EU, or courting future business.
|
| So, if you have a personal blog that grabs IPs? Not illegal. If
| you start a merch shop for your blog (or put in ads/sponsored
| content, etc.), then the whole site needs to be GDPR compliant.
| tpxl wrote:
| > If you start a merch shop for your blog (or put in
| ads/sponsored content, etc.), then the whole site needs to be
| GDPR compliant.
|
| And you do business in the EU. If you have a merch shop, but
| don't serve EU users (no EU shipping, not accepting EUR as a
| currency, no EU specific languages (German, French...), ...)
| there is no problem.
| encoderer wrote:
| There is really no reason to use Google Analytics anymore. There
| are many great alternatives now, mine is PanelBear.com. Other
| people love Fathom and Plausible. It's great to see some
| unbundling happen.
| sixothree wrote:
| Yeah, it was another one of those trojan horse programs. Offer
| something incredibly useful to website owners; something so
| compelling that they literally can't say no. An oh, it just
| happens to track the activity of every web user anywhere in the
| world.
|
| The alternative offerings at the time were fairly awful
| compared to what google released.
| quickthrower2 wrote:
| I also believe (no proof though!) that you don't need all that
| micro detail about your users and it is a distraction for a
| business.
|
| A rough "how many came" is useful. At least to diagnose if the
| site had problems. Just talk to people and make your thing
| good!
| scale8 wrote:
| The reason we built Scale8.com - Time to replace Google
| Analytics and Google Tag Manager :)
| dx034 wrote:
| I'm still a fan of Matomo. Very powerful, easy to self-host and
| you get full control over your data. Never tried their managed
| services though.
| nathan_f77 wrote:
| I'm actually just about to get rid of Google Analytics on
| DocSpring.com. I set up a self-hosted instance of Plausible
| Analytics on Render.com yesterday. I really like it so far. I set
| it up on a custom subdomain so it's not blocked by any ad
| blockers, so it's really nice to see analytics data that's almost
| 100% accurate (unless visitors disable JavaScript.) Especially
| since DocSpring is a developer tool, so most visitors are using
| an ad blocker extension. Also it doesn't use any cookies, so I
| don't need to show a cookie banner. It really feels like a breath
| of fresh air.
| tin7in wrote:
| We are based in Europe and self-host our analytics exactly for
| this reason. I feel this is just the beginning.
| V__ wrote:
| Are you using a custom sotware or something like plausible.io?
| tin7in wrote:
| I've heard about Plausible but haven't tried it yet. We are
| using Posthog which is a suite for product analytics.
| stevoski wrote:
| Plausible et al all are a pale imitation of GA. They all
| offer a dashboard with some basic filtering. But they offer
| little in the way of true analytics features, that allow
| you to slice, dice, and compare data.
| mhitza wrote:
| I'm working on an web analytics project that gives users
| more power over the way they slice/dice/compare analytics
| data. Would you be interested in giving it a try when the
| project launches in alpha?
|
| Send me a hello email at the address listed on my
| profile, would be happy to send out an invite when ready.
| quickthrower2 wrote:
| Which is a good thing!
| closewith wrote:
| Unfortunately, you can't self-host the integration with Google
| Ads or Search Console, which locks anyone who relies on Google
| (or Facebook, Microsoft, etc) Ads into the use of Google
| Analytics/Ads tracking.
| quickthrower2 wrote:
| Why not? Can't you still pass the campaign information via
| the url?
| closewith wrote:
| You can send campaign data that way, but to run any kind of
| effective campaign on Google Ads, you also need to send
| conversion data back if the user who clicks on your ad
| actually does the thing you want. You can either use GA or
| Google Ads own tracking option to set a cookie with a
| unique ID associated with that ad click and then send that
| to Google when they convert.
|
| A privacy-conscious serverside GTM/GA implementation won't
| leak any personal data like IP address to Google, but
| there's no way to avoid sending the GCLID if you advertise.
|
| A lot of companies are dependent on Google Ads for demand
| generation, so it's the reason they are sticking with GA
| even as the writing's on the wall.
| rambambram wrote:
| Congrats. We also chose to do the analytics ourselves. No
| tracking, no cookie banners, and probably better stats as well.
| One thing that Google did very cleverly was to only give GA
| users the search terms that visitors used to end up on their
| site.
| adrr wrote:
| How are you tracking returning users without cookies? Also if
| it's multi-lingual, how are you storing the language prefs?
| nedt wrote:
| Why would you need that? All businsess that aren't online
| can't collect that data and we still have newspapers and
| supermarkets. If you are interested in that data just ask
| your users.
| adrr wrote:
| Supermarkets were the original trackers of users and
| first to start using personas. They are tracking you with
| personalized coupons redemptions, loyalty programs and
| through digital payments. Tesco's personalization is so
| good they can tell if you started a diet or are dating
| someone new.
|
| Printed newspapers are disappearing. Ad supported news
| sites need tracking for ad targeting otherwise there
| isn't enough ad revenue to support their business.
| rambambram wrote:
| > How are you tracking returning users without cookies?
|
| We're not. And that's exactly the point, because we don't
| want to track. I make a distinction between tracking,
| analyzing and stats. What we do is guess who are the unique
| visitors (and who are not), and I say guess because it's
| guesswork since the browser can spew out any kind of info.
| tpxl wrote:
| > Also if it's multi-lingual, how are you storing the
| language prefs?
|
| Cookies you require for functionality (ie. login cookies,
| language settings) require no consent, but do require to be
| laid out in a cookie policy.
| adrr wrote:
| Persistent preferences require consent and is considered
| tracking. Only auth doesn't. Go visit any government site
| and they have cookie banners for their preferences
| cookies.
| m3adow wrote:
| Don't you still have to provide a cookie banner as soon as
| your analytics are storing cookies, even if it's your own?
| y42 wrote:
| > Don't you still have to provide a cookie banner as soon
| as your analytics are storing cookies, even if it's your
| own?
|
| You need consent for every kind of storage usage on client
| side if you create profiles to analyze the them for
| marketing goals. If not, and no PII is being processed, no
| consent is required. Eg you could easily aggregate your
| server logs without a consent.
| nedt wrote:
| But that means you shouldn't have IP or user-agent or any
| unique identifier in the path.
| EEBio wrote:
| You generally don't need a consent for gathering data
| that is required to run the site.
|
| But if you use the data for analytics purposes, you do
| need the users' consent for that, even if it's the same
| data that you use for operational purposes.
| denton-scratch wrote:
| > if you create profiles to analyze the them for
| marketing goals.
|
| That's not correct; if you collect PII, even if you don't
| use it, you need consent. Actually, if you don't have a
| legitimate use for the data, you are prohibited from
| collecting it at all.
|
| GDPR isn't an assault on online marketing; it's about
| privacy.
| cgjohn wrote:
| Just to be clear: PII is not the same as personal data as
| defined by the GDPR. The latter is generally much
| stricter as it also includes indirect data. Data which
| would be anonymous by itself but in a collection uniquely
| links to a single person would still be considered
| personal data under the GDPR.
| guelo wrote:
| Isn't the search term in the Referer header?
| Taywee wrote:
| Nope. They forward through an in-between that obscures it.
| They argue that because search results are personalized,
| being able to see the search terms can give you information
| about the visitor that can compromise their privacy. Google
| doesn't want anybody violating user privacy except for
| Google.
| mhitza wrote:
| If you get your site setup on Google Webmaster tools you
| will still have access to the search terms. Definitely
| not as precise as with GA, but should suffice. Unless you
| want to do per user funnel tracking starting from their
| search term. Which is pretty privacy invasive.
| dx034 wrote:
| You can only see visitor numbers per search term, but not
| information like bounce rates or duration of visits. And
| that would be really helpful to judge if people may get
| the wrong impression of your page and bounce if they
| searched for specific topics.
| closewith wrote:
| Not for many years. The only way to get Google search term
| data now is through the Search Console product, which
| integrates with GA.
| joshyi wrote:
| Same here. We've been using goaccess for years on a 300M hits a
| month. Self-host is the way to go for us.
| Rygian wrote:
| Self-hosting does not automatically make your analytics legal,
| on the other hand.
|
| Processing of your users' personal data is legal only in the
| few exceptional scenarios outlined in Article 6.
|
| https://gdprinfo.eu/en-article-6
| giobox wrote:
| Our definition of "exceptional scenarios" is clearly not the
| same... The list of scenarios in article 6 are common
| business operations covering a huge range of legitimate
| activities where processing might need to occur; there is
| little exceptional about them.
| Rygian wrote:
| Processing of personal information is unlawful except in
| the conditions listed in the article.
|
| So "exceptional" in the sense that they are exceptions to a
| more general rule, as of opposed to the sense of being
| extraordinary.
| leephillips wrote:
| Good. US citizens should be, at least, disappointed that their
| government is so bad at protecting their privacy, that US law is
| so far behind the times.
|
| To those companies and people who find these EU decisions
| baffling or inconvenient: tough. If you had had respect for your
| users this would not be an issue. You would already not be spying
| on them.
|
| To website visitors: if you see a cookie banner, the site is
| asking permission to spy on you. If that concerns you, close the
| tab.
| judge2020 wrote:
| > You would already not be spying on them.
|
| Can you point me to the part of the ban that says it's about
| protecting users from "spying in general" and not "protecting
| users from spying by US companies instead of EU companies that
| EU member states can obtain PII from at any time"?
| mhitza wrote:
| > "protecting users from spying by US companies instead of EU
| companies that EU member states can obtain PII from at any
| time"
|
| I want to quantify this quote. Each EU country can spy on its
| citizens to similar extent as 3 letter agencies from the US,
| but in a less analytical/big meta data way (part of it being
| the US brain draining EU countries for those working in
| tech).
|
| However, if EU country A wants to have access to its citizens
| user date on website X located in EU country B, is not an
| easy process; involving a strict judicial system between
| those countries.
| leephillips wrote:
| I think your logic may be a bit muddled, or I misunderstand
| your question (but, if I take it literally, my answer would
| be "no".)
|
| Not spying = not using GA = this ruling moot.
| dmix wrote:
| > To website visitors: if you see a cookie banner, the site is
| asking permission to spy on you. If that concerns you, close
| the tab.
|
| I'd love to see how often people do anything besides click okay
| anyway (I'd be very surprised if it wasn't 99%+).
| lolinder wrote:
| Unless there is a very simple "reject" button, I click okay.
| Between Firefox's native protections, DNS-level blocking and
| uBlock, I have a lot more confidence in my own protections
| than I do in their honesty, and it's not worth it to me to
| uncheck a bunch of boxes.
| nerdponx wrote:
| Sometimes it's easier on mobile to just accept all the
| garbage cookies and then clear my cookies & site data after
| I'm done with the page.
|
| But they are probably fingerprinting my phone anyway
| through other means.
| dmix wrote:
| Yeah clicking anything but okay or reject all (which I
| rarely ever come across) is usually a maze of options no
| one has time for except some tiny dedicated minority.
| 29083011397778 wrote:
| Really? I could have sworn the EU regulation requires
| dropping all non-essential cookies in 2 clicks or less -
| and that tracks with nearly every site I interact with
| that has a cookie banner.
| tick_tock_tick wrote:
| If I thought the EU was doing this to protect privacy I'd be
| all for it. They really don't give a fuck as seen by ever bit
| of legislation they are pushing for. Yes I also do understand
| that the EU in general view privacy from the government as
| illegal rather then a right.
| SahAssar wrote:
| The EU has both enacted the most promising and some of the
| most backwards, stupid and regressive privacy laws. I'm
| guessing that it depends on what representative guides it and
| forms it through the various processes, and what the courts
| do with it. Overall I think they have moved the needle
| towards more privacy.
|
| > Yes I also do understand that the EU in general view
| privacy from the government as illegal rather then a right.
|
| That is absolutely not true, at least not by enough people
| for anyone to be able to make that sort of blanket statement.
| I'd also wonder what reasons you have for thinking that, it
| seems to me like all of the 5-eyes used each other to spy on
| themselves (besides all of the things done by normal police,
| various levels of federal police, etc.)
| whimsicalism wrote:
| An equivalent regulation to the one banning GA in the US would
| not ban GA because the data centers are in the US.
| stjohnswarts wrote:
| No one is asking for exactly the same law, just the same
| results: more privacy.
| scarface74 wrote:
| Yes "we care about privacy. But we also want a back door to all
| encrypted communications".
|
| https://appleinsider.com/articles/22/05/11/eu-plans-to-requi...
| 2OEH8eoCRo0 wrote:
| America is the LTS branch of Democracy.
| hallway_monitor wrote:
| Privacy improvements will be pulled in along with independent
| political parties in the next kernel update.
| feet wrote:
| You guys are getting kernel updates? Our supreme court is
| taking us back to v0.1 from 1800
| baisq wrote:
| If a modern democracy requires an ever-growing government I
| think I will stick to Democracy Stable.
| tclancy wrote:
| Here in NH we have a group of people trying to compile
| their own. I never thought of them as distro hipsters, but
| it tracks.
| nerdponx wrote:
| My impression of these people is that they generally use
| very out-of-date versions, and they misunderstand/misuse
| configuration settings to the point that their builds are
| illogical for anyone's needs, despite their surface-level
| appeal upon skimming the manual & ancient mailing list
| messages. So the government performs efficiently for some
| very specific workloads, but generally lacks necessary
| features to run society at web scale.
| feet wrote:
| baisq wrote:
| Thinking that the situation of the majority of Europeans
| is the same as the propaganda that you read is a big, big
| mistake.
| jokethrowaway wrote:
| nerdponx wrote:
| The economy is pretty bad in the USA too if you aren't a
| white collar tech worker (or in a handful of other white
| collar fields). Maybe not as bad, but it's pretty rough
| for a lot of people, possibly a majority, and it's
| definitely unsustainable.
| feet wrote:
| Yea I would 100% rather have the calm stability of Europe
| than sacrificing my grandmother and first born son in the
| name of capitalism and the economy
|
| The US is absolutely insane
| mxuribe wrote:
| Agreed i'm not interested in "ever-growing"...not for a
| distro nor a gov...but i am interested in an evolving one
| for the better - i.e. improve effectiveness, and reduce
| bloat if it adds nothing of value. ;-)
| takethat wrote:
| and global wealth.
| nix23 wrote:
| More like the bitrotting prototype ;)
| SkinTaco wrote:
| feet wrote:
| I think the support contract ended a while back
| peoplefromibiza wrote:
| more like the archived repository on Github
| googlryas wrote:
| Pragmatically, to what extent do you believe the European laws
| have protected Europeans above and beyond how American laws
| have protected Americans?
|
| Basically, what class of badness are Americans subjected to due
| to behind-the-times data protection laws, that Europeans are
| protected from?
| Adrox wrote:
| Have you heard of Robo-calls? Basically there are no Robo-
| calls in EU, because you can just add yourself to a
| Government no-call list. If any company doesn't respect that,
| they get a huge fine.
| jacooper wrote:
| European laws are pushing to end Chat providers control over
| social interactions(which is something that shouldn't be done
| for profit any way) in the Digital markets act, which forces
| big apps to provide federation APIs.
|
| The EU with the GDPR made an incentive to not use trackers,
| dont want that ugly tracker on your site ? Then stop selling
| data, that's why private analytics like Plausible and Umami
| have sprung to life. And also made it clear how much tracking
| is on the web.
|
| There is also finally a movement to let the US host
| everything because really, the US isn't trust worthy.
|
| So, the EU laws, gave better awareness about tracking, gave
| incentives to not use trackers, and is now working on
| improving the user experience by stopping the monopolization
| of social interactions.
| ApolloFortyNine wrote:
| It's possible for a company, which is seemingly providing you
| a service since you visited the site, to make money off a
| targeted ad in exchange for free video
| streaming/content/entertainment.
|
| The whole thing has always seemed overblown to me. Websites
| make much more money off targeted ads, allowing them to do
| things like allow anyone to upload a video of any length and
| quality for free. And view other videos people upload. In
| most cases it seemed to me like a fair trade to make. Yet as
| people point out all the time, technically a website isn't
| allowed to deny access to someone who refuses targeted ads
| (through the cookie pop-up), so they're essentially being
| forced to provide that user content at a loss. Untargeted ads
| are often worth 90% less or more than their targeted
| equivalent.
|
| Privacy privacy privacy though, as if someone at Google is
| manually looking through your history laughing at you.
| nerdponx wrote:
| > Privacy privacy privacy though, as if someone at Google
| is manually looking through your history laughing at you.
|
| Part of the problem is that it seems more or less
| impossible to get large companies to keep their data
| secure. In fact Google stands out as maybe the only big
| tech company that has not been involved in a major breach.
|
| Notwithstanding the legal and political issues that arise
| when (not if, but when) this data gets into the hands of
| law enforcement agencies.
|
| And yes, there have been individual instances of employees
| misusing sensitive user data.
|
| Privacy is security.
|
| Generally I agree that content providers should be allowed
| to make money somehow, but this way has proven to be
| untenable and something needs to change.
| stjohnswarts wrote:
| Give me the option to pay more if it lets me get more
| privacy. Otherwise I keep using fake accounts, VPN,
| antifingerprinting methods, ad blockers, etc.
| [deleted]
| trelane wrote:
| Some places do. Many German news sites have a "Pur"
| version you can subscribe to and not get ads.
| franciscop wrote:
| I believe a part of the data-privacy laws and sentiment in
| Europe comes both from the WWII and the civil
| wars/dictatorships/etc that happened across EU. When in our
| grandparents time (YMMV) the government was compiling list of
| citizens or checking what they were doing in their private
| lives, it was not to give them flowers. And while that still
| sounds pretty far from me, it was also fairly recent in the
| past so that there's some social residue of the sentiment.
|
| BUT to answer the question directly, credit checks to the
| level they are performed in the USA sound like a horrifying
| thing and a total privacy breach for us EU citizens.
| cm2012 wrote:
| You won't get a good answer to this because there isn't one.
| These no realistic, practical harm to people that this EU law
| is preventing.
| baconmania wrote:
| Given your comment history, it's clear that you're driven
| by motivations that aren't at all universal.
|
| More bluntly, you've decided that consumer-surveillance-as-
| a-service is harmless. I'm thankful that the European
| regulatory apparatus disagrees. Now if only we could remind
| the American federal government why regulation is a
| worthwhile effort.
| aliasxneo wrote:
| > To website visitors: if you see a cookie banner, the site is
| asking permission to spy on you. If that concerns you, close
| the tab.
|
| There was a recent ACM article on this. They found there was a
| large number of sites that don't actually ask permission for
| anything, they are simply informing you of the spying. Not
| surprisingly, the ones that did allow modifying cookies were
| all setup in a predatory fashion which discouraged the
| disabling of tracking.
|
| The whole system is broke at the moment.
| Swenrekcah wrote:
| It's because they're allowed to use the word "cookies" for
| it.
|
| If they were required to use specific wording, like for
| instance "injecting surveillance artefacts" people would
| probably care a bit more.
| gattilorenz wrote:
| Hardly. It's like the requests for administrative rights in
| Windows Vista, or the installers with many browser addon
| bars...
|
| Nice idea in theory, but if it's too frequent the awareness
| will, at some point, just disappear.
| aliasxneo wrote:
| Not necessarily. The team that wrote the ACM article did a
| small user-test using various versions of the "disable
| cookie" banner. In all cases they concluded that the user
| was indeed aware of the negative impact of cookies,
| however, the need to just "get back to the content" often
| overruled that distaste.
|
| Not surprisingly, the most effective banner they found was
| the one which had a single "disable all cookies" button. It
| was something like an 80% hit rate. So, people care, but
| not enough to dig into another prompt to uncheck a bunch of
| boxes. This is what the ACM writers referred to as
| predatory (abusing human nature).
| drstewart wrote:
| What about Australian citizens?
| BolexNOLA wrote:
| My buddy is a manager at a chemical plant, and your comment
| reminds me of a very astute statement he made recently.
|
| "I don't generally like unions. I've worked at both union and
| non-union plants. But anytime someone else complains about
| unions, I remind them that if they have a union at their plant,
| they earned it."
| feet wrote:
| Sounds like a manager's take on unions, at least he sounds
| somewhat reasonable. Good on him
| saas_sam wrote:
| When union plants are shuttered in favor of non-union plants,
| did they earn that too? Or does this logic only apply in one
| direction?
| tbihl wrote:
| Yes? Why wouldn't they?
| jrajav wrote:
| I think it's fair to say that most unions have been
| established as a sole result of proportional human effort,
| while the same cannot be said for the success of most
| businesses. There are many instances where an existing
| imbalance in power or resource ownership is a significant
| factor in a business' success.
| mattmcknight wrote:
| > To website visitors: if you see a cookie banner, the site is
| asking permission to spy on you.
|
| Or you know...count how many unique visitors they have and how
| to make the site more useful. Do you avoid using cookies on
| this site but still manage to log in?
| [deleted]
| leephillips wrote:
| Do you know the difference between cookies and a cookie
| banner? Do you understand why this site can have login
| sessions, and even keep track of the number of unique
| visitors, yet is not required to have a cookie banner?
| mattmcknight wrote:
| What do you think the _ga attribute is in their cookie?
|
| Isn't there an exception for authentication in the consent
| requirement, but not in the inform requirement?
| [deleted]
| tensor wrote:
| Have you researched to know if this site is hosted on a US
| server? I wouldn't be surprised if it is and I also
| wouldn't be surprised if your IP address was additionally
| stored in a log somewhere for a period of time. In the US.
| jeremyjh wrote:
| Yes but they are not tracking you with third party
| services, so regardless of where the server is they would
| not need a banner. The banner is a request for
| surveillance permission.
| Kovah wrote:
| Cookies needed to properly provide user authentication, i.e.
| user session identification, are counted as "technical
| necessary" cookies and do not need a cookie banner. You only
| need to ask for cookie consent, if you track visitors with
| third-party services. And, to counter your unique visitors
| claim: you don't need cookies, or any third party service,
| for that. Everything can be done locally without
| disrespecting user privacy.
| leephillips wrote:
| Exactly. HN doesn't need a cookie banner because they're
| not spying on their users. No barrier to keeping track of
| sessions.
| mattmcknight wrote:
| > and, to counter your unique visitors claim: you don't
| need cookies, or any third party service, for that.
| Everything can be done locally without disrespecting user
| privacy.
|
| how do track unique visitors without cookies, and how is
| that way less "disrespecting" of user privacy than a
| cookie?
| tensor wrote:
| If you feel this way I hope you do research before visiting any
| website at all, because you might accidentally connect to a
| server in the US and your IP address will be in the TCIP stack
| of that server and probably the logs too. US servers that are
| intended to serve US customers have no obligations to you.
| encoderer wrote:
| Well I'm not an expert but I think the main issue is that
| American citizens have protections that non-Americans do not.
| The government cannot spy on Americans without a court order.
| darknavi wrote:
| The word "spy" is so loose these days. I'd consider the vast
| swaths of metadata other companies compile on me "spying" to
| an extent.
| skrtskrt wrote:
| > The government cannot spy on Americans without a court
| order.
|
| Have I got news for you. Specifically at least 100 years of
| news.
| SahAssar wrote:
| Unless they have an intelligence sharing agreement with a
| nation that happens to pick up signals from americans, from
| who they can request that data. And maybe there exists a
| network to share the raw data, wouldn't that be convenient?
| Or you could have a secret court system (FISA) to bypass most
| of the protections normally granted by due process?
| NaturalPhallacy wrote:
| I'm not disappointed I'm infuriated. Because the US uses
| technology companies to get around the 4th amendment all the
| time:
| https://www.salon.com/2013/04/24/government_giving_att_other...
|
| The US isn't "behind" it simply has no intention of moving in
| that direction, despite the 4th amendment making it really
| clear they're not allowed:
|
| >The right of the people to be secure in their persons, houses,
| papers, and effects, against unreasonable searches and
| seizures, shall not be violated, and no Warrants shall issue,
| but upon probable cause, supported by Oath or affirmation, and
| particularly describing the place to be searched, and the
| persons or things to be seized.
| sylware wrote:
| I don't understand.
|
| They can host locally the data and remotely query it.
|
| What's important is the "intelligence" the data does provide:
| giving critical and unfair advantage for those who have the whole
| data.
|
| For instance, microsoft has an unfair advantage almost anywhere
| because they have access to the whole linkedin database.
| jeroenhd wrote:
| European companies are not allowed to share PII with American
| companies. That goes for companies with a headquarters in the
| USA or subsidiaries that may be forced to share data thanks to
| laws like the US Cloud Act.
|
| Previously, the EU exempted the USA through an "adequacy
| decision". That was later deemed illegal under EU law as
| American laws could not guarantee the privacy of EU citizens to
| the extend the GDPR prescribes. Then the EU tried again, and
| again such a decision was also overturned in court. The EU is
| working on another attempt at letting the USA track PII of EU
| users, but until they do that again (probably for another few
| years) it's illegal to share PII with American companies in
| almost all situations.
|
| This is the third time a data processing agency has declared
| the use of Google Analytics illegal so it shouldn't really come
| as a surprise to those following tech news.
|
| What's important is that the data is PII and that it's going to
| a place that can't guarantee privacy to an acceptable standard.
| Business advantage is irrelevant. The intelligence the data
| provides is also irrelevant. European privacy laws serve
| people, not businesses.
| naet wrote:
| As more and more country specific legal regulations are raised, I
| wonder who will be the ultimate gatekeepers of the general
| internet when certain actors behave against the "rules". The
| current landscape is a complex system of seeming contradictions
| straddling different levels of public and private, centralized
| and decentralized, anarchical and moderated, etc.
|
| Will ISPs be forced to cut off traffic from certain areas? Will
| centralized companies like Google and Reddit be forced to comply
| with regulations or cut off services in certain areas? Will
| governments set up firewalls? Will the buck of responsibility be
| passed upwards to service providers like GA, or downwards to
| individual site administrators?
| UncleEntity wrote:
| Nah, they'll just slap them with a fine now again as a
| substitute for direct taxation and let them do what they do
| basically unchanged.
|
| Once the Europeans have to use a foreign proxy to see the
| regular internet, like the Chinese, then we will have a real
| discussion on online privacy.
| djbebs wrote:
| Have you tried to go to rt.com hany time recently?
| aembleton wrote:
| Still works for me from the UK
| djbebs wrote:
| We already do.
| dogman144 wrote:
| Man, wish we'd do that in the US. Not sure what else to
| insightfully add after all these years.
| AdriaanvRossum wrote:
| Regarding forbidden countries, it's not forbidden in the
| Netherlands, yet. They will announce a verdict in a form of a
| report by the end of 2022 [1].
|
| To give people an option and pink something else over Google
| Analytics, I have built an alternative, Simple Analytics [2].
|
| It doesn't use cookies or any form of tracking and you get still
| the useful data that 80% of the website owners need.
|
| [1]
| https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...
| (in Dutch)
|
| [2] https://simpleanalytics.com
| jeroenhd wrote:
| Worth mentioning that DPAs tend to work together to prevent
| conflicting laws across the EU. Following Austrian, French, and
| now Italian rulings, it's almost guaranteed that the Dutch
| authority will come to the same conclusion.
| AdriaanvRossum wrote:
| Yes, I think so too.
| apd_ wrote:
| How do you track "visitors"?
| AdriaanvRossum wrote:
| With a referrer, see these docs [1]
|
| [1] https://docs.simpleanalytics.com/explained/unique-visits
| aliswe wrote:
| What is a watchdog in this case, isn't it a non-governmental
| organization?
|
| in that case how can they ban anything and what does that mean?
| gruturo wrote:
| This is an English translation from "Garante" which is actually
| a stronger word - more like Guarantor. It is an official
| authority with teeth.
| etagate wrote:
| Exactly. Just to clarify, this is the authority responsible
| for those multi-million dollars fines against faang
| x0x0 wrote:
| It's likely a bad translation.
|
| The Italian SA is the Italian Data Protection Agency (DPA), one
| of the per-country European regulators
| https://ec.europa.eu/justice/article-29/structure/data-prote...
| . Which acts under the GDPR and predecessor data protection
| laws, and is very explicitly a governmental regulator.
| noneeeed wrote:
| Certainly in UK English we use watchdog to mean any
| organisation that has an oversight role, frequently government
| ones. For example the Financial Services Authority might be
| described as "the banking watchdog", it is very much a
| government agency.
| chrisseaton wrote:
| Why do you think watchdogs have to be non-governmental?
|
| For example:
|
| https://www.theguardian.com/technology/2022/may/05/uk-watchd...
| ryanmcbride wrote:
| I've been using clicky on a few of my sites and even though they
| _assure_ me that it's totally compliant with gdpr I don't really
| believe them, does anyone have a decent alternative for analytics
| that respects people's privacy? I just want to see when I get new
| vs returning visitors on a page. Cloudflare's analytics are okay
| but I like how granular clicky can get, but if there's no good
| way to do that I think I'm just gonna ditch clicky and make do
| with the cdn analytics. Hell, I bet the cdn already does
| everything I need and I just don't know how to use it right, or
| I'm not paying for the right tier or something.
| [deleted]
| ClumsyPilot wrote:
| matomo is something you can self host
| tensor wrote:
| Note that you must make sure that your host is not in the US
| as well.
| solar-ice wrote:
| There's several self-hosted solutions, as well as several
| GDPR-compliant SaaS solutions. They generally work pretty
| well; I've seen people set up, for example, Plausible, in a
| couple of hours on a cheap VPS.
| onphonenow wrote:
| At what point do operators just start blocking access from EU
| countries. It's hard to imagine its worth jumping through all the
| complexities here at some point.
| phatfish wrote:
| Bring it on. Anything that disconnects people from the American
| tech industry and encourages domestic competition is a good
| thing.
| panzerboiler wrote:
| Sure. Block access to 450 millions people because it is
| inconvenient to respect their privacy.
| amitparikh wrote:
| They already do. Example:
| https://www.tribpub.com/gdpr/baltimoresun.com/
| reaperducer wrote:
| The last time I checked, the Google Analytics' Terms of Service
| explicitly prohibited its use on web sites involving healthcare
| companies.
|
| That gives you an indication of how invasive it is -- that even
| Google doesn't want to handle the personal information, because
| it can't be made HIPAA-safe.
|
| Naturally, the majority of healthcare web sites use Google
| Analytics, because nobody ever reads the Terms of Service.
| paulcole wrote:
| > The last time I checked, the Google Analytics' Terms of
| Service explicitly prohibited its use on web sites involving
| healthcare companies.
|
| You're missing a key part of the sentence you're remembering:
|
| > If you are (or become) a Covered Entity or Business Associate
| under HIPAA, you may not use Google Analytics for any purpose
| or in any manner involving Protected Health Information unless
| you have received prior written consent to such use from
| Google.
|
| Healthcare companies can absolutely use GA on their websites as
| long as the website isn't involving PHI or ePHI.
| zugi wrote:
| I use NoScript and block Google analytics, facebook, etc. It's
| nice that they use a domain separate from google.com, making it
| easy to block.
| leephillips wrote:
| Yes. I have all their analytics and ad network domains blocked
| in my hosts file.
| humanistbot wrote:
| From the article:
|
| > A website using Google Analytics (GA) without the safeguards
| set out in the EU GDPR violates data protection law because it
| transfers users' data to the USA, which is a country without an
| adequate level of data protection.
|
| > Upon expiry of the 90-day deadline set out in its decision, the
| Italian SA will check that the data transfers at issue are
| compliant with the EU GDPR, including by way of ad-hoc
| inspections.
|
| This follows similar decisions by France [1] and Austria [2].
|
| [1] https://iapp.org/news/a/cnil-is-latest-authority-to-rule-
| goo...
|
| [2] https://iapp.org/news/a/far-reaching-implications-
| anticipate...
| tmoneyfish wrote:
| I'm building my own open source analytics solution exactly for
| this reason.
| iLoveOncall wrote:
| Those decisions are good in theory, but in practice they will
| kill the free web.
|
| The only people that have the work power to put equivalent
| alternatives in place are the big corporations, that will anyway
| find a loophole.
|
| I run my small blog, and I can't spend days or even weeks to
| setup a subpar analytics solution. I won't even start talking
| about self-hosting an analytics solution which would probably
| double my monthly server cost for a website on which I earn 0EUR.
|
| In 2030, if we continue on that trend, websites will be in two
| categories: belonging to huge companies, or running illegally.
| It's baffling that people are applauding the end of the free web.
| Nextgrid wrote:
| Honestly, at this stage the "free web" can fuck right off. The
| "free web" you speak of generates a lot of negative
| externalities everyone else has to put up with. If your "free"
| web needs to attack everyone with spyware for it to exist then
| it's not really "free".
|
| > I run my small blog, and I can't spend days or even weeks to
| setup a subpar analytics solution.
|
| tail -f /var/log/nginx/access.log
| freeone3000 wrote:
| Why does your small blog need an "analytics solution" in the
| first place, if you earn $0?
| iLoveOncall wrote:
| Because I want to know where my readers come from, which
| Google terms they searched, etc.? There's a million reasons
| to want to know stats like this without earning money...
| stevoski wrote:
| > which Google terms they searched, etc.
|
| GA doesn't tell you which terms they searched. They mostly
| stopped doing this in 2013.
|
| Google Search Console _does_ tell you the search terms, and
| without any tracking on your website.
| progman32 wrote:
| As a user, I don't want to give this info. I'm glad the EU
| is giving folks an avenue to express this preference.
| iLoveOncall wrote:
| I provide free tutorials and articles like this. If you
| don't want to provide this info then I don't want to
| provide you free content.
| Nextgrid wrote:
| Then it's not really _free_ content is it? Put your
| content behind a "paywall" where the payment is whatever
| information you're (illegally) collecting from GA and see
| how it goes; at least then the "payment" you're expecting
| from it will be clear and users can make their own
| decision.
| olalonde wrote:
| That's the problem with GDPR. A lot of people are fine
| with this arrangement, but the GDPR is basically making
| it unlawful. GDPR is basically imposing the preferences
| of other people (e.g. progman32) on us.
| Nextgrid wrote:
| The problem that regulation is trying to solve is that if
| "personal data" becomes an acceptable form of payment
| then people won't actually have a choice and companies
| can force people to provide data by not offering any
| alternative payment methods.
|
| The GDPR effectively outlaws using personal data as
| payment which IMO is a good thing because unlike money,
| personal data is not a one-off transaction (the data can
| be valid long-term) and can be misused in all kinds of
| ways we might not even know about yet, thus the risk is
| too high.
|
| This doesn't necessarily mean advertising is banned -
| targeted advertising is generally beneficial to the user
| (if you're going to see ads, you're better seeing
| something you're interested about) so they could offer
| the user a way to set their ad preferences manually (and
| thus sharing personal data freely with no coercion).
| olalonde wrote:
| This assumes that businesses hold all the power and can
| dictate payment methods to consumers. That's not how it
| works in a market economy. If there is a demand for
| alternative payment methods, businesses ignoring it will
| get outcompeted by competitors who do satisfy that
| demand.
| cardosof wrote:
| Hindsight is 20/20 but wasn't it clear that the company selling
| ads shouldn't be in charge of metrics for traffic and ads? Just
| like the TV channels had to rely on media rating firms.
| badkitty99 wrote:
| youngtaff wrote:
| Not sure an ad company should he in charge of a browser either
| cardosof wrote:
| Oh and don't forget a major OS
| openplatypus wrote:
| While I should be happy with narrative (I run
| https://wideangle.co, GA alternative), let's be honest. It not
| banned. Nor is it illegal.
|
| It is illegal to use it in such a way that results in Personal
| Data being siphoned to the US.
|
| Is it hard? Yes. Outright illegal? Nah.
| stevoski wrote:
| It is good to see a GA competitor not resort to FUD as a
| marketing tool.
| dx034 wrote:
| But it's enough of a hurdle that many website owners may just
| decide to go with a EU-based competitor. Certainly a good
| ruling for the EU tech scene.
| nwellnhof wrote:
| What's really puzzling is that Google Analytics never got banned
| because of antitrust laws. It's the most obvious example of
| predatory pricing I've ever seen. How is a smaller company
| supposed to compete against a free product?
| dudus wrote:
| Google Analytics has an enterprise paid version and it starts
| at 6 figures, Adobe has a very competitive product in the same
| space. So there's definitively room for a paid product in the
| market.
| adrr wrote:
| How many companies use GA as their only analytics system? It
| isn't free. It has a free tier.
| dx034 wrote:
| It's like with Cloudflare. The free Tier is what gets small
| companies and hobby developers in. And as they know your
| system but not the one of others, they'll recommend it to use
| when your company grows or their employer looks for an
| analytics system.
|
| But I don't think it's predatory. It clearly worked for
| cloudflare and seems to work for Tailscale (they openly said
| they're using the same strategy). It would be predatory if
| others couldn't match that, but I'd argue many competitors
| could offer free plans for small websites if they wanted to.
| Wowfunhappy wrote:
| Doesn't predatory pricing mean "we dropped our pricing below
| profitability in order to kill competitors (and presumably
| raise our own prices once they're dead)"?
|
| I think you'd have a _very_ good case against Amazon, and
| probably Uber /Lyft, and I've long wondered why no one sued
| them over it. But in Google's case, Analytics is profitable for
| the same reason Youtube is profitable--Google makes money off
| the data they gather.
| permo-w wrote:
| I did hear this in about 2014, so it could well have changed,
| but I thought Youtube wasn't profitable, or at the very most
| barely profitable
| IX-103 wrote:
| As of 2019, I was still hearing it wasn't profitable.
| Though that may be starting to change:
| https://arstechnica.com/gadgets/2021/04/youtube-is-now-
| build...
| vkou wrote:
| One broad view is that anti-trust is supposed to protect
| _consumers, not competitors_.
|
| If a competitor can't produce a quality product that people
| will pay for, consumers aren't being harmed by the prevalence
| of a free good-enough product.
|
| In a consumer-protection world where a free and open source
| Linux had 98% market share in the OS market, Microsoft or Apple
| would have no leg to stand on to sue its developers over anti-
| trust. In a competitor-protection world, they would.
|
| The US views anti-trust through a very consumer-focused
| lens[1], the EU _sometimes_ views it through a more competitor-
| focused one.
|
| [1] This doesn't mean I agree with it, and there are obvious
| problems with trying to prove harm in a court of law, if no
| alternative exists.
| scarface74 wrote:
| If we enforced a law that said no product can be sold at a
| loss, we would get rid of almost every single startup and many
| recently IPOd former unicorns,
| tantalor wrote:
| Lots of ways? Better features, better support, better
| performance.
|
| If you can't beat the free offering, then go home.
| reaperducer wrote:
| _If you can 't beat the free offering, then go home._
|
| In the real world of physical goods, there are laws against
| this. But Google's a tech company, so anything goes.
| minsc_and_boo wrote:
| Which real world country?
|
| In the U.S. most antitrust law is based on protecting
| what's best for the consumer, not protecting the
| competition from a free alternative.
| foota wrote:
| It's not illegal to give things away for free unless it's
| dumping.
| reaperducer wrote:
| _It 's not illegal to give things away for free unless
| it's dumping._
|
| Which is exactly my point.
|
| "[Dumping] occurs when manufacturers export a product...
| at a price below the normal price with an injuring
| effect. The objective of dumping is to increase market
| share in... by driving out competition and thereby create
| a monopoly situation"
|
| https://en.wikipedia.org/wiki/Dumping_(pricing_policy)
|
| That's exactly what's happening here.
|
| Google prices Analytics at $0 to prevent any competition
| from starting up.
|
| While an argument can be made that Google doesn't need to
| charge money for the product because that cost is made up
| in other areas, there is no way of knowing that, because
| those costs are not public. We don't know if it's fully
| made up by other means, or partially made up by other
| means, or not at all.
|
| Like you, IANAL, but it's my understanding that legally,
| it's not about the price, it's about the intent.
| wvenable wrote:
| > Google prices Analytics at $0 to prevent any
| competition from starting up.
|
| It's not dumping because, in the absence of any
| competition, the price hasn't changed. It just turns out
| the market price for this service is $0.
| quickthrower2 wrote:
| I would say it has more in common with the Microsoft
| antitrust case. In that they gave IE away for free.
|
| I think you can show Google has monopoly on search and
| search data and GA is the only analytics allowed to
| connect with that.
|
| Is it dumping? Yes. They don't intend to raise the price,
| but they get paid not in cash but in terms of increasing
| their monopoly by having so much data on us.
|
| Now a lot of things are like this (anything where you
| give your email for a discount code). But they are not
| intended to get a global monopoly or make it impossible
| for anyone else to do business competing with you.
| wvenable wrote:
| IE is no more but the price for browsers is still free.
| Most consumers even at the time also did not pay for
| their browser.
|
| Now these days it would be ridiculous if your device or
| operating system didn't come with a browser.
|
| > They get paid not in cash but in terms of increasing
| their monopoly by having so much data on us
|
| Yes, and anyone else can do the same.
| quickthrower2 wrote:
| The landscape has changed (or to pun... the netscape?).
|
| We now have genuine browser competition. I think Safari
| and Firefox are just enough to say Chrome is not a
| monopoly. I write this on FF right now (running on
| Ubuntu) because it is a viable alternative.
|
| This is the case for now, might be different in 2023.
|
| "X is free" is not enough to be a problem on it's own.
| xboxnolifes wrote:
| > It just turns out the market price for this service is
| $0
|
| You can't come to this conclusion until you prevent
| Google from using the acquired data to improve their ad
| service.
| jokethrowaway wrote:
| What a horrible law.
|
| The market should just create a better solution or find
| investors to call the bluff of the offending company and
| make even more money
| bryan_w wrote:
| "We've tried nothing and we're all out of ideas!"
|
| - A French Ned Flanders, probably
| raviparikh wrote:
| I co-founded a company called Heap that competed against Google
| Analytics and we were quite successful. Amplitude, Mixpanel,
| and others have also done so. GA's free pricing was not really
| a big issue for us and customers were very willing to pay 6-
| and 7-figures for a differentiated quality product.
| Nagyman wrote:
| Loved Heap (Analytics?). I advocated for it while working at
| my previous employer :) I think we were early customers. At
| the time, its automatic tracking of all events was a godsend
| compared to hooking up specific tracking after the fact using
| GA events.
| plandis wrote:
| The US should economically retaliate.
|
| GDPR and these other regulations in the EU exist because EU
| cannot stomach the fact that they got beat on tech and instead of
| innovating they are regulating to try and even the playing field.
| Nextgrid wrote:
| > the fact that they got beat on tech
|
| What tech is the EU missing out on?
|
| All the recent "tech" I see from the US is all about novel ways
| to screw & exploit people for profit, at the expense of turning
| society into a dangerous wasteland full of outrage and
| saturated by advertising.
|
| No thanks.
| gnuj3 wrote:
| Hmmm, or maybe they exist because EU has a little bit more
| respect for privacy of its citizens than US?
| freyr wrote:
| I'm supporting of privacy, but it's amazing how heavy-handed
| European regulation can be, and how difficult it can make
| understanding even basic metrics about our business and how those
| metrics have shifted over time. I suppose their intentions are
| good though.
| realusername wrote:
| All of that is because of the cloud act, non american companies
| won't have as much issues. The obvious solution is to remove
| this spying law breaching EU laws and common sense.
| makeitdouble wrote:
| Suppose you had an internal tracking library, aggragating data
| fetch from your own site and mobile clients, all data saved in
| a data center managed by your country's most reliable provider.
| EU directives would be a no-brainer.
|
| That scenario has always been an option, and would be the most
| common case if Google didn't provide their own service for free
| or at cost. What's happening with the EU feels disruptive only
| because Google had such an unatural position in the market.
| [deleted]
| calibas wrote:
| If I understand this correctly, the issue isn't Google Analytics
| specifically, but "because it transfers users' data to the USA,
| which is a country without an adequate level of data protection".
|
| So this could also apply to any company that sends PII to the
| USA?
| solar-ice wrote:
| At present, there is no legal basis for a company covered by
| the GDPR to send personal data to the US or a US-owned company.
| The US needs to repeal the CLOUD Act, and maybe one or two
| other things, in order to make this situation work again.
| minsc_and_boo wrote:
| Is that for US- or Italian-based users? What if this is an
| Italian company running a global website with data from non-
| GDPR country users?
| jakubp wrote:
| GDPR covers EU citizens. I don't think it says anything
| about non-EU citizens.
| denton-scratch wrote:
| No, it covers companies and individuals operating within
| GDPR jurisdiction. A US company that trades in the EU is
| subject to the GDPR. This is no different from applying
| the UK Trades Descriptions Act to US companies that
| advertise in the UK.
| quickthrower2 wrote:
| Which is nebulous: someone whose grandad was Italian
| living their whole life in the US might be a defacto EU
| citizen.
| denton-scratch wrote:
| No such thing as a de facto citizen; a de facto citizen
| is also known as a refugee.
| k1w1 wrote:
| There is nothing in the GDPR about citizenship. GDPR
| applies to "data subjects who are in the Union" Art 3(2).
| So it is the physical location of the person that
| matters. As a US citizen, if you travel to an EU country
| on vacation then the GDPR applies to you while you are
| there.
|
| GDPR also applies to EU based companies for _all_ of
| their activities - so in addition to limiting US business
| in the EU, it limits EU businesses in the US.
| quickthrower2 wrote:
| If it is physical location, that is something you cannot
| possibly know for a user, due to VPNs. You might know
| that a person is logged in and registered with a US
| address, but you don't know if they are traveling (they
| might even VPN via the US because it is convenient for
| work).
|
| So I guess you need to assume this applies for all
| visitors.
| denton-scratch wrote:
| I think that's correct; and I suspect it was intentional.
|
| I strongly disapprove of extraterritorial legislation (a
| US specialty). But in the case of the GDPR, if you want
| to regulate internet activity, then you more-or-less
| _have to_ go extraterritorial.
| solar-ice wrote:
| You can find the scope of the GDPR in Article 3 of the
| GDPR: https://gdpr-info.eu/art-3-gdpr/
|
| Read these as individual clauses; the Regulation applies if
| any one of them is met. An Italian company serving
| customers anywhere in the world is covered by the first
| clause.
| throwawayjun21 wrote:
| asasidh wrote:
| this is the start of the unbundling of alphabet
| ec109685 wrote:
| Google needs to do what apple is doing with PrivateRelay and
| putting double blind proxies in place so PII can be stripped
| before Google gets its hands on it.
| clairity wrote:
| i'd support any legislation that booted google, fb, ms, adobe,
| salesforce, and a whole host of other surveillance tech companies
| from any and all levels of government. it's literally as
| important as the separation of church and state. in fact, i'd
| love to see a constitutional amendment explicitly separating
| corporate interests from governmental ones, in all facets of
| civic life (e.g., campaign finance).
| hulitu wrote:
| They tried with the church and did not succeed. Why do you
| think they can succeed with SW.
| saiya-jin wrote:
| Not only state... I see absolutely 0 reason for my swiss
| ebanking in the secured web interface to se google analytics
| and similar trackers. I can clearly see them being blocked by
| the likes of ublock origin and ghostery in my firefox. Why the
| f*k should google know where I go in such private matters (and
| there are tons more, ie if you are lgbtq+ in one of the many
| restrictive locations, have some less mainstream political
| preferences etc.). The data once acquired have no reason to be
| deleted, ever. Too juicy info, and 7 billion humans is not that
| large group to aspire to track.
|
| I get why google et al want it for their growth/sales, but they
| are a private entity not owning internet in any way, extremely
| foreign to Europe with no clear friendly intentions. One of few
| times I can say I am proud to be living on old continent.
| clairity wrote:
| exactly, we need to decentralize power, and knowledge
| (information) is power. it seems innocuous when we each leak
| a little here and there, but surveillance tech is vacuuming
| up every tiny bit of it.
|
| living in europe doesn't much matter, given the reach of
| these companies and their interweaving into government
| systems, along with reciprocal surveillance agreements
| (however-many-eyes countries).
| strawhatguy wrote:
| I understand the feeling, but that's not possible, and
| moreover, after reflection, why should it be so?
|
| If government can literally fine/shutdown your business
| arbitrarily (as they do for lockdowns, permits, etc.), then
| they should have a voice in the government that could treat
| them so terribly.
|
| Unless you mean to say that government should be so much
| smaller that it doesn't impose separate business taxes,
| import/export controls, require permitting and licensing and
| follow arbitrary regulations on those businesses, which I could
| get behind. Ideally, if there's no advantage or penalty to
| avoid by petitioning government, won't everyone stop paying
| attention to government? No gaming the game can happen then!
|
| The problem is that we can't have it both ways, can't restrict
| a group from petitioning and then pose rules they MUST follow,
| without a say. That's not democracy at all.
|
| Companies are just groups of individuals after all, and should
| have just as much voice as an activist group does, like ACLU or
| Americans for Tax Reform or whatever.
| danielheath wrote:
| The government of Italy makes rules that apply to Italians
| and those doing business with them.
|
| If you're Italian, you do have a say, and if you're doing
| international business in Italy then you accept the sovereign
| risk of dealing with a foreign state.
| clairity wrote:
| you seem to be arguing from the corporate personhood stance.
| corporations still have an outsized voice via their rich
| owners. they shouldn't, however, be privileged with extra
| voice unaccorded the ordinary citizenry.
| adamrezich wrote:
| > in fact, i'd love to see a constitutional amendment
| explicitly separating corporate interests from governmental
| ones
|
| I don't think you comprehend the scope of what you're
| suggesting.
|
| I work for a school district and I'm currently migrating our
| system from using one commercial bus routing service to
| another... using Windows, SQL Server, Teams, etc. from
| Microsoft... using a laptop, dock, three monitors, keyboard,
| and mouse from HP... and today the elevator was broken so we
| called a repair company to come fix it... oh, and some company
| makes the school buses, and the networked phone on my desk, and
| the printer around the corner, and all of the paper in it...
| the fluorescent bulbs above me don't grow on trees...
|
| you can't just expect governments, even at the national level,
| to roll their own _everything_ without interfacing with
| corporations in any way--this is a hopelessly naive view of the
| world. I am just as uncomfortable as you are with data being
| shared with corporations, but you 're going to have to figure
| out a more realistic set of political goals than what you've
| outlined here.
| clairity wrote:
| it's not really aimed at governments, so much as corporations
| that feel entitled to sneak in ancillary interests into their
| products, like surveilling the public. basically, it's to
| force companies like microsoft to remove all that other shit
| and provide just the core software, if they want access to
| government largess. this has beneficial externalities for us,
| the residents of said governments.
| adamrezich wrote:
| sure, and like I said, I agree completely. but you can't
| just say "i'd love to see a constitutional amendment
| explicitly separating corporate interests from governmental
| ones", unless you're proposing that all corporations should
| be state-owned and -operated, and that's not really a
| viable solution, plus it introduces a whole host of other
| problems.
|
| but even if you just mean to say "government should not
| share citizens' data with corporations", well, there are
| presently two (until our license with one is up at the end
| of summer) separate corporations that both know where every
| kid in my school district lives, what their special ed
| needs are, what their parents names are, what their
| parents' contact information is, if they live between
| multiple households, and so forth, because that is the
| explicit purchase of their business, and that why we
| purchased their software. the same goes for another piece
| of SaaS we recently purchased a license to involving food
| service management for the school system. when designing
| the data export we opted to not follow the part of the
| schema that wants SSNs for the students (because why would
| they need that?!), but that might not be the case for other
| districts using the same software.
|
| my point is there are a lot more interconnected corporate
| software services sharing citizen data at play in
| contemporary government systems than you probably think,
| and, once again, even though I agree with your position
| with regards to sharing citizen data with corporations... I
| think that ship might've pretty much sailed sometime in the
| past few decades.
| clairity wrote:
| i wrote a few sentences on a large civic concept, not a
| treatise, so let's not jump to ideological conclusions
| quite yet.
|
| but yes, i'm explicitly against governments sharing
| private data with corporations, no matter how convenient
| it might seem to be for workers. governments have run for
| centuries without those conveniences, so it's not a
| dichotomous choice of share all the data or not have
| schools (for instance). a lot of data sharing is driven
| by the misguided desire to control (that is, to
| centralize power), whether it be teachers, students, or
| administrators, not for actual educational outcomes,
| despite the latter being the nominal impetus.
| adamrezich wrote:
| > a lot of data sharing is driven by the misguided desire
| to control (that is, to centralize power), whether it be
| teachers, students, or administrators, not for actual
| educational outcomes, despite the latter being the
| nominal impetus.
|
| I have yet to see this occur. instead, it's all about
| bureaucratic convenience. why hire more people for
| Student Transportation to keep bus routes straight, and
| deal with printing out & distributing paper passenger
| lists to bus drivers, etc. etc., when you could use a
| piece of software to handle it all for you? nobody at the
| bureaucratic levels we're talking about here care about
| hoarding personal information for power or centralization
| or anything like that, it's purely for convenience and
| streamlining of bureaucracy.
|
| one might say, ok, sure, but why does it have to be a
| third-party SaaS that you're SFTPing data back and forth
| with, why can't it just be a traditional piece of
| software that you install and manage locally? again:
| convenience, for all involved. that's one less thing for
| our sysadmins to worry about dealing with, and when you
| get enough of these things then you'll need to hire and
| retain more sysadmins (who we're frequently cycling
| through as is due to failure to compete with corporate
| salaries). the software developers of the third-party bus
| routing software don't have to worry about platform
| compatibility if the platform they're targeting is the
| web. parents can easily log into the website to see their
| child's bus routes and if they're delayed or whatever
| (apparently this is a real thing real parents demand...).
| but also, hey, we're already using Office 365, so "what's
| a few more SaaS solutions to problems we have, at this
| point?"
|
| what I'm getting at here is the rise of SaaS and the fall
| of self-hosted solutions to things like this is pervasive
| everywhere in the corporate world, so if you don't want
| your tax money "wasted" on even keeping school district
| student data in-house and secure, this is the world we
| have to live with now. I'm not saying it doesn't suck
| ass, another piece of software we replaced is all web-
| based (albeit locally-hosted) and strictly inferior to
| the end-of-life Java-based software it is replacing.
| software kinda just keeps getting worse, and the further
| stratification of everything into SaaS is definitely not
| good in the long run. but... that's the current state of
| things everywhere, so why should government be any
| different?
|
| if this bothers you about public schooling in particular,
| then the solution (which I'll likely be doing, but not
| for this reason) is homeschooling your kids. then their
| data is only stored in the district database and only
| transmitted to and from the state and local governments,
| for reporting purposes.
|
| but more broadly speaking, what's the use in calling out
| governments transmitting personal information to
| corporations when corporations are already taking so much
| of your data themselves? I bought my fiancee a hat with a
| soda logo on it last week and she was getting ads for
| that specific soda the next day. how it happened, I have
| no idea. shortly after I moved back to my hometown, I
| picked up some groceries for my mom _using her credit
| card_ , including a can of Red Bull I got for myself, the
| first I'd had in months. later that day, ad for Red Bull
| on my social feeds, first I'd seen... in months. whenever
| I buy booze, I get (different) booze ads on Twitter for
| days--when I don't buy any booze for awhile, the ads
| stop.
|
| there's already so much personal information being
| trafficked between corporations everywhere without our
| consent, what makes the government sending it to
| corporations for legitimate purposes so specifically
| offensive? maybe I'm being too cynical but it seems like
| the genie's just kind of out of the bottle now for
| personal data in general. TFA is sticking a finger in one
| of many finger-sized holes in the hull of a ship which is
| sinking mostly not due to the finger-sized holes but to
| the person-sized ones that we're just kinda ignoring.
| clairity wrote:
| not trying to be mean, but it's one thing to acknowledge
| the status quo, and another to acquiesce. that's exactly
| how we collectively slide into decay and corruption.
|
| homeschooling might fix the short term, but it helps no
| one else and probably not your kids' long term. speaking
| up, debating alternative solutions, supporting better
| legislation, even making your own job harder will help
| you and all your neighbors in the long run. we each need
| to call out governments and corporations for their
| misdeeds, all the time, whenever we see it. being a
| citizen is a responsibility, not a right.
|
| (also, i don't see ads and don't give data willingly to
| the likes of google)
| dragonwriter wrote:
| > i'd love to see a constitutional amendment explicitly
| separating corporate interests from governmental ones
|
| How is that possible, since corporations are, by definition,
| creations of government through law?
| clairity wrote:
| i mean, that's like asking how is it possible to
| compartmentalize anything. as elaborated elsewhere, it isn't
| about literally separating all interests, just those that
| harm the public. it's about removing the negative externalies
| that companies like google impose on us via such government
| contracts.
| ta_5628952 wrote:
| > just those that harm the public
|
| But it's not that simple. What harms the public? Many would
| argue being able to use data google collects (legally
| through subpoenas or grey-legally through any of the number
| reports that have come out since Snowden) helps government
| agencies by increasing public security--thus the opposite
| of harm. Being
| clairity wrote:
| in that case, it's pretty simple. the snowden leaks
| elucidated the government's desire to create a
| surveillance state with the help of corporations, not
| that a surveillance state would be a net-good for
| society.
| throwntoday wrote:
| I agree 100%. I have nearly all google domains blocked in my
| hosts file and was frustrated to find out google captcha was
| required on a few government websites. I understand rolling
| your own can be difficult or expensive but it's the government
| we're talking about here. They're no strangers to spending.
| skrebbel wrote:
| FWIW I think the "church and state" analogy is genius, it
| totally resonated with me. I'm going to steal that!
| abarwick wrote:
| This is just naive. Government offices/agencies are so tightly
| coupled with packages like office 365 that forcefully
| separating them would require home built solutions which would
| always be terrible, less secure, and more expensive to the tax
| payer. There's a lot of good these products can provide,
| granted they are properly audited and have high security
| requirements.
| einpoklum wrote:
| > are so tightly coupled with packages like office 365
|
| Are they though? Do you know this for a fact? I mean, sure,
| MS Office is very popular in government settings, but does
| this really go beyond the possibility of just replacing it
| with LibreOffice if they so decided?
| TurningCanadian wrote:
| Sharing a link to a document that others can edit in the
| cloud is much more convenient than emailing around a
| _final_v3(2).docx document.
| einpoklum wrote:
| Well... there's Collabora online:
|
| https://www.youtube.com/watch?v=xbQFTkFaYlo
|
| or Box/DropBox/other cloud storage services, which is
| less convenient than proper collaborative in-pace
| editing, but you can still get the file at the link, edit
| it and upload it.
| abarwick wrote:
| I obviously can't speak for all, even most, but back in my
| consulting days I can say the many US federal and state
| agencies use Azure AD and a litany of AWS services that are
| core to vital work streams. Enough that having to shut them
| down would neuter the department.
| oska wrote:
| > Enough that having to shut them down would neuter the
| department.
|
| You've just identified one very good reason that they
| shouldn't be dependent on a single, _proprietary_ vendor.
|
| Really, I was surprised to find your original comment on
| Hacker News, especially with you ironically fronting it
| with calling other people naive.
| daniel-cussen wrote:
| Russia has that. Just typewriters and stationary.
| jcelerier wrote:
| Idk here in France there are cities and state-wide
| administrations with free/libre stacks based on Linux,
| LibreOffice, Zimbra and others and things seem to
| JustWork(tm). For instance the french Gendarmerie, the cities
| of Rennes and Arles...
| spoonjim wrote:
| Are there any high functioning large companies that use
| Linux/LibreOffice/Zimbra? I suppose governments rarely
| aspire to be high functioning.
| quadrifoliate wrote:
| Using Libre Office rather than Office 365 is unlikely to
| be the limiting factor in how fast anything in a
| government office is going to run.
|
| In fact, I bet you that a major part of the delays in
| Government are because Tom from IT needs a sign off from
| three separate people to get a new Office 365 license for
| Brenda in accounting.
|
| With Libre Office you make that a thing of the past.
| zhte415 wrote:
| > Tom from IT needs a sign off from three separate people
| to get a new Office 365 license for Brenda in accounting
|
| That's unlikely, and if so I doubt Libre Office would
| liberate Brenda. It may be the reverse. On-boarding or
| moving Brenda between functions would mean provisioning
| her for internal ID, identity, email/communication,
| security, network/group access and permissioning,
| physical device(s), etc. Various parts of Microsoft 365
| would just be part of the checklist and deployment, an
| integral part.
|
| Microsoft make the above very smooth. I don't think
| someone slapping Libre Office on a PC makes any of that a
| thing of the past. Any realistic alternative needs to be
| all the way down the stack.
| hutzlibu wrote:
| "Using Libre Office rather than Office 365 is unlikely to
| be the limiting factor in how fast anything in a
| government office is going to run."
|
| Depends. When odf would be the standard maybe, but it
| isn't. Standard is microsoft office, and libre office is
| not 100% compatible. But you will still have to deal with
| lots of microsoft documents, from all the other agencies,
| ordinary people, companies, ..
|
| Meaning, when Munichs government tried to switch to oss a
| few years ago, they did indeed lost a lot of time with
| broken documents, templates, layouts etc. so they
| ultimately switched back (direct microsoft lobbying with
| even Bill Gates getting personally involved might have
| played a role, too).
|
| So I am all for an open standard, but this easier said,
| than done.
| PontifexMinimus wrote:
| > Standard is microsoft office
|
| Then change it. By law if need be, and have all
| government departments go over to Libre Office at the
| same time.
| eggsome wrote:
| They tried that, but the question is how do you write the
| law? In the end they settled on requiring that govt.
| departments use ISO standards to store docs (which at the
| time was only ODF).
|
| Microsoft then tried to get their format ratified as an
| ISO standard. But everyone complained that their spec did
| not actually specify how to implement, instead it said
| things like "In accordance with output from Word 2007".
| So after a bit of back and forth MS realized that they
| did not want to _actually_ document what they were doing.
| The solution? Pack the committee with MS shills to vote
| yes on every proposal by MS. Urgh.
|
| One of the negative flow on effects was that these new
| committee members only cared about voting for things that
| MS had instructed them to vote on - so other standards
| and issues stalled due to a lack of a quorum. It was
| super disappointing looking at this from the sidelines at
| the time.
|
| Here is a link that explains a small part of the history:
| https://www.infoworld.com/article/2618153/how-microsoft-
| was-...
| PontifexMinimus wrote:
| > but the question is how do you write the law?
|
| I would have defined Libre Office as the reference
| implementation. Other software is allowed to the extent
| it reads/writes those files formats correctly.
|
| I would also have mandated open source.
| hutzlibu wrote:
| Well, that is one solution, but I would not want to have
| a urgent problem at that specific time.
| Melatonic wrote:
| I haven't had any issues with Libre Office in years. They
| even have a paid corporate version with (supposedly) good
| support.
|
| What I have had more incompatibility issues with is
| Gsuite (or whatever Google is calling it these days)
| which a LOT of medium sized businesses and school are
| using now as an office alternative.
| pyrale wrote:
| Arles is getting suckered by Microsoft, sadly [1].
| Unfortunately all it takes is one idiot to get in office
| once to kill this kind of successful initiative that has
| been running for almost two decades.
|
| [1]: https://larlesienne.info/2022/02/22/la-municipalite-
| de-carol...
| clairity wrote:
| ah, the _ad hominem_ , never a good sign for the proceeding
| argument.
|
| there are a number of other office suites that are entirely
| adequate for bureaucratic organizations to build methodical
| processes around (which is what bureaucracies do). the
| capabilities of the underlying tools don't matter much in
| this regard.
|
| also, audits aren't meant to prove anything (like security),
| but instead to shift liability.
| scarface74 wrote:
| The average large organization uses over 100 SaaS products
|
| https://www.statista.com/statistics/1233538/average-
| number-s...
|
| I would love to see you replace all 100 of those with open
| source software.
|
| Have you ever dealt with large technology migrations?
| quantum_magpie wrote:
| And if no one does anything, in 5 years it will be a
| 1000, in 10 years 5000. As it is right now, the only
| voice governments hear is that of corpos, and corpos want
| to preserve the influence of corpos. That's why we need
| to force the ban on corpo influence. I'd rather pay 1%
| gdp for a one-time migration to open and free software
| than pay .01% gdp per corp per year.
| scarface74 wrote:
| Are you going to also train staff to use the new open
| source software? Where is the open source SalesForce
| equivalent? Workday? Concur? Device management? Email
| service? ServiceNow? Time tracking? Photoshop? Are you
| going to also force every employee to use Linux instead
| of Mac and Windows? Are you going to tell them to rewrite
| all of their software and business processes written on
| top of Oracle and SQL Server? Should they also rewrite
| all of their bespoke mobile apps to support open source
| mobile operating systems? Are you going to migrate all of
| their Office documents and SharePoint? Are they going to
| move all of their project management processes from
| Microsoft Azure DevOps (aka Visual Studio Online)? Are
| they going to move all of their call center software to
| open source? For school systems are they going to move
| their fuel procurement software? Many education systems
| are partially funded by the lottery. Are they going to
| move their backend systems from GTech? Their lunch
| programs payment systems for students use a third party,
| are they going to move that too? Their ATS? LMS? Grade
| tracking software?
| Dylan16807 wrote:
| How long have they been using each one of those products
| on average? How about migrating off at the same speed?
| scarface74 wrote:
| So let's take the lottery systems. Most states including
| mine has been using the same back end for the lottery
| since 1991. Who is going to write the replacement? Who is
| going to audit it? How much is it going to cost to
| replace literally thousand of lottery terminals? And what
| benefit would it be?
|
| I can't think of the name of the company now. But there
| is one company that manage the school lunch programs. Who
| is going to write the software and you have to replace
| all of the hardware throughout the state.
| Dylan16807 wrote:
| So put systems like that at the end of the list?
|
| And they'll require renegotiation or hardware upgrades at
| some point, so use that as leverage to say no government
| entities will buy any more unless they meet certain rules
| about open sourcing and data storage.
|
| But really, if a handful of things like that were the
| only examples that would be wonderful.
| scarface74 wrote:
| So what goes at the beginning of their list and who is
| going to develop and maintain the equivalent open source
| software?
| Dylan16807 wrote:
| > So what goes at the beginning of their list and who is
| going to develop and maintain the equivalent open source
| software?
|
| The beginning is any SaaS that started being used in the
| last 2-3 years. The immediate solution might just be
| going back to what they had before, if the top priority
| is privacy.
|
| As far as open source, the existing companies could often
| be contracted, but if they don't want to open up then the
| government can put out bids or build a team. If entire
| countries want to buy something, they can make a market.
| And that's assuming there isn't already open source
| software that can do the job, because there often will
| be.
| scarface74 wrote:
| So now you want the government to "build a team" of
| competent software engineers and the government is going
| to have to compete with the private sector for talent.
| The average enterprise framework developer in the US
| costs at least 3 times as much as the average teacher.
|
| Now on the other hand, return offers for interns at my
| BigTech company is around $150K. The average salary for
| the superintendent of schools for larger cities is $167K.
| Where is the government going to get the money to compete
| with the private sector?
| Dylan16807 wrote:
| I'm pretty sure the context here was entire countries
| switching, not single school districts. The money is
| there.
| scarface74 wrote:
| In the US, congressmen make $170K a year, the president
| makes around $400K a year. Junior developers at large
| tech companies can make $170K easily in year one or two.
| Senior developers at tech companies make $400K+. Is the
| government going to pay tech workers enough to compete?
| Dylan16807 wrote:
| It could.
|
| Or it can offer tens of millions of dollars for some
| software and see who bids.
|
| Especially when the previous provider would _probably_
| like to get more money selling something to the
| government, even if they have to make changes.
|
| The above poster was willing to pay "1% GDP" for the
| initial migration and for the US 200 billion dollars
| would pay for a lot of development work.
| scarface74 wrote:
| The companies bidding for the work would also be private
| industry. Wasn't the entire idea to remove private
| industry from government?
|
| Do you really think the government has the competence to
| create software? How many decades has the US government
| been trying to modernize the IRS? Do you remember the
| original ACA website rollout?
|
| Not only do you have to hire developers, you have to hire
| project managers, retrain employers, etc.
|
| Are you going to also create data centers to create
| what's available in the public cloud? You need to make
| those redundant across regions, are you going to force
| open sourcing of control plane software?
| Dylan16807 wrote:
| > Wasn't the entire idea to remove private industry from
| government?
|
| I think the main idea was to remove third party data
| storage? With some open source? You can contract both of
| those out, and when it's open source the company doesn't
| have the same kind of leverage.
|
| > Do you really think the government has the competence
| to create software?
|
| It's not like companies are usually good at it either, so
| shrug.
|
| > Are you going to also create data centers to create
| what's available in the public cloud? You need to make
| those redundant across regions, are you going to force
| open sourcing of control plane software?
|
| At that scale, datacenters are cheaper than cloud
| hardware. As for making the cloud software, well,
| billions of dollars can buy a lot. Force shouldn't be
| necessary.
| scarface74 wrote:
| It's not just the hardware, it's building out the
| competencies in house. Companies like Netflix, Disney ,
| Intuit (TurboTax) explicitly decided that it wasn't
| "cheaper".
|
| Google, Apple, Microsoft, SalesForce, Oracle, are not
| good at creating software?
|
| Let's say the government wanted to "leverage" open
| source, do you think they could make a better version of
| ChromeOS than Google?
|
| You also just think throwing money at a problem can
| automatically create software that is better than private
| corporations?
|
| The original poster said:
|
| _i'd support any legislation that booted google, fb, ms,
| adobe, salesforce, and a whole host of other surveillance
| tech companies from any and all levels of government.
| it's literally as important as the separation of church
| and state. in fact, i'd love to see a constitutional
| amendment explicitly separating corporate interests from
| governmental ones, in all facets of civic life (e.g.,
| campaign finance)._
|
| They don't want _any_ private company involved in
| government IT. That means the government has to build
| everything out themselves without using contractors.
| Dylan16807 wrote:
| > Companies like Netflix, Disney , Intuit (TurboTax)
| explicitly decided that it wasn't "cheaper".
|
| Doesn't Netflix only run their metadata servers in the
| cloud? I'm not sure what those other two do.
|
| > Google, Apple, Microsoft, SalesForce, Oracle, are not
| good at creating software?
|
| Did I imply that?
|
| Though we could debate Oracle...
|
| > You also just think throwing money at a problem can
| automatically create software that is better than private
| corporations?
|
| I never said better. But "good enough", in avoidance of
| horrible privacy violations, is a choice I'd approve of.
|
| And open source software usually does quite well when
| given moderate funding.
|
| > They don't want any private company involved in
| government IT.
|
| My interpretation is that if you get rid of the
| surveillance you solve the main problem, as far as
| outsourcing goes. If that's wrong then some of what I
| suggested isn't compatible.
| scarface74 wrote:
| Netflix is AWS's largest customer. They run everything on
| AWS except the CDNs that cache their video that is
| usually collocated at ISPs.
|
| I'm not trying to "appeal to authority". But since we are
| taking specifically about AWS, I should disclaim that I
| work at AWS in the consulting department. That's where my
| perspective about large scale migrations come from. I'm
| not necessarily saying everyone "should move to the
| cloud". I'm more referring to how deeply ingrained the
| commercial sector has always been involved with
| government.
| abarwick wrote:
| Simply training government workers to use open source
| tools would shut down governments for weeks.
| mensetmanusman wrote:
| Then this is a good argument to help convince Republicans
| to get on board.
| rapind wrote:
| 100 SaaS products in one org sounds like a security and
| logistics nightmare.
| [deleted]
| clairity wrote:
| not sure that it's relevant and 'large' is subjective,
| but yes, i stewarded the technology migration of a core
| product suite for a prior employer, which incidentally
| had government agencies as a prominent customer segment.
|
| i'm not suggesting that governments can only use
| internally developed or open-source software, i'm saying
| corporate interests should be firewalled away from
| goverment. so a locally-installed office suite
| incorporating no surveillance tech doesn't have the
| ancillary corporate interests attached to qualify it for
| being firewalled.
| scarface74 wrote:
| You migrated _a_ product. Were you involved in migrating
| the _entire_ infrastructure of an entire state?
|
| Yes, I speak from experience, migrations and
| modernizations are kind of my job.
| [deleted]
| throw827474737 wrote:
| so just assuming you have an overpriced stinking pile of
| sh*t, is this an argument to stay with it forever?
| scarface74 wrote:
| So do you think open source or the government producing
| their own software will be better?
| Jcowell wrote:
| > ah, the ad hominem, never a good sign for the proceeding
| argument.
|
| GP never says that _you're_ naive, but the comment was.
| clairity wrote:
| either way (intent can also be multi-modal), it signals a
| triggered response and is entirely superfluous and
| distracting. it's worth setting that aside, even after
| writing it, and examining the emotional underpinnings
| that led to the response in the first place. we learn a
| lot about our own subconsciousness that way.
| ska wrote:
| >, ... it signals a triggered response
|
| This is, at best, a stretch.
| simonswords82 wrote:
| I have no idea what it is you're trying to say but I did
| laugh that your username is clarity! :)
| clairity wrote:
| excellent, my diabolical plan to rule the world via dry
| humor is working as designed.
| mmanfrin wrote:
| > ah, the ad hominem, never a good sign for the proceeding
| argument.
|
| An ad hominem means using an insult _as the basis for
| rejecting an argument_ , e.g. 'that is wrong because you
| are [attack]'. Saying an argument is naive and then
| explaining why is not an ad hominem.
| clairity wrote:
| arguments can have multiple lines of reasoning, one of
| which can be an _ad hominem_ all by itself.
| lovich wrote:
| A car has multiple parts, but it's still difficult to use
| if you only use/look at each one separately
| clairity wrote:
| if you look carefully, the 3 sentences are disconnected.
| they don't form a line of reasoning.
|
| if it had been starter, engine, and transmission, maybe
| you'd have a point, but instead it's corroded battery,
| door handle, and tailpipe.
| lovich wrote:
| I looked at it carefully, and I'm not seeing what you're
| seeing unfortunately. I interpreted the naive comment as
| a separate summary of their opinion, and then the rest of
| the paragraph was the supporting explanation. He didn't
| dismiss the idea because it was naive, it's the reason it
| is naive is why he was saying it wouldn't work
| jasonlotito wrote:
| Ah, the ad hominem, never a good sign for the proceeding
| argument.
| robertlagrant wrote:
| None of it was ad hominem.
| wutbrodo wrote:
| None of the lines of reasoning were an ad hominem. From
| your other comment[1], it seems like you think "ad
| hominem" just means "being rude to someone". I recommend
| reading the GP comment's description of ad hominem again:
| it means making a logical argument that depends on the
| speaker's personal characteristics.
|
| "You're European, so your argument is biased and wrong"
| is an ad hominem. "Your argument is naive, here's why I
| think that" is not. The latter is logically downstream of
| the argument, while the former is upstream.
|
| [1] https://news.ycombinator.com/item?id=31854644
| clairity wrote:
| no, an _ad hominem_ need not be literal. do you really
| not understand nuance in language? we 're not computers
| operating only on singular data and deterministic
| instructions.
|
| see how those three sentences go together? that's a line
| of reasoning. the subject comment doesn't have that
| throughline. it's disjointed; the parts are only
| tangentially connected.
| lovich wrote:
| But an ad hominem requires that the argument is thrown
| out solely based on the attack against the person. Laying
| out a logical argument against someone's belief, and then
| _additionally_ insulting him based on his beliefs is not
| an ad hominem.
| wutbrodo wrote:
| > no, an ad hominem need not be literal
|
| What on earth do you mean by "literal" here? Ad hominem
| refers to a specific fallacious style of argumentation.
| Being ignorant of the definition and then too stubborn to
| admit it is not pushing back against "overliteralism".
|
| Especially because the rest of your comment (dismissing
| the rest of the argument due to "ad hominem") only makes
| sense if one assumes the correct definition!
| PontifexMinimus wrote:
| > would require home built solutions which would always be
| terrible, less secure,
|
| I disagree. It would be relatively straightforward to build
| such systems on Linux and open source.
|
| > and more expensive to the tax payer
|
| As a proportion of Italy's GDP, the cost would be negligible,
| especially given that this is a matter of national security,
| something governments tend to be keen to spend money on.
| stickfigure wrote:
| > As a proportion of Italy's GDP, the cost would be
| negligible
|
| After how many failed rewrites that never deliver a working
| product?
| ehnto wrote:
| The assumption here seems to be that the government would
| be writing the software, but it would go out to market.
| This would be a fantastic opportunity for a local
| software company to put out something in the space. I'm
| foreseeing more of this kind of thing as data sovereignty
| becomes a more considered issue by governments.
|
| The other undertone I'm getting from this thread is that
| people think America has a monopoly on building software,
| and that's simply not the case. It's not hard to find
| companies doing really good work outside of the US. There
| is also nothing special about Office 365, it doesn't have
| a technology moat, it just has a surmountable
| interoperability moat and a social moat.
| PontifexMinimus wrote:
| Zero. Start off with using the latest Ubuntu LTS. Then
| add stuff as needed.
| Terry_Roll wrote:
| Rubbish, there has been a concertive effort by the US to
| undermine other countries including so called NATO allies in
| order to dominate the world, its been going of for decades.
|
| I refuse to use the NHS here in the UK because of the
| widespread use of Microsoft everywhere.
| alsetmusic wrote:
| I didn't read it as government can't use commercial products.
| Just that the corps couldn't influence politics. But I'm not
| the OP, so I can't speak to what was intended.
| scale8 wrote:
| More around the storing of data. This is why Scale8.com is
| on EU servers...
| throw827474737 wrote:
| less secure? can it get worse than ms, outlook and active
| directory foo? they incepted their own industry around their
| unsecurity, lol.
|
| terrible and more expensive is also a joke, but not as big,
| you still could got to ibm or oracle if you want to pay more
| for less, admitted
| inopinatus wrote:
| The legal and moral question is one of data sovereignty, not
| tools vendor. I suggest the GP comment be read with that
| context in mind.
| ekianjo wrote:
| your whole argument is based on the assumption that
| proprietary software is superior in every single metric.
| thats just patently false.
| itronitron wrote:
| Most developed countries have several offices/agencies that
| already run 'home built' solutions, they just don't get
| talked about much.
| [deleted]
| jacquesm wrote:
| They get talked about incessantly at the local Microsoft
| HQ.
| sam0x17 wrote:
| Sounds like it would create jobs too, that's a plus not a
| minus lol
| tvink wrote:
| "Creating jobs" to inefficiently solve a solved task is not
| a good thing, it is society burning it's tax income. It is
| only good to create jobs when the output of those jobs is
| increased value.
| sam0x17 wrote:
| If there isn't anything generally available that doesn't
| have telemetry, then productivity software w/o telemetry
| isn't a solved task. If you accept LibreOffice and the
| like, then it's a solved task but you'll still need
| someone to manage it, hence job creation.
| the_other wrote:
| Slowing the flow of money out of the public purse and
| into a very small number of barely accountable global
| megacorps and private equity funds, whilst improving the
| employment prospects of the local population, sounds like
| it's worth the cost of repeat work.
|
| Also, nature loves a bit of redundancy. And capitalism
| loves competition. You can't have competition under a
| monopoly.
| cscurmudgeon wrote:
| > . And capitalism loves competition. You can't have
| competition under a monopoly.
|
| And the govt. is the biggest monopoly of all.
|
| Somehow, restrictions against US firms are praised but if
| US imposes restrictions that is condemned (e.g. TikTok).
| the_other wrote:
| > > . And capitalism loves competition. You can't have
| competition under a monopoly. > And the govt. is the
| biggest monopoly of all.
|
| I didn't say shut down the megacorps. Maybe they have
| use; I don't know. What I do know is they're
| unaccountable (like the shit bits of government).
|
| If government had to use open systems, the quality of
| those open systems would improve and compete better with
| the similar commercial ones. The public (and companies
| and other countries) then have a choice between the tools
| from the megacorps and the open tools. The public also
| gains/improves a resource. More competition. Probably
| better for everyone.
| tildef wrote:
| > Somehow, restrictions against US firms are praised
|
| By whom?
|
| > if US imposes restrictions that is condemned (e.g.
| TikTok).
|
| By whom?
| NavinF wrote:
| https://en.m.wikipedia.org/wiki/Parable_of_the_broken_windo
| w
| majormajor wrote:
| How far does "separating corporate interests from governmental
| ones" go?
|
| Can the government purchase a car? Hire a private corporation
| to build a road? Hire a consulting company to check the
| security of their (now-free-and-without-a-support-contract
| FOSS?) computer setup?
| clairity wrote:
| where to draw the line is a fair question in any policy
| debate, and one i'd expect to draw plenty of lively
| discussion. it's pretty clear to me that surveillance tech is
| on the outside of that line, but i'm open to reasonable
| arguments otherwise.
| Noughmad wrote:
| It's actually quite simple. The government can buy things
| services from specific providers, but it cannot force you to
| buy services from specific providers. In other words, it can
| buy BMWs for government use, but it cannot say "you have to
| buy a BMW to enter the municipal office".
|
| The same applies to websites. If a government website uses
| Google analytics, it is essentially requiring you to do
| business with a specific company (in this case Google) in
| order to use a government service.
| inlined wrote:
| And if the government uses Cloudflare or GoDaddy or aws
| it's requiring you to do business with those companies.
| This goal is impossible to achieve with any government run
| service.
| Noughmad wrote:
| No, those do not see any benefit from me visiting the
| site beyond what the government is paying them for.
| Analytics does, they get my data.
| kevincox wrote:
| It's easy. You just need the government to run fiber to
| every citizens house so that the can connect directly to
| the government data center.
|
| Of course some citizens are living over seas so we can
| provide a satellite uplink for them.
| killjoywashere wrote:
| > cannot force you to buy services from specific providers
|
| But government can impose requirements, like TAA compliance
| (1) and SHB requirements (2) on its service vendors,
| forcing those vendors to purchase from a fairly constrained
| number of hardware providers.
|
| https://www.dtra.mil/Portals/61/Documents/Business%20Docs/e
| v...
|
| https://www.afcea.org/site/sites/default/files/files/2-ColL
| i...
| Arainach wrote:
| If the government takes your data and runs an analysis on
| an old IBM mainframe, are they forcing you to do business
| with IBM?
| Phrodo_00 wrote:
| Is this a bad faith argument? I can't see how the
| difference of google having the data vs the government
| (or whatever entity you interacted directly with) is so
| easy to miss.
| l33t2328 wrote:
| Can the government own a BMW bus?
| feet wrote:
| The gov is forcing me to pay the crony corporations through
| taxing me
| jollybean wrote:
| This analogy does not apply.
|
| The gov. is using some service and therefore some citizen
| data is subject to the T&C's and that's it.
|
| If Google were a German or UK company it would be the same
| thing - everyone subject to those T&C's.
| wutbrodo wrote:
| Could you expand on the definition of "doing business with"
| an entity that you're using here? It seems quite non-
| standard.
|
| If you open the door to a govt office, are you doing
| business with the company who installed the doors? If you
| use the toilet, are you doing business with the company
| that janitorial services are contracted out to?
| Levitz wrote:
| No, when you leave that govt office you don't have any
| link to those companies.
|
| When you visit a site with Google Analytics, they still
| have your data after you leave.
| inopinatus wrote:
| The issue (per original article) is one of data sovereignty,
| and I'd identify a sibling concern of adopting open data
| formats.
|
| If those are sacrosanct, the choice of tools vendor matters
| far less.
| takethat wrote:
| anyone runs self hosted matomo/piwik instance for analytics?
| scoutt wrote:
| I wonder what will happen with websites that use payments
| integration like PayPal or Stripe.
| hbfdhfdhadfhnfa wrote:
| Meanwhile, COVID-19 certificate app for Czech Republic citizen's
| uses Google Analytics. We are not the same. Good job Italy!
| lmkg wrote:
| This is consistent with decisions from the Austrian and French
| data protection authorities (DPAs). Note that Google is a
| _Processor_ (for this product), meaning that Google itself does
| not violate GDPR, but only the websites that use it.
|
| Following the Schrems II case, the "threat model" used by EU
| courts on these matters is "American law enforcement can serve a
| warrant to American companies." Long story short, any processing
| that Google does _after collection_ is not considered to offer
| any protection, because American law enforcement can just tell
| them not to do that and they won 't. Hence, the "Anonymize IP
| Address" setting in Google Analytics is not considered to have
| value for GA.
|
| It might theoretically be possible to use GA compliantly by
| proxying data through an EU-owned service which obfuscates
| anything considered personal data, at minimum the IP address and
| various cookie values. This scenario hasn't been confirmed by
| anyone as compliant, but the regulators seem to always go out of
| their way to dance around it rather than just saying "GA is non-
| compliant, always, forever." Still, for the trouble to set up
| such a service you might as well just stand up a self-hosted
| first-party analytics solution.
|
| This particular decision on GA is purely about the cross-border
| transfers, and doesn't seem to touch on whether using cookies for
| analytics requires consent. That's a separate issue (technically
| about a separate law).
| V__ wrote:
| > meaning that Google itself does not violate GDPR, but only
| the websites that use it.
|
| This is so baffling to me. Google has subsidiaries in the EU.
| The fact that it's ok to give a product to a EU client which
| can't be used in accordance with the law, and the client is
| responsible, is just idiotic.
| humanistbot wrote:
| To be compliant, Google can just set up data centers specific
| to GA in one of those EU subsidiaries, so GA admins can
| choose to have their visitors' data stored only in an EU data
| center (and promise to not transfer that data to the US).
| This wouldn't be that hard to do.
| nisegami wrote:
| It really makes no difference where the data is stored once
| it's accessible by a US company:
|
| "The CLOUD Act primarily amends the Stored Communications
| Act (SCA) of 1986 to allow federal law enforcement to
| compel U.S.-based technology companies via warrant or
| subpoena to provide requested data stored on servers
| regardless of whether the data are stored in the U.S. or on
| foreign soil."
|
| from https://en.wikipedia.org/wiki/CLOUD_Act
| shadowgovt wrote:
| Building out the infrastructure necessary for Cloud to be
| compliant with region-stored data was a multi-year project.
|
| Huge swathes of Google's architecture (especially its
| legacy architecture) have deeply-ingrained location-
| agnosticism assumptions. It turns out to be extremely
| complex and expensive to remove those assumptions given the
| way Google handles data once it hits their datacenter
| fabric.
|
| (Not impossible, mind, just that this assertion that it
| wouldn't be that hard to do is in "I could build Twitter in
| a weekend" territory).
| robin_reala wrote:
| It's coming up to a decade since Schrems I, six years
| since GDPR, and four years since enforcement of GDPR. For
| a company like Google the writing has been on the wall
| for a lot longer than a weekend. They've simply been
| gambling that they can get away with it, and now that
| argument is collapsing.
| shadowgovt wrote:
| Oh, no doubt. They've 100% been gambling that they could
| get away with it. The GDPR has deviated increasingly from
| what their leadership assumed would be a reasonable
| position (it continues to drift from the American
| centroid belief on who owns what data; for Americans, the
| notion that you can use other people's computers without
| them keeping records of how you used their computers is
| kinda weird, and Americans lack the direct historical
| experience to have the kinds of concerns about mass-
| citizen-tracking that Europe does).
|
| My prediction is that as things move forward, they're
| going to find it isn't worth their money to offer
| Analytics for European customers if the GDPR continues to
| make that more onerous (especially since the monetization
| story of Analytics for Google is so threadbare) and just
| offer it for customers in other countries while Europe
| does its own thing. Win-win.
| openplatypus wrote:
| As mentioned by other commentators, this is not enough.
| Schrems II ruling exposed the risk here. If servers are in
| EU but are undereffective control (even via proxy) of
| country with inadequate control (US, RU, CN), then you
| can't use data location as argument.
| MrQuimico wrote:
| The problem is not only the geo location of the
| datacenters. As long as these subsidiaries are under the
| control of a USA corporation, this is illegal, since the
| USA corporation can be requested by the USA gov to share
| any data they may have not matter where it's stored. Only
| options are a 100% GDPR compliant solution (European or
| from a country with similar laws) or self-host. Hopefully
| another Privacy Shield like agreement will be in place
| soon.
| ClumsyPilot wrote:
| > another Privacy Shield
|
| its real name should have been privacy hole
| dylan604 wrote:
| It wouldn't be hard for Googs to do this on their own so
| that they comply with the rules/laws in the markets they
| are operating vs giving it to the end user as an option in
| the configs. Most people using GA probably wouldn't know
| what any of that meant anyways. They just want the numbers
| so their marketing people can tell them what to do next.
| I'm talking the people running sites on Wix type sites vs
| having an actual dev team that can push back against a
| marketing department
| gostsamo wrote:
| No, they can't as far as I get it. The american cloud act
| entitles US law enforcement to serve orders to US companies
| and their foreign branches. So, if you are american with a
| company in the EU, the important part is that you are an
| american, not that the company is in a foreign
| jurisdiction.
| tempestn wrote:
| Perhaps Google could license a third party in the EU to
| host analytics for EU customers?
| gostsamo wrote:
| This is an option. I saw somewhere a news that they might
| license the entire GCloud to a French provider but I
| can't remember where and when.
| ohand wrote:
| You're remembering this announcement from last fall: http
| s://www.thalesgroup.com/en/group/investors/press_release.
| ..
| closewith wrote:
| Yes, specifically the CLOUD (Clarifying Lawful Overseas
| Use of Data) Act, which was enacted following a case in
| 2014 where Microsoft refused to hand over emails stored
| in the EU (Ireland, in that case) on foot of a domestic
| US warrant.
|
| The CLOUD Act expressly brings data stored by US-based
| companies anywhere in the world under the purview of US
| warrants and subpoenas.
|
| https://en.wikipedia.org/wiki/CLOUD_Act
| gretch wrote:
| What about Italian websites that serve customers outside of
| Italy?
| V__ wrote:
| If they serve customers outside the EU, then they should
| comply with those laws or not serve them at all.
| leephillips wrote:
| I don't find it idiotic. It was the client's decision to spy
| on its users. I have no sympathy for companies who make that
| decision.
| V__ wrote:
| > It was the client's decision to spy on its users.
|
| Calling it spying is a little far-fetched I think, when the
| problem was the transfer ip addresses to US servers, not
| Analytics itself.
| leephillips wrote:
| Like most people, I have an IP that is unique to me, and
| will be for weeks, maybe months, until some event causes
| my ISP to assign me a new one. Google can track and
| correlate my activity across all the websites that I
| visit that happen to use GA. In this way they can build a
| profile. If I used Gmail, they could include information
| from the content of my email, which they admit their
| computers examine. With enough data it would be a simple
| matter to detect when my IP changed, and continue to
| amass the profile. If this isn't spying, then nothing is.
| V__ wrote:
| Oh, I think I wasn't clear. I meant saying that the
| client is deciding to spy is a bit far-fetched. Google of
| course.
| rattlesnakedave wrote:
| It was the client's decision to use the service.
| leephillips wrote:
| Which is a decision to spy on the users.
| pessimizer wrote:
| Why do you have to be sympathetic to the client in order to
| also condemn Google? If someone was selling bleach as a
| cure for autism through a network of distributors, do you
| have to be sympathetic to the distributors in order to
| condemn the manufacturer?
| cm2012 wrote:
| Another decision in a long stream that will make it much harder
| for EU start-ups companies to catch up to American ones. With
| absolutely no improvements to actual EU citizen well being.
| realusername wrote:
| That decision is on the US, once the cloud act will be removed,
| those services will be legal again
| toyg wrote:
| Before the CLOUD Act there was the PATRIOT Act, which had
| effectively the same provisions.
|
| These things have not been legal since the GDPR went into
| effect, and in some countries even before then.
| realusername wrote:
| Oh yeah sure, that also would not work with the patriot
| act.
|
| To be compliant with the GDPR, the US needs data laws which
| only affects citizens on their own soil and not
| overreaching to EU citizens.
| hef19898 wrote:
| And we all know that this will never ever happen.
| peoplefromibiza wrote:
| or maybe EU is starring to rely on their own startups.
|
| If I had to chose an analytics software for a customer's
| website, I'd chose someone in EU for the sole reason that it
| would be compliant in both EU and the rest of the World.
| andiareso wrote:
| Yikes... Have you ever heard of some of the alternatives?
|
| I self-host Plausible which is GDPR compliant and gives me all
| of the features that Google Analytics is actually good for.
| There is so much bloat in GA that provides absolutely no extra
| value.
|
| I'm skeptical that this is a bad deal for EU citizens.
|
| [EDIT] missing and
| redleather wrote:
| That's assuming a European GDPR-compliant alternative to Google
| analytics wouldn't arise. But of course it will. It's not even
| a very difficult product to build. If anything this is both
| sticking it to Google and creating opportunities for European
| startups to fill the void.
| arendtio wrote:
| Actually, the cookie layers of Google have become a lot better
| in recent months. I doubt that is was Googles initiative, so I
| think that all this legal stuff is making a difference. Yes, it
| is a very slow process, but what would be an alternative?
|
| Yes it doesn't solve the startup problem, but honestly there
| also also a ton of other laws and regulations outside of data
| protection which make it hard for startups to prosper. Web
| Analytics seems a relatively minor problem.
| baq wrote:
| take data of your USA customers and sell it to the highest
| bidder without their consent or even knowledge as you please.
| don't complain that I have the right to know you do that and
| disagree to you doing that.
| dehrmann wrote:
| Google doesn't really sell user data.
| speedgoose wrote:
| No, it's too valuable. They sell services using the data
| such as Google ads.
| nathanaldensr wrote:
| Maybe a race where the finish line is _maximum exploitation of
| the digital population_ isn 't a race worth running.
| RubyRidgeRandy wrote:
| here I thought maximum exploitation would be selling someones
| identity on the dark web but I come to find on HN that it's
| actually hashed analytics data D: !!!
| MarcelOlsz wrote:
| I wish the internet was purely an informational no bullshit
| interface/store instead of all this crap. I welcome these
| changes. Convert it back into a piece of furniture. Oh no
| we can't make a billion dollars for no reason.
| iLoveOncall wrote:
| waffleiron wrote:
| So lets legalise child labour? Get rid of OSHA?
|
| Where you draw the line is cultural and personal, so don't
| dismiss things like this so easily.
| neuronic wrote:
| Yes, let's all marvel at the accomplishment of making
| everything funded by exploitative and intrusive but largely
| useless advertisements.
|
| All digital startups are literally doomed without the
| indiscriminate collection of personal tracking data.
|
| Side note: thank you modern adtech for consistently
| recommending me products I already bought days and weeks
| before. Very effective. Gullible companies just keep paying
| cold hard cash for these garbage recommendation systems
| because some sales rep talks fluffy about AI and machine
| learning, it's so mindblowing....
| DisjointedHunt wrote:
| The EU hasn't shaken off their roots in monarchy. Using the
| power of the state to go after a single private entity since
| they have a blood feud with said entity and are now finding all
| sorts of excuses to hit them economically.
|
| I've been following the cases with regard to privacy in the EU
| and it's a complete joke. You have all these onerous rules
| against any web technology making it near impossible for
| startups to function without an army of lawyers. Think I'm
| exaggerating? Look up the provisions under GDPR for any
| business, big or small, to set up a website and then process a
| single user request for their data even without sign in.
|
| The UK is sick and tired of this and has recently begun moving
| to ignore these onerous rules. All power to them.
| kcartlidge wrote:
| > _The EU hasn't shaken off their roots in monarchy._
|
| I know, right. I mean obviously the world's most famous royal
| family (our British one) isn't really a monarchy so that
| doesn't count. And they certainly don't get previews and
| vetos on our laws, or given hundreds of millions from the
| licence fees for offshore wind farms, or own a notable
| percentage of the land.
|
| As for GDPR, compliance is pretty straightforward provided
| you aren't being shady to begin with.
|
| And the new UK proposals are much worse and if they go
| through as they stand will be a nightmare for anyone serving
| UK visitors.
| tgv wrote:
| You may be looking at this through a very narrow, heavily
| politicized lens.
|
| First: GDPR is a compromise, so it's a bit uneven. That's
| partly due to lobbying by google and friends. Second, privacy
| very much needs protection. Even if you are perfectly fine
| giving up your privacy, other people aren't. Third: you can
| actually process user requests. Depending on how you do it,
| you don't even have to show a banner. Is that really too
| intrusive?
| DisjointedHunt wrote:
| I mean, before accusing someone of looking at this
| politically, please read the comment fully.
|
| You're taking pains to explain why GDPR is a compromise?
| Why? If it's bad law, it's bad law.
|
| Nothing you said invalidates the assertions I've made.
| Unless you've directly experienced the onerous system of
| regulations in places like Germany, I'd urge you to do more
| research before the armchair dismissal.
| denton-scratch wrote:
| > If it's bad law, it's bad law.
|
| Presumably it's your opinion that it's a bad law. The
| majority of Europeans think it's a good law - possibly
| the best regulation the EU has ever promulgated.
| DisjointedHunt wrote:
| Bad law for the reasons above.
|
| Ie, onerous toward regular businesses Ie, used to greatly
| expand bureaucracy and overhead Ie, used by unelected
| bureaucrats to wage battles of personal vendetta against
| specific companies instead of doing what laws do, which
| is set unambiguous standards for all
| denton-scratch wrote:
| In fact it's not at all onerous, unless you are
| determined to violate it's provisions. If your business
| doesn't depend on privacy violations, then the
| "bureaucracy" that GDPR calls for is trivially easy to
| implement. There are no licences, and no registration
| requirements. Provided you aren't playing fast and loose
| with the personal data of Europeans, you're fine.
|
| There's no "personal vendettas" going on; can you
| substantiate that allegation at all? The GDPR applies to
| everyone equally. And unlike some laws, it's fairly easy
| to read; it's meant to be understood. Don't bother
| reading some biased summary of the Regulation; read the
| GDPR itself. That's the best guidance on the intent, and
| the best guidance on how to comply.
|
| /me: former data protection officer at a web development
| outfit.
| makeitdouble wrote:
| Setting up something like Matomo instead of GA doesn't looks to
| me like a huge penalizing factor for a startup.
|
| If anything, EU startups could benefit from better control over
| the tools they use. One interesting halo effect of Google
| seeing that much data is also that US startup from ex-googlers
| get a head start on many insights.
| herbst wrote:
| I am no EU citizen, however live in Europe and do tech
| startups. I welcome GDPR as well as this ruling.
|
| It's unethical IMO to send personal data to countries that have
| weak privacy laws without making it absolutely clear to the
| user. Which is rarely the case with GA right now.
|
| I switched most my projects to shynet, for me personally that's
| more than enough information and I have zero worries about
| tracking and know that some users appreciate my approach.
|
| Edit:// even before GDPR became a thing I worked with several
| companies who had strict rules about hosting in Europe or even
| more explicit not hosting in the US.
| hnbad wrote:
| Nah. The problem here is Google, not analytics in general. You
| can still use analytics as long as you do it in a privacy-first
| approach.
|
| These laws also apply to US companies offering their services
| to in the EU. Frankly, it's about time American companies get
| reigned in on their privacy abuses. US startup culture has been
| playing fast and loose with people's data for far too long to
| disastrous effects.
| t6jvcereio wrote:
| That's ok, that's our decision.
| jimnotgym wrote:
| Isn't this an opportunity for EU startups? By choosing to
| enforce the law on US companies that EU companies are already
| generally very compliant with, surely the EU has levelled the
| playing field for EU companies?
| jeroenhd wrote:
| I can already see the taglines: "ConsentCo, tracking that's
| legal in the EU, unlike Google Analytics"
| cm2012 wrote:
| A little advantage for EU analytics startups, disadvantage
| for all other EU startups and SMBs who have less options for
| figuring out what users like about their website and
| offerings.
| hef19898 wrote:
| Assuming any of that actually helps to grow revenue, or
| that it is the only way to find out what your users want.
| Plus, GDPR isn't making tracking illegal in general, it is
| just heavily regulating it. If it was just properly
| enforced, the internet would be a much nicer place...
|
| Side note, I'm slowly getting tired of people ignoring
| regulations and compliance simply out of laziness.
| YetAnotherNick wrote:
| So due to this legislations it is more costly/less profitable
| for a company to have a European customer compared to US
| customer. Things like GDPR/lawsuits/bad PR etc. doesn't come
| for free for companies. So if some startup has more ratio of
| European users it is at a disadvantage.
| herbst wrote:
| GDPR is rarely enforced, we are still In a transition phase
| and many who start out choose to just ignore it to a
| degree.
|
| I don't see how it's more costly or less profitable.
| Judging by the amount of lawsuits per capita I think it's
| way more likely to get sued in the US than Europe. And
| guess what's more expensive or complicated for a European
| company?
| AdriaanvRossum wrote:
| It is. Most startups in the EU have to use more and more
| businesses in the EU. The selection is little, so way more
| changes to succeed if your EU based and serve both markets.
|
| I run Simple Analytics [1], which is a privacy-first
| analytics business from the Netherlands. I see a lot of
| business from the EU just because we are from the EU as well.
|
| [1] https://simpleanalytics.com/?ref=hn
| hnbad wrote:
| Frankly, as a EU company (based in Germany no less) I'm
| steering clear of any US SaaS whenever possible. Even if
| they operate in the EU they're usually a legal headache
| because privacy compliance is added as an afterthought and
| they'll often carelessly transfer data to US servers based
| on assumptions that should have been abandoned when Privacy
| Shield was torn down in the courts.
|
| Out of the big cloud providers only Azure feels even
| remotely safe to use (if only because of the privacy
| reputation of Google and Amazon).
| BlueTemplar wrote:
| Wait, why would Microsoft have a better reputation ?
|
| Because (NSA aside), they have been caught less often
| transferring private information and "stolen" company
| secrets to third parties ?
| hnbad wrote:
| Google is an advertising company that is literally built
| on non-consensual data harvesting. AWS is an outgrowth of
| Amazon, which is likewise massively invested in data
| mining (though mostly on Amazon itself).
|
| Microsoft's telemetry in end user products is known to
| tech savvy people but the company is mostly known for its
| operating system and office suite that most businesses
| already use. Additionally in Germany Microsoft used to
| offload its enterprise services to Deutsche Telekom (or
| T-Online I think) operating them for MS under the
| Microsoft brand, thus appearing even more trustworthy by
| effectively handing over control to a well-known German
| company. This changed but reputation sticks.
| suction wrote:
| As an EU citizen, I find it to be a huge improvement to
| detangle my data from US-American entities. Especially with the
| election of Trump and January 6th. Maybe Americans haven't
| fully realized what that meant for US-EU relations for the next
| hundreds of years. The US is just not a politically stable
| country until further notice.
| alexklarjr wrote:
| since when EU became politically stable? Last time i checked
| you were at war with Russia.
| Scarblac wrote:
| Ukraine is, not the EU. The US is at least as involved in
| the war as the EU is.
|
| But I wouldn't call many EU countries very stable either.
| It can still be a win to not send private data to the US
| though, tracking has become far too precise and
| omnipresent.
| [deleted]
| kcartlidge wrote:
| > _since when EU became politically stable? Last time i
| checked you were at war with Russia._
|
| Russia's attack on Ukraine has no relevance at all to
| whether the EU is or isn't politically stable.
|
| There may be other reasons you can cite, in which case fair
| enough, but that example is a non-EU third party attacking
| a non-EU third party. And the EU is _not_ at war with
| Russia.
| alexklarjr wrote:
| EU did everything to start it, established economic
| blockade of Russia and sending weapons to Ukraine. At
| this point it is a war between Russia and EU in Ukraine.
| suction wrote:
| Putin's disinformation really worked wonders on you.
| alexklarjr wrote:
| My opinion is irrelevant, it is what Putin's generals
| think. https://www.aa.com.tr/en/russia-ukraine-
| war/moscow-says-eu-n...
| trasz wrote:
| And? Even Russians don't care about what their military
| believes in - see the hilariously low social status of
| soldiers within Russian society. Why would anyone else
| care? As a reminder, we are discussing whether EU is
| politically stable.
| trasz wrote:
| Blockade and weapons are consequences of Russian
| invasion. Russia started this war.
|
| And yes, unfortunately it can't be allowed to persist in
| its current shape.
| alexklarjr wrote:
| So it is war then?
| trasz wrote:
| What else could it be? Russia already lost more men then
| during their entire invasion on Afghanistan.
| iakov wrote:
| You are demonstrating the level of geographical and
| political knowledge that people expect from americans. I
| hope this is satire.
| concordDance wrote:
| Eh? Jan 6 wasn't very noteable (a bunch of disorganized
| protestors are let into congress, but the state was not
| meaningfully threatened), the US has long had political
| instabilities, the business plot was way worse, but who has
| heard of it now...
| denton-scratch wrote:
| Perhaps those are start-ups that we don't need in the EU.
| xnickb wrote:
| Let me guess, you're from the US and user surveillance is
| beneficial to your business so naturally everyone with non-
| capitalist (read not $$$-centric) ideology is plain wrong. EU
| startups don't have to "catch up" or even compete with US start
| ups.
| skdd8 wrote:
| read this with a french accent for whatever reason >.<
| louhike wrote:
| The CNIL in France is really pushing companies to not use Google
| Analytics, and you better listen to them here. It seems US
| companies should really make changes to how they host/manage data
| to be able to able to work in EU in the near future. (It isn't a
| criticism, simply an assesment).
| f1refly wrote:
| There's nothing US companies can do to make themselfes legal to
| use here. The legal framework in the US allows dragnet spying
| on every non-american and american companies are forced to
| participate in that effort.
| jeroenhd wrote:
| They're perfectly legal if they don't process any PII. If a
| US company serves static content there's no need to fear the
| EU; they'll just have to disable illegal external
| integrations like Google Analytics/Fonts/etc.
|
| A company doing business with other companies might find
| themselves in a position where they can comply perfectly. Not
| every company needs to collect PII, though these days every
| company likes to pretend they do.
| IX-103 wrote:
| When PII includes IP addresses it's kind of hard not to
| process. How else are you supposed to group metrics over a
| session (since cookies are also forbidden)?
|
| This seems to ban third-party analytics by any US company.
| The cynic in me feels this is a little convenient in how it
| advantages EU organizations over foreign ones...
| dx034 wrote:
| Session cookies are allowed if the user agrees. And if
| the user doesn't agree, you have no right to process PII
| to group metrics over a session. That's the big shift
| here, assuming you have a right to build a profile on a
| user (or even evaluate their behavior) without their
| consent is not legal under GDPR.
|
| And as a European, I'm very glad that's the case. I know,
| we're still not close to compliance with GDPR, but it has
| changed the privacy discussion more than any other part.
| koyote wrote:
| Do you have a source on PII including IP addresses?
| walrusfromspace wrote:
| The European Commission's official website[1]
|
| [1] https://ec.europa.eu/info/law/law-topic/data-
| protection/refo...
| tylerrobinson wrote:
| The article says it:
|
| "The Italian SA reiterated that an IP address is a
| personal data"
| denton-scratch wrote:
| > group metrics over a session
|
| How is that something that is essential to providing a
| service?
|
| I suppose that it's somehow "commercially advantageous",
| but there are many other commercially advantageous
| techniques that are simply illegal - such as taking a
| customer's money, but supplying zero in exchange.
|
| A company's profit needs are not an end-run around
| consumer protection laws (which is what GDPR amounts to).
| jeroenhd wrote:
| You don't strictly need automated analytics to sell
| services to foreign customers.
|
| Collecting most if not all analytics is forbidden, for
| sure, but analytics and metrics aren't inherently
| required for businesses.
| la64710 wrote:
| This kind of ridiculous laws do not understand the boundless
| nature of internet. If you want to protect privacy of netizens
| simply make a universal law instead of having different laws in
| different countries.
| adfm wrote:
| Since the Internet is not a fiefdom, universal law is moot.
| Nation states will draft tracking laws that are only only
| enforceable through tracking in an attempt to gain their slice
| of authoritarian pie. Pointing to the Google or US is typical
| strawman BS and gives people a false sense of security because
| they should assume everyone, not just the Google, is tracking
| them. Getting people to own their data is an uphill climb, but
| is ultimately what will curb the negative behavior we're
| witnessing.
| pessimizer wrote:
| Other countries may not want to protect privacy at all.
| Italians are making rules to protect Italians.
| IncRnd wrote:
| How does one "simply make a universal law"?
| tgv wrote:
| I'm afraid it does understand the boundless nature of the
| internet, and it wants the owner of the server to do something
| about it.
| rkagerer wrote:
| These guys are my heros
| corywatilo wrote:
| Italy is the 4th in a string of recent decisions across the EU.
|
| (We're tracking these cases on isgoogleanalyticsillegal.com along
| with details for each.)
|
| Note that it's not illegal to use GA entirely, just illegal to
| use in its default state which transmits PII to the US.
| remram wrote:
| I understand that this is primarily an advertisement for
| Posthog, but if you're going to keep posting it you might want
| to keep it up to date. There are only 4 countries on your map
| and one of them is:
|
| > The Dutch Data Protection Authority warns that the use of
| Google Analytics 'may soon no longer be allowed', after a
| ruling by the Austrian privacy regulator. A definitive
| conclusion is said to come at the beginning of 2022.
|
| At least you removed "the only open source product analytics
| platform" and the Google fonts since the last time a Posthog
| employee posted it
| https://news.ycombinator.com/item?id=29994183
| stingraycharles wrote:
| That is an extremely important nuance which is not obvious from
| the title.
| [deleted]
| tut-urut-utut wrote:
| Most of the people using GA wouldn't be able to set it up
| correctly. I switched my personal site from GA to
| Microanalytics, since I wanted to avoid spending time trying
| to figure out how to configure GA to be conformant.
|
| Google should be the one doing the compliance work. If Italy
| bans some usage pattern in GA, it's Google that should make
| it impossible to configure it in non-conformant way.
| mywittyname wrote:
| It's not that bad: https://support.google.com/analytics/ans
| wer/6366371?hl=en#zi...
|
| The most difficult aspect is dealing with URLs. But a
| company that is large enough to be customizing URLs per
| user, is large enough to make a few JS changes to ensure
| they aren't sending those details to GA.
| throwaway2037 wrote:
| I agree 100% with your second paragraph. I also hope they
| introduce massive "percent of revenue" fines when Google
| "forgets" to ban illegal activity on their (near-monopoly)
| advertising platform. Massive fines has genuinely changed
| the behaviour of sales & trading at global investment
| banks. We can do the same for FAANG and friends.
| minsc_and_boo wrote:
| Isn't it already against Google Analytics' policy to put PII in
| the platform to begin with?
|
| https://support.google.com/analytics/answer/6366371?hl=en#zi...
| rgbrenner wrote:
| Gdpr uses a more expansive definition of personal data, and
| it includes the IP address and geolocation data, for example.
| dudus wrote:
| And to be clear Google Analytics has a setting to
| "anonymize" the IP address which deletes the last octet of
| the address and makes geolocation less accurate.
|
| Then there's an argument that the IP address still reaches
| Google servers before it's deleted. But that's just
| splitting hairs at this point. If Google doesn't process
| the data with IP the IP address I see no harm.
|
| IP addresses are not something that you can choose to not
| send at all. It's kind of required by the TCP/IP stack. If
| that was the case users in EU could not access any website
| in the USA.
| fulafel wrote:
| The GDPR is a product of the Snowden revealed pervasive
| surveillance done by US TLAs. Keeping the data in EU vs
| sending it over to US under assurances is a big hair.
| y42 wrote:
| I guess the difference here is, that I want to visit a
| website in the US versus a tracking request, that happens
| in the background.
| riffraff wrote:
| The press release mentions that partial truncation is not
| considered good enough as google has enough ancillary
| metadata to reverse it.
| [deleted]
| [deleted]
| [deleted]
| [deleted]
| [deleted]
| [deleted]
| lmkg wrote:
| > just illegal to use in its default state which transmits PII
| to the US
|
| As I mentioned in a sibling comment, this is technically true
| but complying with GDPR takes more than unchecking a few boxes.
| I've never seen any GA set-up that would remotely approach
| compliance. At minimum, you need to mask IP's _before_ they
| reach Google, which means standing up a non-Google server to
| proxy all the hits. That is more complexity than 99+% of GA
| installations.
| naet wrote:
| My current understanding of google analytics and GDPR
| compliance is that you can use it in a GDPR compliant manner
| without that much trouble. On the older UA there is a simple
| flag that enables IP anonymization and on the new GA4 there
| is purportedly no need for it as they don't collect or store
| the IP at all.
|
| For many clients I have set up a cookie compliance tool like
| Onetrust, which blocks loading of GA and other scripts with
| one of the consent popups. With this combined configuration
| (and having verified nothing sneaks through before someone
| gives consent) most company legal / compliance teams I have
| worked with have deemed this to be a fully compliant setup.
| Of course, this might not be actually compliant, but the
| company legal team has done some research and arrived at this
| as the most advantageous position currently available.
|
| I think using a compliance based tool like Onetrust also
| gives a sense of legal security in that if our configuration
| is properly set up they are advertising that we then get
| compliance as part of their service, and so responsibility of
| a violation could potentially be passed to them in a legal
| setting.
|
| ref:
| https://support.google.com/analytics/answer/2763052?hl=en
| majewsky wrote:
| > For many clients I have set up a cookie compliance tool
| like Onetrust
|
| Every time I've seen a cookie popup from Onetrust, it was
| obviously illegal because "Reject all" was not the easiest
| option. It's fine if "Accept all" is as easy as "Reject
| all", but nothing is allowed to be easier than "Reject
| all". Have they fixed that yet?
| erikgaal wrote:
| This is actually a setting within OneTrust which has a
| terrible default. We (had to) use OneTrust on
| eurovision.tv, but configured it ourselves to have three
| equally styled options.
| jeroenhd wrote:
| I'm not so sure your take on IP address anonymization. The
| source states: The Italian SA found that
| the website operators using GA collected, via cookies,
| information on user interactions with the respective
| websites, visited pages and services on offer. The
| multifarious set of data collected in this connection
| included the user device IP address along with information
| on browser, operating system, screen resolution, selected
| language, date and time of page viewing. This information
| was found to be transferred to the USA. In determining that
| the processing was unlawful, the Italian SA reiterated that
| an IP address is a personal data and would not be
| anonymised even if it were truncated - given Google's
| capabilities to enrich such data through additional
| information it holds.
|
| The Google documentation says: The IP-
| anonymization feature in Universal Analytics sets the last
| octet of IPv4 user IP addresses and the last 80 bits of
| IPv6 addresses to zeros in memory shortly after being sent
| to Google Analytics.
|
| IANAL but I'm pretty sure the IP anonymization setting is
| no longer an acceptable way of getting GDPR compliance. It
| may have been acceptable under Austrian or French ruling
| before, I don't know about those, but from 90 days from now
| you'll have to explicitly require consent for _at least_
| all Italian users.
|
| As a side note, OneTrust has the worst of the worst cookie
| banners, to the point that I no longer even open websites
| that have that crap installed. It's also illegal by making
| it harder to reject tracking than to opt-in, there just
| haven't been any specific lawsuits about this party yet.
| snowwrestler wrote:
| That Google documentation is for the IP anonymization
| feature of Universal Analytics, which is being sunset in
| about a year.
|
| Google announced earlier this year that Google Analytics
| 4, its successor, does not log or store IP address at
| all.
|
| I don't know whether UA or GA4 service was the subject of
| the Italy case, but I would not be surprised if it was
| UA. Most sites have not switched over to GA4 yet.
| autoexec wrote:
| > Google announced earlier this year that Google
| Analytics 4, its successor, does not log or store IP
| address at all.
|
| So if I go to a website and it has me load code from
| Google's servers it's still got to send my IP address to
| them. I'm not sure why we'd take them at their word that
| they won't keep that data around (I'd like to see that
| independently verified). but it'll be sent to the server
| logs if nothing else. What does not storing the IP
| address even mean? Do they hash it and store that
| instead? Do they do a quick lookup and just flag your
| dossier logging the connection and when it happened
| before dropping the IP info?
|
| If people care about their privacy I think it's probably
| best not to send information to Google in the first
| place. There are alternatives to google analytics after
| all.
| closewith wrote:
| In a privacy-conscious implementation of GTM/GA, those
| scripts can be loaded from a first-party server
| controlled by the company, and Google will never see the
| user's IP address.
|
| There is no real alternative to Google Analytics for most
| companies because of the Google Ads integration. If you
| advertise with Google, you need to send them conversion
| data, which means the GCLID. Without Google Ads,
| switching would be simple. Most enterprises already pay
| for other analytics tools.
| autoexec wrote:
| > In a privacy-conscious implementation of GTM/GA, those
| scripts can be loaded from a first-party server
| controlled by the company,
|
| Thanks! I didn't know that was an option. I haven't
| noticed sites doing it yet at least, but I hope it
| catches on even for sites targeting US visitors! It'd be
| especially nice for government websites using GA.
| denton-scratch wrote:
| > Google Analytics 4, its successor, does not log or
| store IP address at all.
|
| The fact that it receives the IP address at all renders
| it illegal in Italy, and probably anywhere GDPR is in
| force. And IP address truncation doesn't get you
| anywhere; it's Google that does the truncating, so the
| whole address is actually sent to Goo, by which time it
| has departed from GDPR jurisdiction.
| closewith wrote:
| That's a very common implementation of serverside GTM/GA in
| the EU. If you advertise, you'll still be sending GCLIDs,
| though.
| Nextgrid wrote:
| If only ad clicks send back tracking parameters (and
| nothing else) it might actually fall into legitimate
| interest.
| closewith wrote:
| The current issue isn't the lawful basis for the
| processing, as compliant companies already only use
| Google Analytics once they have consent. The issue is
| that without an adequacy decision from the EU to allow
| data transfers to the US, and with the global reach of US
| authorities thanks to the CLOUD Act, there's no way to
| keep personal data safe from US law enforcement.
| [deleted]
| 1vuio0pswjnm7 wrote:
| Here are the URLs for those who disable Javascript (from
| https://github.com/PostHog/isgoogleanalyticsillegal.com)
|
| https://gdprhub.eu/index.php?title=DSB_(Austria_-_2021-0.586...
|
| https://www.cnil.fr/en/use-google-analytics-and-data-transfe...
|
| https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...
|
| https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
|
| NOYB is the primary source tracking these cases and generally
| was also responsible for filing the complaints that led to
| them. All the details are available from NOYB's GDPRhub wiki,
| https://gdprhub.eu. GDPRhub attempts to provide information on
| all the European DPAs including how to file complaints. At the
| least it provides contact info for all the DPAs and English
| translations of DPA decisions.
|
| As stated in 13 Jan 2022 announcement on noyb.eu, these
| decisions are generally the result of the "Max Schrems II"
| decision. After that decision, Schrems filed 101 complaints to
| DPAs, and now the chickens are coming home to roost.
|
| Note that the "legality" of Google Fonts, under the default
| configuration, is also in question. Arguably use of Google
| Fonts is even more widespread than use of Google Analytics.
| digitalengineer wrote:
| Some time ago Google gave EU admins the option to select a
| local regional (EU) server. This means the data is not send to
| the US. But! It's still nog fully legal as the Google HQ (and
| thus the US government( can still access all the data.
| googlryas wrote:
| Why is that not fully legal? Wouldn't the same law prevent
| Google USA from querying PII data from Google Italia?
| digitalengineer wrote:
| If Google US can access the data, that means the US
| government by extension can also. This is exactly what GDPR
| doesn't want happening. More details in this open letter by
| Max Schrems " the Court has clearly held that US
| surveillance laws and practices violate Article 7, 8 and 47
| of the Charter of Fundamental Rights"
| https://noyb.eu/en/open-letter-future-eu-us-data-transfers
| marcosdumay wrote:
| Italian laws do not apply to Google USA.
| lovich wrote:
| The Italian market doesn't have to apply to Google USA
| either.
|
| Companies can always choose to ignore a specific nation's
| laws[1], they don't still get access to that nations
| markets. At the borders the nation state is the one with
| the guns and firewalls
|
| [1] unless you piss off a nation that can project global
| power, lol if you piss off China or America
| justinclift wrote:
| First time I've heard of China projecting "global power".
| Are there cases of it happening?
| dmitriid wrote:
| Apple complying with Chinese laws, and providing Chinese
| government access to private data.
|
| Google, Facebook etc. being blocked in China.
|
| etc.
| psychoslave wrote:
| https://www.wilsoncenter.org/article/china-the-arctic
|
| https://thediplomat.com/2021/08/chinas-presence-in-
| africa-is...
|
| https://www.cadtm.org/Chinese-geopolitics-continuities-
| infle...
| hef19898 wrote:
| All over Africa, in a more heo political sense. Also
| along the new silk road all the way to Europe. Just to
| name two.
| lovich wrote:
| https://www.scmp.com/news/china/article/1714248/more-
| chinese....
|
| Chinese and American police forces both operate abroad
| and like to flex their power. The NYPD was in a similar
| situation post 9/11 when they started trying to police
| nearby states and when they sent operatives to other
| countries even against their own federal government [1].
|
| Russias also sent operatives overseas in some fairly
| public assassinations. It's not really surprising that
| China does this, it appears to be the default operating
| procedure of powerful countries
|
| [1] http://america.aljazeera.com/watch/shows/the-
| stream/the-stre...
| wonderbore wrote:
| Oh yes they do. GA is part of a company that also sells
| services in Italy. They should follow the law if they
| want to keep earning that non-US Adwords money that
| allows GA to remain free.
| connicpu wrote:
| But someone will have to foot the bill when their branch
| in Italy is fined by the government for violating Italian
| law
| googlryas wrote:
| Not generally, but they do apply to Google Italia, who
| would not legally be allowed to respond to requests from
| Google USA for European PII.
| marcosdumay wrote:
| Yes, the Italian law that prohibits sending data abroad
| applies to Google Italia, but Google USA is submitted to
| the USA law, that says that the USA government can
| request any data from Google Italia and they are required
| to get it.
|
| So the existence of Google USA makes Google Italia
| operation illegal.
| baq wrote:
| ...in USA.
| Knufferlbert wrote:
| Well, depends, fundamentally it's a paradox.
|
| Either US company get's the data from the Italian one,
| making the Italian operation illegal in Italy
|
| Or
|
| The US company doesn't get the data from the Italian one
| (despite ownership), making the US company illegal in the
| US.
|
| I don't think anyone is under the illusion that the
| latter option is chosen when push comes to shove.
| kixiQu wrote:
| if anyone is curious about why that gives the govt. access:
|
| https://en.wikipedia.org/wiki/CLOUD_Act
|
| (God willing they repeal it, _even_ if only for the
| international commerce implications...)
| toyg wrote:
| This will never be repealed. It was introduced to
| effectively enshrine a right US authorities have had since
| the PATRIOT Act was introduced 17 years prior, since that
| act had become politically contentious and was left to
| expire.
|
| If anybody seriously thinks US authorities will quietly
| lose a key power after enjoying it for 21 years, I have a
| few bridges ready to be sold.
| kixiQu wrote:
| No one said "quietly" -- but there has to be some
| threshold of backlash that would knock it back. My guess
| is that European privacy law could combine with it to do
| enough impact to large American businesses that they'd
| use their political weight to do _something_ , whether or
| not it were to improve matters from the perspective of
| privacy/sovereignty.
| concordDance wrote:
| > (God willing they repeal it, even if only for the
| international commerce implications...)
|
| It's hard to express how impossible this is. It is very
| very strongly in the state's interest to keep powers like
| this. We're more likely to get communism...
| kixiQu wrote:
| This then comes down to whether you think the US govt.
| these past few decades is better at self-perpetuating
| power or toadying up to the demands of capital. Cynicism
| vs. cynicism!
| DyslexicAtheist wrote:
| something I'm not getting here. If you buy a EU engineered
| IoT home appliance that has PII including, whether a user
| is presently inside their home, then every company I know
| operating in this market uses US based clouds (what other
| options are there LOL) to do things like digital twin or
| device shadows but by using a local availability zone.
|
| So this is very different than GA, but depending on the
| threat-model can be worse. Also very similar metrics can be
| gathered from the data as from a GA cookie (are they
| eating, cooking, showering, watching TV).
|
| CloudAct would (or should) in this case also apply here or
| what am I missing?
| undefinedzero wrote:
| The watchdogs are extremely slow and have a huge backlog.
| You're right that storing that data in the US or without
| transferring ownership to an EU subsidiary would not be
| legal.
| toyg wrote:
| You're not missing anything. A lot of companies just have
| no idea of the legal landscape, or simply ignore it in
| the name of convenience. That's because consumers are
| even more ignorant of their rights around technology and
| don't sue them. It will take a lot of civil litigation
| for this to change.
| spockz wrote:
| I am only aware of Hetzner. (German) The other day I was
| checking out there offerings and I was amazed at how easy
| it is to order a vm. And then it is live the next second.
| It is amazing.
|
| Obviously they don't have full range of services the big
| three have. But maybe just enough anyway.
| xvinci wrote:
| (what other options are there LOL)
|
| It is a hot topic, here are a few: IONOS -
| https://cloud.ionos.com/ Onep Telekom Cloud -
| https://open-telekom-cloud.com/en
|
| But if you want to do scale in Europe you have to go for
| OVH: https://www.ovhcloud.com/en/
| BlueTemplar wrote:
| > what other options are there LOL
|
| This blogpost lists a few :
|
| https://news.ycombinator.com/item?id=27393854
|
| Also, even if no options were available, it's not like
| the law would care - the illegality of it has been
| advertised for years...
| godshatter wrote:
| Presumably the Five Eyes alliance could also mean that
| servers in Australia, Canada, New Zealand, and the UK may
| also be unusable since they share intelligence information
| with the US.
| y42 wrote:
| Like Adobe, who uses tracking servers in the EU, but Data
| Processing happens in the US?
| cavisne wrote:
| The article has the watchdog suggesting exactly that (the
| specific site has 90 days to use GA in a compliant way, no
| direct complaint against GA), so it seems from their point of
| view it's legal.
|
| The title of this post and a lot of the comments are
| projecting what they want GDPR to be (all non european online
| entities banned from doing business in the EU) vs how its
| being enforced.
| sebazzz wrote:
| On the last point: how does that work with cloud computing
| providers, as all the big ones are US-based?
| [deleted]
| ricardobayes wrote:
| Forget anonimized GA, I wonder what regulators would say to the
| likes of Hotjar which even records your screen and can be
| played back.
| mro_name wrote:
| yeah, like 'swimming pools only bear a danger of drowning when
| wet'.
| rightbyte wrote:
| Empty pools are probably more dangerous.
| Forge36 wrote:
| I hear they attract skaters.
| rightbyte wrote:
| Those pools don't have sharp drops and are rather safe I
| guess. I wonder if that is the reason some pools are
| built like that ...
| hnarn wrote:
| That analogy makes no sense at all.
| stickfigure wrote:
| Is it illegal to use my website from Italy? I store PII (and
| everything else) in the US.
| dmitriid wrote:
| No. It's illegal _for you_ to operate in the EU.
| tick_tock_tick wrote:
| I'd be terrified if I was a EU company at this point. There is
| not logically way these same rules don't apply to using AWS, GCP,
| and Azure. There isn't enough other cloud hosting with nearly the
| same capabilities in Europe to handle that day.
| makeitdouble wrote:
| GCP and Azure have options to keep all data within the EU, I'm
| sure AWS has something to at this point. In France GCP is
| approved for public business, so it seems to be working fine.
|
| On your general point, we're way past the point where a company
| is allowed to blindly use any random SaaS without caring about
| what it does with the data or where it goes. The pendulum is
| clearly swinging back.
| 4ggr0 wrote:
| > GCP and Azure have options to keep all data within the EU
|
| I wonder how much of a difference this makes, if the DCs
| still belong to these american companies and this thing
| exists: https://en.wikipedia.org/wiki/CLOUD_Act
| makeitdouble wrote:
| GCP made a few adjustments to have something that is
| compatible with both US laws and the GDPR
|
| https://cloud.google.com/blog/products/compliance/how-
| google...
|
| From memory, gov entities also have deeper customizations,
| and data centers might be separate from customers and the
| standard Google operation altogether.
| hef19898 wrote:
| There seems to be a difference between "B2C" stuff like ad tech
| and tracking and "B2B" like AWS. The latter seems to be more
| eager to be compliant, I assume only to prevent local /
| regional competitors to fill a gap but still. Plus all the nice
| public contracts to be had.
| yrgulation wrote:
| Time to get off my arse and write a self hosted privacy oriented
| analytics tool. Whatever happened to awstats. The question is -
| how to monetise on it?
| tqi wrote:
| 2008-2018: Banking reform
|
| 2018-202?: Data privacy
|
| I wonder what the next trendy thing government officials will
| pretend to care about/fix in order to garner media attention.
| Something crypto related, maybe?
| scale8 wrote:
| This is why we built Scale8.com !
|
| An open-source and privacy-friendly alternative to Google
| Analytics & Google Tag Manager :)
|
| GA is simply not compliant...
|
| https://scale8.com/blog/is-ga-gdpr-compliant/
| tannhaeuser wrote:
| Well HN, how about a badge for links indicating whether it uses
| ga? We have to start somewhere don't we? Or we'll continue to see
| the web decline. Actually, from my PoV, it might be too late
| already. Maybe it's just me or people in EU being harassed with
| banner popups, but I hardly go to any link anymore, and so do
| many other people I know. It's just not worth it.
| ronsor wrote:
| I'm an American, but I occasionally use an EU VPN. I don't
| understand how EU residents can tolerate the number of
| cookie/privacy/GDPR/whatever popups every site has, even on the
| sites of EU companies.
| iLoveOncall wrote:
| We don't. Outside of a few greybeards the vast majority of
| the population would gladly send all of their data including
| dick pics and credit card numbers to remove those popups.
|
| The law was absolutely useless because 99% of the websites
| have an illegal implementation and still added a major
| annoyance in the form of the popup / banner.
| solar-ice wrote:
| My impression is the lawmakers assumed that companies would
| do what they go on about in their blogs and marketing
| material all the time - ensure the best user experience for
| their customers, which they could do by properly complying
| with the GDPR.
|
| Instead, the companies took their masks off and decided to
| beat us over the head with illegal consent popups to trick us
| into believing that a damaged user experience is the only
| possible outcome of the GDPR.
| jokethrowaway wrote:
| We Europeans are generally used to do whatever the government
| tell us.
|
| We don't have the same culture as Americans.
|
| Don't get me wrong, you had a pretty bad deal as well:
| without much fanfare, your government grew up so much in the
| last 200 years that it became the largest employer in the
| world. You pay loads of taxes (even more than several EU
| countries) and get very little benefits.
|
| And yet, I'm sure that if we will get to a political solution
| to the ever-growing cancers that governments are, that
| solution is more likely to appear in the states than in
| Europe.
|
| Europe is a hopeless - albeit beautiful - land. The people
| gave up change 50 years ago.
| trasz wrote:
| >We Europeans are generally used to do whatever the
| government tell us.
|
| As opposed to those who used to do whatever the private
| companies tell them?
| tannhaeuser wrote:
| Err, just to avoid further misunderstanding: I'm pro-GDPR
| ;) and think it's right to confront users with the hydra
| behind the crap on the web. What I think has destroyed the
| web is attention economy, monopolies, the race to the
| bottom, and lack of incentive for quality content.
|
| Agree though that Europeans could do with more
| libertarianism and less trust in state; it's something
| that's been a big issue for me since at least CoVid
| hysteria.
| [deleted]
| aembleton wrote:
| > how about a badge for links indicating whether it uses ga?
|
| Sounds like a browser plugin would be best for this, then all
| links across the web could show it. Or you could just block it
| in uBO and not think about it again.
| butterNaN wrote:
| A bit individualist solution but you can block it with NoScript
| on your browser
| de6u99er wrote:
| 15 years ago Google Analytics was cool. But ar some point Google
| ditched the "Don't be evil" culture and tried to get as much out
| of Google Analytics for themselves, that it became unethical.
|
| As long as they haven't died ...
| olalonde wrote:
| I wish GDPR compliance would have been opt-in. For example, a
| GDPR compliant website could have sent a custom header indicating
| compliance, which the browser could have displayed in the address
| bar (a bit like HTTPS). Consumers would then have been free make
| the decision to not use websites which aren't GDPR compliant.
| Consumers who are more concerned about privacy could have set
| their browser to automatically block any non GDPR compliant
| website.
| eropple wrote:
| _> Consumers who are more concerned about privacy could have
| set their browser to automatically block any non GDPR compliant
| website._
|
| It may not be your intent, but defaults matter and what you're
| wishing for here is de-facto scuttling of the GDPR.
| olalonde wrote:
| Are you implying that the vast majority of consumers aren't
| concerned with their privacy and would keep using GDPR-
| compliant websites? If that's the case, isn't the regulation
| somewhat against the spirit of democracy?
| peoplefromibiza wrote:
| > Are you implying that the vast majority of consumers
| aren't concerned with their privacy and would keep using
| GDPR-compliant websites?
|
| False premise.
|
| Users simply aren't aware, but once they learn about it,
| they become concerned,
|
| > If that's the case, isn't the regulation somewhat against
| the spirit of democracy?
|
| That's a really weird argument.
|
| Anyway, that's _not_ the case.
| closewith wrote:
| Bizarre idea. Should websites be allowed to opt out of anti-
| fraud legislation? Anti-money laundering? Human rights
| protections?
| nnq wrote:
| Yes? ...this was the original dream of non-national
| cyberspace and we almost had a hope at getting it. Then the
| second chance with web3 but this was also spoiled by people
| getting too greedy and too nasty too fast.
|
| A parallel anonymous-and-free-for-all-but-with-payments-
| included, smth. like Tor-but-powered-by-IPFSv9-and-Etherv7,
| will probably emerge in a couple decades done right after a
| couple failed iterations. Some techs need hardware to catch
| up to be cheap enough, and only after a few failed attempts
| they manage to grow a trend... and it will probably will last
| until it's used to finance a proper starting of WW3 and by
| then banning it will be too late.
|
| Anyway, we'll enjoy the hell out of ourselves on the new
| patreons-but-for-snuff-p03n, so it will all have been worth
| it :)
| peoplefromibiza wrote:
| > this was the original dream of non-national cyberspace
|
| cyberspace was about freeing the people and the flow of
| information between people, not the corporations that silo
| the data in their data centers for ptofit.
| Nextgrid wrote:
| > Then the second chance with web3 but this was also
| spoiled by people getting too greedy and too nasty too
| fast.
|
| Maybe the laws & regulations you complain about are
| actually necessary because otherwise people will keep being
| greedy & nasty and eventually outnumber honest people?
| progman32 wrote:
| I believe your argument simply boils down to "laws
| shouldn't apply to people". Am I mistaken?
| nnq wrote:
| Besides the missed irony, I mean that _we need to have
| and we 'll inevitably have a separate internet layer /
| set of protocols / etc. where information will be freely
| broadcastable and exchangeable without enforcement of any
| laws_. We de-facto have it now too, but it's practically
| geek-only hence no real "broadcast" to masses of people
| function can be achieved.
|
| And that once such tech becomes usable by a large percent
| of the general population (by eg. allowing "unsecure"
| websites to "do anything") and we make the mistake to add
| a truly functional and anonymous money transfer
| technology to this layer of information tech, we're
| royally screwed as a species.
|
| I obviously don't want a lawless and free for all
| regular/default internet because on the regular internet
| we exchange real money and we have real identities. I'm
| perfectly OK with having lawless layer of information
| exchange and broadcasting (it's just a natural
| generalization and globalization of "free speech" and I
| think it's crucial for humanity) and even working to
| making them usable by the general population, as long as
| we don't allow any serious kind of money transfer and
| commerce to happen through them. Eg. A psycho posting a
| killing video once a decade is no biggie and would happen
| anyway, let's at least enjoy it / groups of psycho
| creating a market and industry for their "products", not
| ok. Two random guys planning to meet to exchange some
| guns for some money is no biggie and already happens
| anyway; trading weapons on scales to supply real wars not
| ok. Etc.
|
| De-facto "having sites op-out of anti-fraud legislation"
| or of "human rights" protections is already happening,
| and is less obvious because of the centralized nature of
| our current internet. A less centralized internet will
| just allow it to happen in the open in theory. Only it
| won't because since they're already doing other more
| serious illegal stuff and don't want to draw attention.
|
| PP's "Bizarre idea. Should websites be allowed" thinking
| was just funny and ridiculous at the same time: there's
| nothing bizzare, thing are already happening (naturally)
| like this, and ofc it's happening discretely (eg. having
| telegram or other messaging app groups instead of http
| websites but performing similar functions etc etc) and in
| the silence bc ppl doing them do even more illegal stuff
| and nobody wants attention from authority or ppl
| concerned with morality ...and I couldn't help make fun
| of it a bit. It's the kind of guys that argue against
| free speech and yell the "but think of the kids" argument
| at us all the time, and it's tiresome to have to trick
| them all the time since reasoning with them doesn't
| work...
|
| So suggesting that maybe we should bring what's already
| happening anyway in the open, base it on more open
| standards technology, have it be indexable by search
| engines etc. :P I'd rather have a legal:any flag that I
| can add to a google search when I want to go off the
| beaten track then to have to switch the program/protocol
| I'm using (and the browser should make sure as hell I
| don't leak my identity and don't pay for anything on such
| unsafe sites), and _that 's the crux of it, the browser
| would know that a site is unsafe and needs total
| sandboxing simply because the site owner has decide to
| "opt out of the laws" - you realize that longer term when
| s settles down it's a win win situation for everyone if
| you just twist your mind out of the default narrative the
| current tech-corporate establishment is brainwashing you
| with..._
|
| (Or the "let's make a decentralized and truly free
| internet layer" into a real and usable thing... or the
| crypto-crimies will beat us to it and do a version that
| also has payments, generates obvious disasters/wars etc.,
| and then is taken over by big gov and turned to a
| totalitarian nightmare with social credit tracking extra
| features" argument.)
| progman32 wrote:
| Thanks for clarifying your position.
| olalonde wrote:
| No, just GDPR? I don't see any valid reason a user might want
| to "opt out" of anti-fraud legislation but I do see a reason
| why a user might want to access the non-GDPR web.
| peoplefromibiza wrote:
| How would you write such a law?
|
| You can't make exceptions based on what's convenient for
| some business.
|
| Why should GDPR be opt-in but not the consumer minimum
| 2-year guarantee against faulty products?
|
| > ? I don't see any valid reason a user might want to "opt
| out" of anti-fraud legislation
|
| To commit frauds, for example?
| olalonde wrote:
| > Why should GDPR be opt-in but not the consumer minimum
| 2-year guarantee against faulty products?
|
| I also believe that should be opt-in.
|
| > To commit frauds, for example?
|
| Fraud implies an unwilling party, a victim. Not
| comparable at all to what I'm suggesting.
| peoplefromibiza wrote:
| > I also believe that should be opt-in.
|
| But that is irrelevant, we European citizens are happy to
| have it.
|
| And actually fought to have it.
|
| It's a consumer _protection_ law, what you want is
| consumers with less or no protections.
|
| > Fraud implies an unwilling party, a victim. Not
| comparable at all to what I'm suggesting.
|
| I'm quite sure the majority of users visiting a website
| that hosts GA are giving away their data unwillingly.
|
| Would you opt-in theft too?
| olalonde wrote:
| > It's a consumer protection law, what you want is
| consumers with less or no protections.
|
| Yes, indeed. I don't believe the government should
| mandate specific protections consumers should receive,
| because it just serves to reduce consumer options. And
| this is also why I wish GDPR would have been opt in,
| giving more options to consumers.
|
| For example, in a world with no government mandated "2
| year warranty", some manufacturers would offer a product
| with "2 year warranty" and some other manufacturers would
| offer the same product "without warranty", but at a lower
| price.
|
| Consumers would then be free to chose if they want to pay
| the cheaper price without warranty or the higher price
| with the warranty. There are two options for consumers in
| this world whereas in the world with mandated warranty,
| only the "higher price with warranty" option is
| available.
|
| It's the same with GDPR, GDPR compliance has a cost. Some
| websites have started banning EU IPs for that reason.
|
| Of course, the above assumes that consumers are not
| mislead and that transactions are voluntary. Therefore, I
| do think there should be laws against fraud, theft,
| misrepresentation, etc.
| peoplefromibiza wrote:
| > Yes, indeed. I don't believe the government should
| mandate specific protections consumers should receive,
|
| What you believe or not it's completely irrelevant.
|
| In my Country consumer protection is in the Constitution,
| at article 41. [1]
|
| So the government is duty bound to protect the consumers.
|
| Thanks God I was born here and not in olalonde-land.
|
| [1] _Art. 41_
|
| _Private economic enterprise is free. It may not be
| carried out against the common good or in a way that may
| harm public security, liberty, or human dignity._
|
| _The law determines appropriate planning and controls so
| that public and private economic activities may be
| directed and coordinated towards social ends._
|
| > "some manufacturers would offer a product with "2 year
| warranty"
|
| Or, realistically, all the manufacturers would offer zero
| days warranty and only luxury brands would offer life-
| long warranty to people who can afford their products
| (e.g. less than 1% of the population).
|
| Example: Apple, which is not exactly a cheap brand, only
| offers one year warranty in the US, while it's 2 years
| mandated by the law in EU.
| olalonde wrote:
| You have the extra year protection, but you are
| (forcibly) paying for it.
|
| iPhone 13 Pro USA price: 999$
|
| iPhone 13 Pro Italy price: 1250$
|
| PS: In the US, you could probably get that extra year of
| warranty from Apple or from a third party (for like 20$).
| But you don't _have to_.
| peoplefromibiza wrote:
| > You have the extra year protection, but you are paying
| for it.
|
| which anyone understands that is not the same thing.
|
| You can also buy 2 of the same items for redundancy, I
| wouldn't call it "warranty" though.
|
| > iPhone 13 Pro USA price: 999$
|
| > iPhone 13 Pro Italy price: 1250$
|
| The price on Apple's U.S. online store website is before
| taxes
|
| But anyway that's a completely meaningless comparison:
|
| Parmigiano Reggiano in Italy Euro ~10 / Kg
|
| Parmigiano Reggiano in USA $ ~20 / pound AKA $ 44.4 / Kg
| olalonde wrote:
| Of course the price premium is not exclusively due to the
| warranty (probably a good chunk of it is due to import
| tarifs and taxes). But do we agree that increasing the
| warranty period costs Apple more? Do we not agree that a
| business will tend to increase the price of its product
| when the cost of its product increases?
| peoplefromibiza wrote:
| > Do we agree that increasing the warranty period costs
| Apple more?
|
| I don't.
|
| On the contrary, I believe they should thank us for
| encouraging them to make better and more durable
| products.
|
| If I am spending 12 hundred euros on an electronic
| device, the least the manufacturer can do is give me the
| warranty that it won't break on its own before 2 years of
| usage.
|
| Anyway, Xiaomi makes perfectly valid products at 1/3 of
| Apple prices.
|
| Maybe it's not the 2-year warranty the issue here...
| eulenteufel wrote:
| The Venn diagramm of the websites that have a Cookie-Popup
| right now and the websites that would choose to not be GDPR-
| compliant is a circle.
|
| This change would mean most website couldn't be used by privacy
| concious people anymore and that the websites in turn are free
| to track the sh*t out of everyone else. From my perspective
| that sounds a lot worse.
|
| The web is a mandatory part of public live for most people by
| now and it's good and healthy that corporations get push back
| for not respecting privacy.
| kmlx wrote:
| > This change would mean most website couldn't be used by
| privacy concious people anymore
|
| wouldn't the market react?
| Nextgrid wrote:
| The market would only react if people were actually aware
| of the privacy violations. This is what the GDPR is trying
| to address by making data processing require _informed_
| consent.
|
| The vast majority of people (some even on HN) have
| absolutely no clue how advanced the stalking actually is.
| You hear every so often these anecdotes about people
| suspecting Facebook of listening to them; it's actually
| _more_ creepy that the tracking is advanced enough to
| successfully infer conversations without actually listening
| in.
| Traubenfuchs wrote:
| Aren't there like about 100 google analytics clones available
| that do exactly the same thing?
___________________________________________________________________
(page generated 2022-06-24 23:02 UTC)