Re:Zuckerberg denies knowledge of Facebook shadow profiles
by TheCoelacanth on Wednesday April 11, 2018 @11:56PM
(#16817853)
That's not going to fly in about a month under GPDR:
1. A standard cookie notice is nowhere near granular enough about different possible uses to qualify as informed consent.
2. I'm pretty sure Google Analytics is just a "processor" rather than a "controller" under GDPR, so much of the onus for following the regulations is still on the person using GA rather than on GA itself. Processors would not be responsible for handling deletion requests from individual; they would just need to make it possible for controllers to handle them. Obviously processors that take as much of the responsibility as possible will be much more attractive service providers for controllers, but the controllers can't just pass the buck to processors.
No. They are asking for permissions (cookies law in the EU) because the GA code works that way. They bundle the consent in the legal text of the cookie notice. Users give consent, everything's fine. Then the site managers send this data over to Google with the GA code. Google applies it's labeling machine to the data, link it to a user with its super cookie tech and finally give an anonymised report to the site's manager.
If the site manager is asked by a user to remove data the standard answer should be something like "we don't have it and so we can't delete it, call Google". Then when a user asks to Google for removal of its data things'll get interesting because Google will be removing a droplet from its ocean of data and a tenth digit will be rounded somewhere.
That's how a site manager who uses only GA/pixel should manage the situation. Proving they didn't leak that private data and aren't using it.