France says Google Analytics breaches GDPR because it sends data to US
- Reference: 1644505070
- News link: https://www.theregister.co.uk/2022/02/10/google_analytics_gdpr_breach/
- Source link:
In a [1]statement this morning CNIL said it "considers these transfers to be illegal," blowing a large hole in French usage of one of the world's most ubiquitous traffic-counting suites.
Precise details of exactly what laws Google Analytics breaches were not explained in the statement. We have asked CNIL for more detail and will update this article if it responds.
[2]
The decision, while only applicable inside France, is likely to be echoed around the European Union: CNIL confirmed it had reached its decision in cooperation with its other EU data protection counterparts – and today's ruling [3]mirrors one made by Austria a month ago .
[4]
[5]
Celebrating the decision, privacy campaigner Max Schrems, whose complaints had triggered the CNIL probe, cheered: "In the long run we either need proper protections in the US, or we will end up with separate products for the US and the EU. I would personally prefer better protections in the US, but this is up to the US legislator – not to anyone in [the EU]."
CNIL's decision found that Google Analytics' operation contravened [6]article 44 onwards of the EU's General Data Protection Regulation. The French agency read the EU directive together with the famous Schrems II judgment of the EU Court of Justice, which [7]struck down the old Privacy Shield transatlantic data-sharing agreement.
[8]
The regulator ordered an unnamed website manager to strip Google Analytics out of his site, giving him a month to comply. It added: "Concerning the audience measurement and analysis services of a website, the CNIL recommends that these tools be used only to produce anonymous statistical data, thus allowing an exemption from consent if the data controller ensures that there are no illegal transfers."
The decision boils down to the US not having EU-style data protection laws preventing secret transfer of personal data from corporations to US law enforcement and spy agencies. Nonetheless both the United States and the political bloc have, until now, [9]fudged the issue by publishing standard contractual clauses that allow commerce to continue while politicians haggle over a permanent solution to the problem.
[10]Privacy Shield: EU citizens might get right to challenge US access to their data
[11]Privacy Shield binned after EU court rules transatlantic data protection arrangements 'inadequate'
[12]Austrian watchdog rules German company's use of Google Analytics breached GDPR by sending data to US
[13]Google fails to neutralize lawsuit that complains Chrome's incognito mode isn't very private at all
Article 44 of [14]the GDPR says "processing should be lawful where it is necessary in the context of a contract" while article 45 states:
Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law.
CNIL's decision reiterates the Austrian finding that automatic operation of Google Analytics (think of all the cookie opt-out boxes which put analytics under the "necessary and not disable-able" heading) does not qualify for the "necessary for the performance of a task" exemption in the GDPR.
Google did not immediately respond to a request for comment.
A lawsuit filed in the US last year alleged that Google Analytics [15]can still track users of its Chrome browser in incognito mode . ®
Disclosure-note
The Register uses Google Analytics, as specified in the cookie notice shown to all you fine folk browsing our digital doings.
Get our [16]Tech Resources
[1] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YgVEvObSrXrAJTT@DdPl0QAAAJQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgVEvObSrXrAJTT@DdPl0QAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YgVEvObSrXrAJTT@DdPl0QAAAJQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679&from=FR#d1e4227-1-1
[7] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgVEvObSrXrAJTT@DdPl0QAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2022/02/03/privacy_shield_progress/
[10] https://www.theregister.com/2022/02/03/privacy_shield_progress/
[11] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[12] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[13] https://www.theregister.com/2021/03/17/google_incognito_lawsuit/
[14] https://eur-lex.europa.eu/eli/reg/2016/679/oj
[15] https://www.theregister.com/2021/03/17/google_incognito_lawsuit/
[16] https://whitepapers.theregister.com/
Also consent not sought
Before taking personal data the GDPR also mandates that the user be clearly informed and their consent sought. This does not happen with any of these things.
Hello El Reg, Google Analytics is loaded long before any cookies are accepted, if at all. As you noted, GA doesn't qualify as necessary.
Yes but you forget necessary is relative, I'm sure El Reg consider it necessary to collect their stats at the expense of its readerships privacy.
I keep Google's analytics banned as it seems website owners can't be trusted.
You joke but I know at least one popular national site which believes google analytics is a necessary for the site to function. The reasoning... it is on their cookies information page as necessary so it must be.
Good.
Fuck Google. Yes I have a Gmail account, but that doesn't mean I want Google tracking my every move elsewhere. While at Gmail & checking the spam folder, fine, but the moment I log out is the moment their need to do so ends.
My browser allows the creation of the GA cookie while I'm logged in, but I manually turn off that capability the moment I close that tab. If I'm not logged in & actively checking my email folders, you have *zero* right to follow me around like a damned stalker.
"But it's in our T&C's you agreed to!" No, I did not. a *contract* is a mutually negotiated instrument, what you've given had zero negotiation prior, no ability to negotiate during, and no ability for the customer to renegotiate after. What it is is a one sided "take it or leave it" form of pseudo-voluntary indentured servitude.
I'll let you know what I'm doing on the Gmail site itself, but nowhere else, any time else, for any reason.
Re: Good.
Very much this.
As to the T&Cs I'll add that the T&Cs I agreed to when I made my Gmail accounts (and that's all I've ever made, I never explicitly made Google or Youtube accounts or anything for their other products), those were all implicitly created when they made or acquired the products. I made my Gmail accounts in the first year it was available (2005 this side of the pond iirc) prior even to the Youtube acquisition and there was definitely a lot less stuff about tracking and data sharing and the likes in there back then. All the changes after that have been made on the basis of "I've altered the deal, pray I don't alter it further" and "take it or leave".
Google can suck it. I will also add that since EU law means that this French verdict is basically valid for the entire EU. ALL EU websites using Google Analytics are now in violation of GDPR until further notice. Possibly El Reg too, since the UK put GDPR into their laws before they threw their toys out of the pram.
Re: Good.
A contract most certainly does not have to be mutually-negotiated, nor are you entitled to negotiate during, not to renegotiate after.
I’ll confidently bet that you have entered into a number of one sided "take it or leave it" contracts - the “leave it” part is the choice you’re generally granted and perhaps feel peeved about missing in this case
Pi-hole
I am told that it blocks GA.
Not verified that yet.
Re: Pi-hole
GA is blocked - as are the ads in Google Search (and whilst shopping in Amazon). Obviously that's largely down to your block lists, but the basic lists Pi Hole ships with should do the trick.
Also good for blocking Samsung tellies sending back unnecessary viewing data.
Re: Pi-hole
Actually, pi-hole does not block the text ads at the top of a search as they are served from google.com. However, it does block http://www.googleadservices.com so if you click on the ad you will not see it. In some ways this is the worst possible outcome as it can leave you with a completely unclickable page of crud when you do a seach. Fortunately, if you run an in-browser adblocker as well and block google.com with that then the ads vanish (at least they do with Adblock Latitude).
Re: Pi-hole
Yes, it does.
And google apis, google fonts, etc
Need to do some setup first; clear the pi-hole logs and then access a page, see what is loading, block it, clear the logs and reload the page. If it fails to load then allow one bit until it loads......
It's amazing just how much unnecessary junk is loaded by each page.
To be honest
I'm surprised it has taken this long. All that juicy tracking data being slurped to the US where it is aggregated and sold on to the highest bidder, with no way for the subjects to have any say about it.