Austrian privacy regulator: Google Analytics violates GDPR & Dutch Data Protection Authority warns of possible ban on Google Analytics

[creesch]

Summary

This post combines two news articles from the dutch tech website tweakers, I'll try to reference the articles individually and mention them in the sources.

 

Recently the Austrian privacy regulator stated that Google Analytics is in violation of EU privacy legislation as it sends things like cookie data and IP-addresses to the US and this is not allowed under the GDPR. This is the first ruling as a result of 101 legal charges about data being send to the US. As a response to this statement from the Austrian regulator the Dutch equivalent updated a document about how to deal with Google Analytics stating that in the near future it might be prohibited entirely to use Google Analytics. 

 

Quotes

Note: All quotes translated through deepl so if sentences flow a bit weird that is why.

 

Quotes from the initial article about the Austrian watchdog statements: 

Quote

According to the Austrian privacy watchdog, IP addresses and cookie data are personal data and are therefore not allowed to be transferred to the United States under privacy law, writes privacy foundation noyb. In its defence, Google said it had sufficiently encrypted user data, but according to the Austrian watchdog the measures taken by the search giant are not effective in preventing espionage from the US. 

 

 

Quote

It is the first ruling in one of 101 complaints about data transfers to the US that the Privacy Foundation filed with various European privacy regulators in 2020.

 

Quote

According to Max Schrems, the chairman of noyb, this decision means that companies can no longer use American cloud services in Europe. ''It has been more than a year and a half since the Court of Justice confirmed this for a second time, so it is good that it is now being enforced.''

 

Quotes from the follow up article where the Dutch Authority warns of a possible ban: 

Quote

The Dutch Data Protection Authority warns that the use of Google Analytics "may soon no longer be permitted". It does this after a ruling by the Austrian privacy watchdog. The AP wants to draw a final conclusion in early 2022.

 

Quote

The new text is in a manual for the privacy-friendly setting of Google Analytics that the AP has published. Since Thursday, the regulator has added an update in which it warns that the use of Google Analytics "may soon not be allowed". The AP does this after a ruling by the Austrian privacy watchdog. The latter concluded earlier this week that the use of Analytics is in breach of the AVG, because the tool collects cookie data unnecessarily and sends it to the US.

 

 

 

My thoughts

As stated is mentioned in one of the articles this might influence how US cloud providers can operate in the EU and how data analytics in general can be applied. For consumers I believe this is only good news, certainly within the EU but as we have seen in the past these sorts of rulings often have a ripple effect outside the EU as well as companies do not want to deal with two different implementations. Given that various experiments have shown that you don't actually need far reaching individual tracking analytics to make a profit I'd personally say that this about damn time.

 

If anything I hope this makes companies in general move away from google as the analytics provider as there are good (open source) alternatives that do offer more privacy friendly analytics.  A lot of people will wonder why you would need analytics at all which is a reasonable question if you have never developed software or a website before. The answer is that without any form of analytics you are effectively guessing at how well your product works, what is being used, etc. Asking users for feedback can help there but suffers from things like selection bias. So some form of analytics isn't unreasonable, we just don't need the far reaching tentacles that are google analytics or anything remotely close to that. 

We have had the tools already since the 90s to count visitors to a page, see where they came from, etc so google analytics and the likes always have seen as tools that far overreach what you reasonable need to improve your service. 

 

Sources

https://tweakers.net/nieuws/192020/autoriteit-persoonsgegevens-waarschuwt-voor-mogelijk-verbod-op-google-analytics.html

The mentioned manual: https://www.autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleiding_privacyvriendelijk_instellen_google_analytics_jan_22.pdf

Article about the Austria ruling: https://tweakers.net/nieuws/192002/oostenrijkse-privacytoezichthouder-google-analytics-is-in-strijd-met-gdpr.html

 

[Rauten]

On one hand, I really like this and hope it has EU-wide consequences.

On the other hand, I wonder if this could push Google to outright refuse to provide certain services in Europe, and what the effect of such an action could be?

 

Or it might just turn into one of those "Oh it's forbidden but the economic penalties aren't so big that they're going to bother changing anything", A.K.A., a Google "tax".

[creesch]

13 minutes ago, Rauten said:

On one hand, I really like this and hope it has EU-wide consequences.

On the other hand, I wonder if this could push Google to outright refuse to provide certain services in Europe, and what the effect of such an action could be?

 

Or it might just turn into one of those "Oh it's forbidden but the economic penalties aren't so big that they're going to bother changing anything", A.K.A., a Google "tax".

 

I doubt that the second scenario will happen, the EU simply is too big of a market to ignore. Even if this scenario plays out I actually think it isn't a negative one. As I said there are actually good solid (open source) alternatives available for google analytics that are much more privacy friendly. 

 

The last scenario might happen but that really depends on the what and how. Currently GDPR compliance is being enforced and companies are receiving fines here and there and as it is up to individual companies at the very least it will mean that maybe a minority will ignore these sorts of things and keep using GA but the majority will likely comply and just move to a different product. 

 

[creesch]

Just to give my own thoughts a bit more context. We have had tools like AWstats which predates Google Analytics by half a decade at least. A demo of it can be found here and frankly the data it offers in that version is very similar to the data it offered to me when I was messing with it in the early 2000s. It does this all without placing cookies, without tracking individual users, etc and provides more than enough metrics to get started with website improvements. And I am pretty sure we had similar tools in the 90s. So it isn't as if there are absolutely no alternatives. 

[Rauten]

2 minutes ago, creesch said:

Just to give my own thoughts a bit more context. We have had tools like AWstats which predates Google Analytics by half a decade at least. A demo of it can be found here and frankly the data it offers in that version is very similar to the data it offered to me when I was messing with it in the early 2000s. It does this all without placing cookies, without tracking individual users, etc and provides more than enough metrics to get started with website improvements. And I am pretty sure we had similar tools in the 90s. So it isn't as if there are absolutely no alternatives. 

Sure, they are alternatives for web improvement  - but if you want to know specifically what ads to target against who, you need to dig deeper and deeper and deeper.

And at the end of the day, that's where the money is today.

 

My friends tend to joke about how "smart" Google is, when they talk within earshot of their phones (they have Google Assistant enabled) and then just a short while later, oh me oh my! They get ads for those specific products or services! How could that happen!

They know EXACTLY how that happened, they just don't care.

 

So yeah, I doubt there are any alternative tools right now that can take over the "Big Brother" role of Google.

[creesch]

6 minutes ago, Rauten said:

but if you want to know specifically what ads to target against who, you need to dig deeper and deeper and deeper. And at the end of the day, that's where the money is today.

 

 

It actually hasn't been proven that you actually do need that sort of detailed information on users in order to successfully run ad campaigns and still turn a tidy profit. In fact experiments like this one suggest that it might just be unnecessary overreach. It is mostly companies like Google and Meta that maintain that it is absolutely necessary to track users in that details which makes sense as they have a vested interest in maintaining that image as they are also the only ones that can do this detailed sort of data collection. 

If it turns out that in fact it is quite possible to do the same thing with less invasive user tracking it also means that their role becomes less important which threatens their business model. 

 

So no, from my perspective it isn't as clear cut as it is often presented and the trope of it being needed to make money is more often blindly parroted from Google and Meta rather than actually verified to be true. The latter does make sense though, figuring out if it is actually needed does mean taking a big risk as far as your revenue stream goes. So it is much safer to follow the party line and keep using the current methods available. 

[Chris Pratt]

My hot take: this is further overreach by the EU. By definition, Google Analytics can't be in violation, because the data is anonymous. GDPR covers PII and specifically what can be done with data *tied* to a particular user.

 

GA collects no PII. PII does sometimes end up in analytics data, but that's down to usage by websites in passing in additional data that they shouldn't be. GA3 admittedly doesn't have much control over this in order to explicitly take steps to block it, but GA4 does, and Google will in fact suspend your GA account if they catch you collecting PII.

 

That is actually probably a direct response to legislation like GDPR, but that's all the more to the point: they are complying.

 

These continually moronic governing bodies seem to not be able to understand that a company can't necessarily control everything their users do. They can have terms of service, suspend your service when they do catch you, and make good faith efforts to sus out violations, but it's far too much data to catch everything. That doesn't mean the company is in violation. It means we live in the real world where nothing is perfect.

[Chris Pratt]

Just now, huilun02 said:

Any actual evidence that its actually anonymous and not blindly taking Google's words?

 

This the first time I am seeing authorities issuing a hard ultimatum instead of an easy cash grab by pretending to care about privacy. I am fully supportive as long as it does not get watered down into a fine.

I've used GA since it came into existence on multiple different properties. I know how it works, unlike the Austrian government, apparently.

[Chris Pratt]

9 minutes ago, huilun02 said:

Yeah me too, unlike the Austrian government who can deploy a whole team of specialists to be sure they are not doing something silly. Keep in mind they are not doing this for monetary gain.

Yeah, because politicians motives are always completely pure unless they're doing something for money. I can't speak to what the Austrian government did or didn't do in this scenario, but since politicians are politicians, I'd imagine there was no actual research or investigation, or if there was, they gave a perfunctory hearing to the experts and continued to do whatever the hell they had already decided they wanted to do anyways.

 

The simple fact is that GA does not collect PII. You can look at the base collected data and see that. It does however allow you insert your own data through events, and yes, it's of course possible to insert PII with that. However, that's not Google; that's the website using the service. As I already said, GA4 takes steps to prevent this, and Google is actively suspending accounts that collect PII with GA4. That's sadly part of the reason GA4 adoption has been lackluster; the websites that do this don't want to have to stop. However, GA3 is deprecated and will go away eventually. The GA4 transition is not trivial, so Google has to provide a reasonable amount of time.

 

However, even with just GA3, if the Austrian government has a problem, it's with the individual bad actors using GA, not with Google. It's like suing Facebook because I posted your name and address there. That's not Facebook's fault. It's on me. Going after those websites doesn't get headlines, though; going after an entity like Google does. Then, they can point to that at election time and pretend like they're actually fighting for their constituents privacy.

 

[AlTech]

46 minutes ago, Chris Pratt said:

My hot take: this is further overreach by the EU. By definition, Google Analytics can't be in violation, because the data is anonymous. GDPR covers PII and specifically what can be done with data *tied* to a particular user.

 

GA collects no PII. PII does sometimes end up in analytics data, but that's down to usage by websites in passing in additional data that they shouldn't be. GA3 admittedly doesn't have much control over this in order to explicitly take steps to block it, but GA4 does, and Google will in fact suspend your GA account if they catch you collecting PII.

So GA doesn't collect IP addresses or browser cookie data?

46 minutes ago, Chris Pratt said:

 

 

[CarlBar]

Ughh i had to re-read the entire thread twice before my brain caught up. For some reason i was reading Austrian as Australian and was wondering what the hell Australia was doing weighing in on EU laws. Had me very confused for a while .

 

@Chris Pratt I'd imagine the way the law is written it's google responsibility to not accept data that is in violation of GDPR, not just the websites responsibility to not provide it.

[HanZie82]

This is a good thing, that shit need to be reigned in.

 

[creesch]

13 minutes ago, CarlBar said:

Ughh i had to re-read the entire thread twice before my brain caught up. For some reason i was reading Austrian as Australian and was wondering what the hell Australia was doing weighing in on EU laws. Had me very confused for a while .

 

@Chris Pratt I'd imagine the way the law is written it's google responsibility to not accept data that is in violation of GDPR, not just the websites responsibility to not provide it.

Well according to the Eurovision song festival Australia is part of Europe, so there is that  

[creesch]

58 minutes ago, Chris Pratt said:

Yeah, because politicians motives are always completely pure unless they're doing something for money. I can't speak to what the Austrian government did or didn't do in this scenario, but since politicians are politicians, I'd imagine there was no actual research or investigation, or if there was, they gave a perfunctory hearing to the experts and continued to do whatever the hell they had already decided they wanted to do anyways.

 

 

So I debated replying to you a few times based on previous replies and this remark made me finally reply. I get the feeling you are overly projecting your own biases here, which I am going to guess as based on your experiences with how the US government (doesn't) function. To be extremely frank, we actually have halfway decently functioning governments and government organizations/authorities in most EU countries that actually try to do their due diligence on these matters. Not saying they do a perfect job, but they certainly also don't fit the stereotype you are painting now.

 

Your hot take seems to be one of a rather binary kind. And I just don't think there are many subjects that benefit from binary hot takes at all. Sure, they make things seem simple, but they rarely are. In fact, most things we deal it are pretty complex. In fact, very often they are born out of a frustration of not understanding something. As far as I am concerned, binary statements are the clickbait of discussions and understanding things. Doesn't mean they can't serve a purpose, if whatever you make the statement about is a digression of your main subject it is fine to cut it off with a binary statement to simplify things. But in this case, it more or less seems your entire argument is based around it, which doesn't make for productive or insightful discussion about the matter at all. 

 

 

[HanZie82]

11 minutes ago, creesch said:

 

So I debated replying to you a few times based on previous replies and this remark made me finally reply. I get the feeling you are overly projecting your own biases here, which I am going to guess as based on your experiences with how the US government (doesn't) function. To be extremely frank, we actually have halfway decently functioning governments and government organizations/authorities in most EU countries that actually try to do their due diligence on these matters. Not saying they do a perfect job, but they certainly also don't fit the stereotype you are painting now.

 

Your hot take seems to be one of a rather binary kind. And I just don't think there are many subjects that benefit from binary hot takes at all. Sure, they make things seem simple, but they rarely are. In fact, most things we deal it are pretty complex. In fact, very often they are born out of a frustration of not understanding something. As far as I am concerned, binary statements are the clickbait of discussions and understanding things. Doesn't mean they can't serve a purpose, if whatever you make the statement about is a digression of your main subject it is fine to cut it off with a binary statement to simplify things. But in this case, it more or less seems your entire argument is based around it, which doesn't make for productive or insightful discussion about the matter at all. 

 

 

Yeah i've noticed (a lot) that US people think their politics is the only way.

They dont get the transparency some European country's have.

Thus because they compare it with their own system, makes for weird conversations.

The USA is the only country in the world if you live in it.

Europe is made of different country's so its ingrained to learn other peoples ways

[CarlBar]

5 minutes ago, creesch said:

 

So I debated replying to you a few times based on previous replies and this remark made me finally reply. I get the feeling you are overly projecting your own biases here, which I am going to guess as based on your experiences with how the US government (doesn't) function. To be extremely frank, we actually have halfway decently functioning governments and government organizations/authorities in most EU countries that actually try to do their due diligence on these matters. 

 

Your hot take seems to be one of a rather binary kind. And I just don't think there are many subjects that benefit from binary hot takes at all. Sure, they make things seem simple, but they rarely are. In fact, most things we deal it are pretty complex. In fact, very often they are born out of a frustration of not understanding something. As far as I am concerned, binary statements are the clickbait of discussions and understanding things. Doesn't mean they can't serve a purpose, if whatever you make the statement about is a digression of your main subject it is fine to cut it off with a binary statement to simplify things. But in this case, it more or less seems your entire argument is based around it which doesn't make for productive or insightful discussion about the matter at all. 

 

 

 

I suspect if he is bringing US politics based biases to bear it's more about the "small government" biases that are prevalent in the US based on some phrases from his first post. The US tends to really not like any kind of government involvement or oversight of almost anything, (the more right wing the more extreme this tends to be but it's present even in left wing US politics).

 

The whole "politicians incompetent" view in the US is also a lot more complex than it seems, i'd have to get deep into no-no politics to dig into the details for you but in simple terms the US tends to have a lot of duplication of responsibilities between local and federal entities which tends to lead to a lot of bureaucratic inefficiencies.

[Chris Pratt]

56 minutes ago, creesch said:

 

So I debated replying to you a few times based on previous replies and this remark made me finally reply. I get the feeling you are overly projecting your own biases here, which I am going to guess as based on your experiences with how the US government (doesn't) function. To be extremely frank, we actually have halfway decently functioning governments and government organizations/authorities in most EU countries that actually try to do their due diligence on these matters. Not saying they do a perfect job, but they certainly also don't fit the stereotype you are painting now.

 

Your hot take seems to be one of a rather binary kind. And I just don't think there are many subjects that benefit from binary hot takes at all. Sure, they make things seem simple, but they rarely are. In fact, most things we deal it are pretty complex. In fact, very often they are born out of a frustration of not understanding something. As far as I am concerned, binary statements are the clickbait of discussions and understanding things. Doesn't mean they can't serve a purpose, if whatever you make the statement about is a digression of your main subject it is fine to cut it off with a binary statement to simplify things. But in this case, it more or less seems your entire argument is based around it, which doesn't make for productive or insightful discussion about the matter at all. 

 

 

I do live the U.S. but the things I said are not born of that. I'm not some boob that believes the U.S. is the center of the world. It's actually kind of hilarious some further replies have assumed that to be the case, based on I don't know what. If anyone here actually knew me, that assumption would be ridiculous.

 

I fully understand politics are not the same every where, but when it comes to tech, they are. I'm not ruffling under some U.S. based bias, but the regulation of tech in general by people who are not technologists.

 

Even then, what I said was in response to the specific user I was replying to, and specifically to the assertion that the Austrian government wouldn't do something like this if there wasn't something to it. That is a foolish faith in any governing body and needs to be called out as such.

 

My real point, and the one that still stands, is that GA isn't in violation of GDPR or any other similar regulation, because it doesn't collect PII. The fact that bad actors may collect PII on their own initiative is not the fault of GA, nor limited to GA. Therefore the pursuit against Google here is one born of either ignorance, laziness, or ulterior motives. That bugs me on a fundamental level, despite who the specific characters are.

[CarlBar]

3 hours ago, Chris Pratt said:

Even then, what I said was in response to the specific user I was replying to, and specifically to the assertion that the Austrian government wouldn't do something like this if there wasn't something to it. That is a foolish faith in any governing body and needs to be called out as such.

 

And this is not invoking a US biased view of thing how? A lot of countries in Europe have a populace actually trust their governments on things like this because for the most part they've shown the trust is warranted. No ones immune to screw ups mind, but the trust is in fact warranted in many cases..

[Salv8 (sam)]

6 hours ago, CarlBar said:

For some reason i was reading Austrian as Australian and was wondering what the hell Australia was doing weighing in on EU laws

mate trust me, even we sometimes do this.

[RejZoR]

7 hours ago, Chris Pratt said:

My hot take: this is further overreach by the EU. By definition, Google Analytics can't be in violation, because the data is anonymous. GDPR covers PII and specifically what can be done with data *tied* to a particular user.

 

GA collects no PII. PII does sometimes end up in analytics data, but that's down to usage by websites in passing in additional data that they shouldn't be. GA3 admittedly doesn't have much control over this in order to explicitly take steps to block it, but GA4 does, and Google will in fact suspend your GA account if they catch you collecting PII.

 

That is actually probably a direct response to legislation like GDPR, but that's all the more to the point: they are complying.

 

These continually moronic governing bodies seem to not be able to understand that a company can't necessarily control everything their users do. They can have terms of service, suspend your service when they do catch you, and make good faith efforts to sus out violations, but it's far too much data to catch everything. That doesn't mean the company is in violation. It means we live in the real world where nothing is perfect.

It's not anonymous, not with the fuck ton of data hoarding Google does and can cross reference easily behind the scenes and just lie into everyone's faces that they aren't doing it.

[poochyena]

I fail to see how this regulation benefits anyone.

[SansVarnic]

@HanZie82 There is so much wrong in your comment that I would have to break the no politics rule and others in order to fully explain to you as to why.

 

With that said... All those involved in this topic; The No Politics rule has not been rescinded, please keep to the rules when commenting.

[HanZie82]

On 1/15/2022 at 3:58 AM, SansVarnic said:

@HanZie82 There is so much wrong in your comment that I would have to break the no politics rule and others in order to fully explain to you as to why.

 

With that said... All those involved in this topic; The No Politics rule has not been rescinded, please keep to the rules when commenting.

Just casual observations i made in my life.
I thought i was keeping from politics.
Unless you're talking about a removed message that i cannot remember.

[Neowizard]

Summary

According to a ruling by the Data Protection Authority, using Google Analytics in the EU breaks Court Of Justice ruling against Privacy Shield, meaning that using Google Analytics on EU citizens is illegal.

 

Quotes

Quote

Max Schrems, the lawyer who successfully sued Facebook for privacy violations against European citizens, has scored another victory, this time against Google

Quote

When the Privacy Shield legislation was invalidated ... They were no longer allowed to transfer data of European citizens to the US as this would make data of European citizens vulnerable to American mass surveillance

Quote

Now, the Austrian Data Protection Authority ... has decided that the use of Google Analytics violates the General Data Protection Regulation (GDPR)

My thoughts

I love how the EU is protecting its citizens. With how giant tech companies essentially being invincible to the US gov't, the EU is the only titan in the ring that can actually do something to protect us where the public is unable or ill-equipped to defend itself. Yes, I hate pushing away all those cookie messages, but it's a small price to pay and it reminds that someone's trying to give me back control over my information.

 

I believe Google will find a way around this. They aren't going to give up on Analytics, but at the very least this shows me someone is trying. Try enough, and maybe we'll see more real positive changes (like we did when we got the option to delete our information held by this tech giants)

 

Sources

https://tutanota.com/blog/posts/google-analytics/

[RejZoR]

Took a while... I was blocking this junk forever.