It's going to be hard when your own hands are tied by legislation but your competitor just does as they see fit.
Also them having the resources to drag out any court ruling for years and years ensures there is no level playing field whatsoever.
So yeah, maybe companies should be called out for thinking they are above the law just because they can afford endless legal battles.
Google Analytics isn't better at anything other than their marketing has convinced everyone that it is a must have. If you believe 100% of the data from GA is accurate, then I have a bridge to sell you.
The problem is that companies with a presence in the US can be forced to break the law of either the US or the EU. It's illegal to hand over the information to the US government, but it might also be illegal not to.
Do you mean, who's stopping them from not collecting personal data? No one, that's the point. If you're not collecting personal data none of this applies and you can serve whatever you want to people in the EU.
If you mean, who is stopping them from handing over data to the US government? That's exactly what this court case is about. They can't conduct commerce in the EU unless they have a mechanism to avoid that, and progressively more strict enforcement gets imposed by courts if they keep trying. (Eventually, presumably being detained if they try to enter an EU country, though I seriously doubt it would escalate that far in practice.)
Only legally for the US. Those processes aren't legal for the EU, so the transfer is illegal (for an EU web site).
The government can always just ask. Very little data in the US is protected.
What about the cookie popups, with the "accept" vs. "more info" choices? Is that legal, then?
In all cases where you see a banner for accepting cookies, the company behind it is doing something nasty to the users. (i have yet to see a counter-example to that)
edit: but you can be required to by law. You're right.
Thanks for pointing that. Don't know how many time have met privacy advocates, etc has made a such a strong point against google, and still embedded youtube video or google font on their site. Is there are github page where one can block all google or fb used domains or ips? Would be very useful!
If you want to get extra fancy you need to also worry about Doh and Dot (encrypted DNS) and hardcoded IP's (mainly for actual applications like mobile apps or smart devices). Encrypted DNS is a great thing but companies also use it to bypass things like pihole or NextDNS by hardcoding their DNS IP into an application and then sending all requests to that IP using Doh and Dot so that the end user has no control.
What you can then do is use any kind of edge router / firewall / networking equipment (virtual or physical) to block all the common DNS IP addresses directly and only allow addresses of your choice (such as NextDNS or other). This way when the application tries to make a connection using Doh or Dot to that specific IP address it ensures that it is blocked and everything must fall back to whatever DNS you have setup (which can also be running Doh or Dot for privacy / security). Some home routers have this functionality or you can setup a pfsense box relatively cheaply to achieve this. Unfortunately I have not yet found an easy / cheap solution for mobile devices if anyone has any suggestions.
Edit: Please note that they seem to have removed the link to Google fonts from the website now.
Are you asking for a repo - for software? Or instructions? Or something to do with GitHub Pages? I may be able to help, but I don't quite follow.
Don't shoot the messenger? I think everyone should have the right to voice opinions and point out problems with products, competitors or not. As long as the claims are factual and not FUD and bullshit. (I'm reminded of fud campaigns made e.g. by big corporations against open source, backed by their own shady fudfactory studies)
If a company can -- without lying or twisting facts -- point out that their competitor's product is dangerous/illegal/unsuitable/{whatever is relevant to me}, I'm all open.
Of course, the line between a fud campaign and plain good old information is sometimes very thin.
The competitor that put up this site appears to be a company that provides analytics that are not centrally collected and analyzed to serve ads across the internet. Their entire selling point seems to be that they do not engage in mass surveillance. Equating this to what Google analytics does (if this competitor's claims are accurate) is a false equivalency.
To me, this is no more objectionable than a foam insulation manufacturer capitalizing on asbestos bans.
The primary problem with surveillance capitalism is when your movement across the entire Internet is gobbled up, sliced, and aggregated for the largest bidder.
Indeed, I really feel that Google and Facebook turned "evil" (whatever that means) when the huge amount of customer data available to them from their own sites was no longer enough, but they demanded on vacuuming up your actions on every single corner of the Internet to add to their already gargantuan piles of dough.
If you see a title, you have no idea it is from a 1st party or 3rd party until you read the article. Or, you could just come to the comments an diatribe away. That's the internet way, and claiming to be morally better than the internet is the HN way.
Checks out - I'm a bot.
It's really hard to make that claim when Google is known for anticompetitive behaviour, including crippling GA competitors [1].
We should probably acknowledge that Google is in the terminal phase where only forced split and divesture will help, and in the meantime, every action from competitors is fair game.
[1]: https://forum.matomo.org/t/adwords-campaign-rejected-for-goo... https://matomo.org/faq/troubleshooting/antivirus-program-or-...
Their product is open source and (assuming the say the truth) keeps the data on the server of the website owner. I would say this is better.
I love that you casually put not being illegal on the same level as a dashboard or a convenience feature.
Then again, even though this is google, I'm not big on localized countries attempt to create laws that dictate the behavior of the internet as a whole, admittedly this is a different issue.
After you click to the article, again there's no indication until you scroll to the bottom (after you've already read or skimmed the site). This is deceitful. Furthermore, it doesn't really follow the spirit of ShowHN, which is supposed to link to a tool that people can try out.
You're right that marketing can be helpful, but introducing your company through a bait and switch is a major red flag. This post could've easily been presented honestly: "Show HN: Host your own analytics data to comply with GDPR - posthog.com" or something along those lines.
I assume companies that try stuff like this don't even realize the negative feelings such a campaign can engender. They probably see thousands of new visitors to their bogus site and call it a success, all the while not even seeing the thousands of people who saw this deceptive tactic for what it was and have now filed "PostHog" in their mental file cabinet of dishonest companies.
> The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022.
As for the Astria ruling, this is part of it:
> The fact that Google LLC argued that Google Analytics was allegedly provided by Google Ireland Ltd since April 2021 was not considered relevant, as the violation occurred in August 2020.
So it might be illegal to have used GA before April 2021, but it very well might now be legal given that GA is now provided by 'Google Ireland Ltd', which was a move explicitly done by Google to comply with GDPR.
That page explicitly notes that cookies aren't sent and these requests aren't used for the ad machine. Is using Google Fonts at all the issue just on the chance they're using IP address matching for ads/is them having your IP too much of a risk?
Just dump all request logs in a giant Data Lake - seems like promotion material idea. (sarcasm).
Yes, it says this.
> aren't used for the ad machine
No, it doesn't say this.
We'll probably try it anyway, to be honest, but I'm not crazy about this type of advertising.
There is so much room to beat Google Analytics on UX alone. Is this really necessary?
I don’t for a second think Google would hold back if their own behemoth was in under mortal threat and their main competitor had been found guilty of illegal acts.
The invisible hand of the market (fwiw) relies on free flow of information. Educating the public about Google’s illegal acts is an act of service, though self serving.
In fact, given the state of regulatory capture, it’s a public service to educate consumers locally about how a competitor’s actions are perceived abroad.
It has been more than 3 and a half years since GDPR was implemented, yet it took concentrated efforts of non-profits and individuals to come to this extremely obvious interpretation that EU–US Privacy Shield is nonsense.
Maybe if EU and member countries actually made any enforcement efforts, a viable competitive space would emerge.
> Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.
Google Analytics is not a good product if it can't legally be used. The competitor in this case is offering a better product because it can legally be used.
This isn't very convincing.
In industries that don't successfully self-regulate we get politicians that force a regulation in order to have good product out compete bad ones. It is especially common with lemon markets where information asymmetry between buyers and sellers is a significant reason of good products being unable to fairly compete with bad ones.
The value of personal information is a notoriously lemon market where the buyer, ie users, are not aware of the actually cost to themselves or to whom they are selling their information. One of the first requirements in GDPR is fixing part of this by forcing companies to disclose to whom the information is sent to. Secondly it partially address the cost aspect by forcing companies to disclose how the information get used and thus what the real cost to the user is. A bit like how banks need to disclose what the interest of a loan actually will be before the consumer signs the contract.
What makes privacy issues an even bigger issue is that the cost is not carried by the party who decide and benefits from the choice of analytic software. This is similar to environmental issues where the cost of a decision is not carried by the company that made it, but rather by those around them. Environmental issues is a typical example where self-regulations do not seem to work, as the end consumer has no information if a certain clothing item is made from child labor or by a eco friendly operation. A regulations job there is to put down some minimum standards that everyone need to follow, including information disclosure so that end users can actually know what they are paying for and how much.
As it is, it's very difficult to tell if something you're using is gathering data that you don't intend to gather (e.g. your hosting provider logging IP addresses for your hand-coded blogging software). I don't want to have even the tiniest possibility of being on the receiving end of one of those theoretically huge GDPR fines just by self-publishing some code and putting it on the internet.
It's just that website creators were defaulting to "just use Google Analytics" because it's convenient and they didn't care about their user's human right to privacy, and were thus externalizing human rights violations onto them.
The government is simply preventing externalization of harm, which even libertarians will agree if the governments job (of course agreeing on what level of spying is harmful is where the debate will be).
> PostHog is what I always wanted a Product Analytics SaaS to be. Private cloud option so GDPR becomes way more manageable, features built based on direct community feedback, focus on simplicity and usefulness over vanity features...Great job people!
Mmm I dream of [Private cloud options] to make [needlessly complicated government legislation] easy!
Yay privacy, I guess? Just add 3 more needlessly complicated middlemen.
I get what you're saying, but i feel like that's probably a sliding scale of how much people actually care about these things vs how much they want to just easily get things done.
For example, right now my personal website serves the following files, just to get Open Sans working:
/fonts/open-sans-latin.woff2
/fonts/open-sans-latin-ext.woff2
/fonts/open-sans-latin-bold.woff2
/fonts/open-sans-latin-ext-bold.woff2
/* latin */
@font-face {
font-family: 'Open Sans';
font-style: normal;
font-weight: normal;
font-display: swap;
src: local('Open Sans'), url(/fonts/open-sans-latin.woff2) format('woff2');
unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
Furthermore, the characters that you'll want to show on your site will also make you write more code, just look at what Google does for Open Sans: https://fonts.googleapis.com/css2?family=Open+Sans&display=s...
Oh, and more styles? Well, be ready to add all of those as well, since most of the fonts out there won't necessarily be variable: https://fonts.google.com/specimen/Open+Sans#standard-styles
In comparison, Google Fonts just lets you choose what you want and copy something like the following:
HTML:
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap" rel="stylesheet">
CSS:
font-family: 'Open Sans', sans-serif;
In my opinion, those sizes should also be readily available in the web UI of Google Fonts, or most other sites that recommend fonts out there!
Why? Because Hacker News does not indicate that the login cookie provided to you with be persistent.
From: https://ec.europa.eu/justice/article-29/documentation/opinio...
> Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be immediately aware of the fact that closing the browser will not clear their authentication settings. They may return to the website under the assumption that they are anonymous whilst in fact they are still logged in to the service. The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case.
I think this situation is much closer to what's going on in the original post. No one's life is threatened, but the letter of the law has been broken.
Would it be tasteful to put up such a site?
I strongly disagree.
First, it's not just the letter of the law which is violated. The basic intent of the law is at odds with the actions of Google Analytics.
Starting with Safe Harbour, Privacy Shield and now the standard contractual clauses, the courts consistently decided that no matter how precisly it is formulated, data is just not sufficiently protected by current US laws to allow sharing.
Also the important difference with Hacker News is that Hacker News violating these rules mostly affects Hacker News itself, while GA violating the rules leads to liability risks for web developers who keep transmitting third party personal data to it.
Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.
All tracking is bad, from Google or not. I understand the "companies need to make informed decisions" argument but I disagree with it, mainly because tracking software is involuntary and it's in the interest of the tracking software maker and the company using it to make it as stealthy as possible.
PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_usin...