Hacker News Reader

Comment by V__ | Hacker News Reader

> This has been particularly relevant as Google, following the first Austrian decision, has begun to provide additional settings in relation to what data can be collected by the tool. However, our conclusion is that the tool cannot, without more, be used lawfully.

Even though Google has branches in Europe, again the website owners will get in legal trouble and not Google for offering a product which cannot be used legally.

Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?

View on HN

Its easy to buy car parts online that are illegal for road use. Same concept applies - you can build whatever kind of car, or website, you want. But there are rules about how that car or website must be used when around the general public.

Can you buy illegal car parts (sold by a European entity, for example) which advertise themselves as road legal but aren't?

They don’t have to advertise that they are legal for road use to sell them to people intending to use them on the road. Another example: a number of e-bike suppliers sell parts that are explicitly described as not road-legal. People may buy them precisely because they are advertised as being faster or more powerful than what is sold in retail stores.

> a number of e-bike suppliers sell parts that are explicitly described as not road-legal.

That's fair play. The user knows exactly that he is breaking the law, and he can be punished. Google advertises Analytics for online-shops, websites etc. Cases in which the product can't be used legally and the user doesn't know it.

It's not the end user, it's the website owner. And yes, you are responsible for your website.

The website owner is the end user of Analytics, but even if not: Why should the distinction matter?

For example: I'm also responsible for my car but if it's (by design) not road legal, why should I be responsible to be sure of that and not the carmaker?

Idk where you live, but I'm responsible for making sure that my car stays road legal. And I would be responsible to make sure it was from the start if I had built it myself wink wink

Of course, but if you bought a brand new vehicle and it wasn't road legal by design you wouldn't be.

In the UK, if you want to use a vehicle on the roads it's your responsibility to get it taxed and insured and so on. In the process of doing that you'll find out whether it's legally usable on the roads.

There are various kinds of agricultural, recreational and construction vehicle that can't be driven on the roads: you put them on a trailer for moving them from site to site.

You are missing my point, or I'm unable to convey it: If your brand-new car comes with a by design defective (and illegal) airbag or a by design frame which breaks after a few hundred miles and this results in a death, you won't be responsible. You also are not responsible to check whether your car was designed to legal norms and standards. If it's sold to you as road legal you can expect it to be road legal.

Does Google Analytics advertise itself as legal?

As far as I know they never explicitly say that - they give you all the details you need to make the determination yourself, but never explicitly give you the answer.

I don't think that distinction legally matters (in Europe). Every product or service in Europe has to "ensure that your products meet the EU requirements to protect human and animal health, the environment and consumers rights." [1]. This means every consumer buying a product in Europe (from a European entitiy) can assume that the product or service is legal.

[1] https://europa.eu/youreurope/business/selling-in-eu/selling-...

There's nothing wrong with Google allowing a website to use GA. The problem only arises if that website then serves end-user traffic to EU citizens. Many European websites may choose to only use GA if the traffic is coming from outside the EU.

I'm not sure if that's true. I might be mistaken, but I think European companies have to abide by GDPR even for non-eu personal data.

But let's say it is, then still Google should make that very clear or even adapt its script to prevent a connection if an EU ip is recognized.

You just described absignificant portion of the EU based car tuner scene.

> Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?

Pretty much all of them? Let's say you buy a humble walkie-talkie. It is your responsibility to operate it in regions where the specific RF bands it uses are legal.

No, that's not true, if you buy a walkie-talkie, the seller has all kinds of obligations to ensure that it follows the requirements.

Radio devices are a good example where it fact is illegal to make, sell or import transmitters that do not conform to permitted RF bands.

IIRC in USA there is an exemption in FCC rules if you're importing a device for personal use by e.g. buying it online from abroad (and then you're responsible to use it properly), but if you'd want to resell that device, you can't just transfer the liability to the user, you are responsible for ensuring that the transmitter follows FCC rules.

Not true - you can easily buy unlocked Baofeng radios in EU and nobody cares. FCC cared because American manufacturers couldn’t really compete on market terms.

The fact that nobody cares is a lack of enforcement (and exemptions for import for personal use) due to low priority, but it does not mean that it is legal to sell unlocked/unrestricted walkie-talkies in EU - it is not, at least not in all EU countries.

For example, last year there was an explicit prohibition on sales of Baofeng UV-5R in Germany (https://www.bnetza-amtsblatt.de/download/72) and Poland and probably other countries due to out of band emissions causing radio interference.

And you as a customer are clearly informed about such limitations. No walkie-talkie would advertise themselves as free to use anywhere. Also, no walkie-talkie sold which by design uses the wrong frequencies would be allowed and would make the user liable and not the producer.

> Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?

Let's remember, for context, that the EU is saying that the US is an "unsafe" third party country. While this is certainly true under a given definition of safe/unsafe, I doubt (m)any European citizens can point to harm as a direct result of their data being subpoenaed under the US CLOUD act. I am not saying there isn't a real problem but as I mentioned in another comment, the US and EU have agreed "in principle" on a third privacy shield to satisfy concerns on both sides and we are now waiting for it to be codified and tested in courts.

ECJ has declared "Privacy shield" as well as "Safe Harbor" null and void, since those were merely agreements, which never side codified into actual law. So I don't think there will be any new court decisions regarding those.

I also don't think most Europeans are really worried about US government intrusions into their privacy, thoug I don't know the legal implications the CLOUD act would have in this context. Honestly, I think anybody takes US government intrusions for granted after the Snowden leaks. It's the companies people are worried about. Facebook, Google have a scary amount of power and lack of oversight.

You can use google analytics legally in all of these areas that have deemed it illegal, because they're just saying it is illegal for common public-facing internet usage. You can still use google analytics for, say, corporate intranet sites in Denmark if you'd like.

Sure, but that is not what Google is advertising, and it should be Google's responsibility to inform users about that.

Exaggerated example: If I would buy a car which by design isn't road legal, and this design flaw would cause an accident killing someone. Normally the carmaker would be responsible. The carmaker couldn't say, well technically, it's only for use in your backyard, but you have to be a lawyer to know that, and our advertising isn't reflecting that at all. Somehow, Google get's away with such logic.

I doubt you can. If the data collection is illegal under the GDPR (or it’s incarnation under danish law), then it won’t help if you don’t use it in a public facing context. The GDPR doesn’t make any difference between subjects that are employed by the entity collecting the data and others.

Reply on news.ycombinator.com