They're decisions by the governments of Germany, France, and Italy:

* https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/

* https://www.cnil.fr/en/use-google-analytics-and-data-transfe...

* https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...

So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data.

The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US.

Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.

Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!

I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others

How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?

No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.

> Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses

Because you "could" be logging visitor IP addresses? First, why would you have to log them? Is this a legal requirement in the US? You can't serve a page over HTTP unless you log a crapton of stuff for the government? And second...I don't believe it's illegal to log IP addresses under GDPR as log as the user consents to it...or is it?

Yes, the EU says it's illegal if you could be logging them, regardless of whether you are or not.

And yeah, it's not illegal if a user consent to it, but the issue is that the user has to connect (with their IP address) to give you his consent or not. That's why I said theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.

> Yes, the EU says it's illegal if you could be logging them, regardless of whether you are or not.

Wait, what? Where do they say that?

> That's why I said theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper

Why would you do such a complicated thing?

US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.