I am getting messages from users telling me that that can't use my service because things like Google Fonts and Google Analytics have been essentially made illegal in certain European countries like France, Austria and Germany, due to recent court rulings.
A user told me they know of people who got fined because of this.
Is this true? I can only find a few references here and there, but there seems to be truth to it.
My main question is, what did you do in your case to make your product GDPR compliant?
Any links to services that you used would be very helpful.
Here is what I did so far for compliance.
I generated the legal documents like terms and conditions, privacy policy etc. using a third-party document generation service, and I added a PDF with a GDPR Data Process Agreement (DPA) listing the platforms that I use (Firebase, etc).
I've set the region of my production databases to Europe.
To give more context if needed, I own a bootstrapped company and I'm now setting up the legal paperwork for being compliant with GDPR, the company is Belgium-based.
The company is an online course platform, that allows customers to create their own website, in their own custom domain.
So the customers could have in their websites privacy policies that are different than mine.
What did you do in terms of documentation and third-party services to help you make your company GDPR compliant?
Any services that you recommend?
Thank you for any insight on this matter.
If you need a google (or other) fonts, do self hosting. Simplest way is to build them into your site as a dependency... npm @fontsource for individual fonts is great for this [0] This is also better in terms of HTTPS overhead, and the process of self hosting is good for font file weight awareness due to the affect on your build size, especially when using lots of styles.
Same principle for any other CDNs you use, they all have the potential to track. The risk benefit of CDNs is being reversed, public CDNs disadvantages are: increased HTTPS overhead, increases points of failure, increased risk of users getting arbitrarily blocked by CDN provider IP blacklists, increased risk of tracking. Benefits: small developer convenience, potential advantage of caching (unlikely these days, and unlikely to outweigh the cost of HTTPS overhead especially in terms of total latency).
In reality, I'd suggest you avoid both services and go for simpler choices. E.g.: fontsource.org for fonts, and maybe something like plausible if you really need analytics.
You can find many, many of them when you search Twitter for "buildinpublic".
The sad truth is that most successful solo founders these days:
1) Make it very hard to figure out where the service they provide is located.
2) When you find out, it is usually registered in a country outside of the EU. Crunchbase often helps to find the location.
Apart from the USA, Singapore and Colombia seem to be popular choices among solo founders who know what they do:
https://www.crunchbase.com/organization/nomad-list
https://openstartup.tm/remote%20ok
What the discussion about GDPR usually misses is that GDPR does not only apply to Google Analytics and Google Fonts.
A web business needs a hosting solution, a CDN, a payment processor, an email solution, an A/B testing solution, etc etc etc.
If you try to handle all that inside of the EU, you are cut off from all the good tools that startups usually use.
RemoteOK is in Singapore.
I added it to the comment now.
SaaS projects usually service the whole world. I have not found a single solo founder who does that in a way that is compatible with the GDPR.
If the EU would try to enforce the GDPR worldwide, it would mean the EU gets cut off from 99% of the internet. Then Europeans can only use giants like Google and Facebook. Because smaller players can not duplicate all of their infrastructure using tools based in the EU.
It won't happen. It would be as if the EU sanctions itself into stone age. Imagine the physical industry would be told that it can only use parts made in the EU from now on.
Like, at all?
There are self-hosted alternatives. Plausible Analytics is good. Find web fonts that you can host yourself.
Not only you will reduce your risk exposure, you'll see that it is not that difficult to get rid of Google.
Your users, European or not, will thank you later.
In any case, for the OP I would also recommend to use an alternative. I don't know about Plausible Analytics but I have heard good things about Simple Analytics [1]. I'm not sure about Google Fonts.
In terms of GDPR compliance, just keep in mind that you can't hide this stuff behind T&C, you need the user's explicit consent, and it needs to be timely and you can't forbid them from accessing the service if they decline consent. I would also consider using a service that handles GDPR/cookie consent collection for you so you don't need to keep it up to date as time goes on and you can focus on your business instead.
It's the same thing with the cookie-banner law, by the way. I am running a service in Europe and I can proudly say that I have no cookie banner on my site. You know why? Because I don't have any tracking cookies on my site in the first place.
Users don't actually care.
How? https://plausible.io/data-policy.
OP already said he is hosting the servers in the EU, so he is in the same situation as plausible's SaaS offering.
• https://www.growthfyi.com/custom-ga
I personally choose to use Plausible Analytics with a custom domain [0] and the default "System Font Stack" [1], which means my sites load fast, don't have a flash of unstyled text, and my analytics script doesn't get blocked by ad blockers.
You can download fonts from both of them and host them on your own server to avoid processing that information.
I'm all for privacy and such (I don't use Google Fonts or tracking ads/analytics), but I don't really see a difference in here. According to G Fonts privacy policy, they don't store any PII. (This also reminds me that based on what I understand of the ruling, almost any 3rd party requests for assets should be blocked? Including G fonts, bunny fonts and jsdelivr)
Do they log IP addresses? That would be enough as those count as PII. Maybe bunny.net has logs disabled and that's what makes them stand out.
But especially with fonts it's just so easy to self-host them that it's kind of a no-brainer.
> almost any 3rd party requests for assets should be blocked
That could be a very good practice/state of mind for developing privacy-respecting websites/apps and will save you from stress, before it can happen.
As you have no more advantages due to separated caches from using CDNs for scripts etc., you can self-host those, too. Saves on DNS lookups and you have control over the caching-times, too.
I'd try to run as much as possible from the same domain.
This means that sending data from the EU to a US company is almost always a GDPR violation. There are a few nuances to this which are very important.
- The US CLOUD Act gives US law enforcement access to data stored in other jurisdictions. This means that locating the servers in the EU is not sufficient. Nor is operating via an EU subsidiaries.
- IP address counts as personal data, as does pseudonymized identifiers.
The two of these combined mean that GDPR forbids you from having your users connect to Google servers. This is why Google Fonts is straight forbidden, and why most installations of Google Analytics are forbidden. Also the use of basically anything from Google, Azure, AWS, Oracle, Facebook, Akamai, etc except when routed through an EU proxy which obscures the user's original IP address.
The FAQ for the Schrems II ruling makes it clear that SCCs and BCRs aren't a basis for sending data to the US (BCRs are still valid for other regions that haven't received an unfavorable adequacy decision).
https://edpb.europa.eu/sites/default/files/files/file1/20200...
As far as I can tell, nobody's enforcing the rules about where you store your data right now (as distinct from sending user data to 3rd parties, like the Google Fonts thing).
1. not data. Personal Data. of course if you know you know, but threads like these are rife with non informed readers.
2. nothing to do with the geo residency of the company. it's about sending the data to the US (or most non-EU countries). Even an EU company can't send the data to the US absent various agreements.
3.You are way overstating the violation part. It's very easy to be able to send the data and be compliant.
That's fair. Although a lot of data can become personal data if you're not careful.
> it's about sending the data to the US (or most non-EU countries)
Disagree, the United States is in a worse condition that most other countries. Even in countries without an adequacy decision, you can usually satisfy GDPR by incorporating SCCs into your contract. A US company cannot comply with GDPR because they are beholden to US laws which require them to violate the terms of any contracts they sign protecting the data privacy of their users (according to the CJEU).
> It's very easy to be able to send the data and be compliant
Probably depends on your context. Something like, say, sending a pile of data over to GCP to train an ML model on? Probably easy to comply. Front-end dev work? Anything that makes the user's device connect to a Google URL is forbidden, since that's sending personal data (IP Address). The higher-level your framework, the more care it takes to avoid some dependency doing this behind your back.
Self-host matomo, it is super easy to manage.
You can't easily track every mouse movement of every user but maybe it's for the best
What bothers me the most for solo founders with GDPR is that you can't analyse individual user journeys without some kind of consent. I don't care who you are, but I care how you use my product so I can improve it. Aggregated / backend analytics will give me only the most basic insights.
Am I right in that? Is it possible to work around that? I don't track to sell or analyse personal data. I just want to understand how you use my product better.
Even with self hosted stuff you need a consent for tracking if I understand it correctly.
If you don't use IP addresses or can't come back from a user profile to an IP address, you should be fine with tracking the user journey. But be careful with tracking actions like "placed an order" and linking to that order then. That link would create an option to identify a specific user and could therefore be a problem.
The only analytics you can do without consent is effectively a stateless hit counter that increases on every operation. For a lot of features, it's more than enough and saves you from all these headaches.
There's a bit more leeway to take data you already need to use for your service, and using it for a secondary purpose like analytics. So things like analyzing logs, including making use of a user identifier which you had to collect and process for other reasons. There are still restrictions, but much less severe than "strict consent." You can use "Legitimate Interest," legitimately.
Note that reading cookies is covered by the ePrivacy Directive, while processing personal data is covered by GDPR (reading cookies with personal data is covered by both). This is the source of many issues. In this case, it means collection is severely restricted (ePD) but use afterwards is less-restricted (GDPR).
Imagine you have a physical store, and want to track which clients come back, what products they look at, and in which aisles they stop.
You could take their photo to recognise them when they come back, that's obviously not privacy-respecting at all.
What Google Analytics does is given them a badge with a unique id the first time they walk in, and expect that person to show that unique id on each subsequent visit. And also expect them to show that same badge on every other store (website) they visit. Even in places where they're registered (e.g.: GMail). It's inevitable that by tracking users like that you can eventually tie it to their real life identity, and also produce a really detailed record of all their activities.
This idea has become pretty common somehow: "I just want to see a single user's journey and don't care about who they are". But imagine how you'd do that on a physical store (including with clients that walk out and in again), and if there's ANY way that it wouldn't be super creepy to customers.
This is why freemium products are so important. In this future, your marketing should be a sledgehammer with one focus - get people to create accounts. Once people have accounts, then you can do all sorts of analysis to find your product's value prop/customer journey mapping/etc.
GDPR suggests that you can't make non-essential data processing a requirement for using the service, so it seems to me that ToS that force you to accept tracking would still not be compliant.
Aside from fonts and CDNs pointed out already in other comments, there is also actual content:
How will you serve videos for example? You should look for a GDPR compliant option for that as well. It may exist, or you can self-host videos up to some point. (It is possible, done that before and it worked well.)
Does your platform offer mentoring? How will course participants talk to mentors? Look for a GDPR compliant option here. Don't use services of Google, MS or others that just suck. Probably look for something like Jitsi Meet hosting, or get capable engineer to set that up on your own infrastructure.
How will people inside your company communicate? Look for options for that. Zulip is easy to self-host for example.
That social icon on your website? It better not be loaded directly from FB, insta and the like!
You want to know what visitors do on your website? Well, self-host a matomo or similar. Don't do the usual reach for Google Shnanalytics.
Don't employ dark patterns in your cookie consent popup. Remember: Rejecting tracking and cookies must not take any longer than accepting it. Highly suggestive colors of the buttons are also a no-go. Be honest.
In general, if anyone suggests using any Google services or MS services, look for other options to avoid trouble and pain later. If you cannot do so now, keep book about all the things you still need to fix, to become actually GDPR compliant.
As an alternative to Google Analytics, I recommend Plausible. If you need more event-based tracking (like Mixpanel), have a look at my app Fugu (https://github.com/shafy/fugu). It doesn't track unique users and is therefore compliant with GDPR. It's hosted in Germany, and you can self host it for free if you want (it's open-source).
This is not very clear yet, but it might well be possible that using US companies as hosting providers might also become illegal under GDPR, even you use their EU data center. This is because the US government can access all US companies customer data, even if it's not hosted in the US. There are already precendences where this was ruled by a court. So, to be safe, I would also pick a EU provider, such as Hetzner, Clever Cloud or Scalingo.
It's easy as that. You can absolutely use ANY tool or service you want (really), but if it processes personal information (and even IPs count as that) you'll need to ask for consent and inform the user what data is processed and where and how it is processed and how you plan on protecting that data.
That has to happen BEFORE anything is processed if it's not technically ultimately necessary. Hint: Passing user and browser information to Google because your site looks nicer with an external font is technically not necessary. ;-)
With these requirements in mind, you'll find that it's easier to self-host your fonts, run a local Matomo instance with high privacy settings for analytics etc.
It sure is a different approach on "how to do internet", but you'll get the hang of it and it's not that hard after all.
Also: If you don't use any external services that process private information, you don't need a cookie notice after all. ;-)
> A user told me they know of people who got fined because of this.
Yes, some people in Germany are currently running around and try to fine websites that use Google Fonts. It works and is legal, but the morality... That won't stop such people...
Self-hosting fonts can easily help you with that, even Google has a page on that: https://fonts.google.com/knowledge/using_type/self_hosting_w...
There is tremendous value in having the GDPR enforced properly though. Imagine a world where you can actually talk to someone or buy something or without Google or Facebook knowing about it, webpages no longer embedding dozens of third-party trackers, "data brokers" going out of business, etc.
IMO it's actually quite insane that we let the situation deteriorate so badly that something like the GDPR was needed, both from a "do the right thing" perspective (smearing your PII over tons of third-parties with dubious or outright malicious business models is a sign of disrespect for your users, not to mention security liability) as well as legal perspective (some countries already had existing legislation around electronic data processing that predates the GDPR).
The near term is to make it easier for organizations to maintain the various gdpr style mandated user data export and deletion capabilities without it getting in the way of / blocked by continuously evolving software systems efforts.
The same sort of tooling could also be used to help data analysis folks navigate the huge sea of tables in various datalake setups organizations are so eager to setup (it can be tricky seeeing which things are usefully joinable among many many evolving datasets that might be in that setting.
This of course isn’t really aimed at solo engineer sized application Systems such as the original poster, but is it something folks would find useful?
Also, from personal experience, European business partners are much nastier/cutthroat to deal with.
The UK ICO describes when a company does and doesn't need a DPO, at least with the UK implementation of the GDPR:
https://ico.org.uk/for-organisations/guide-to-data-protectio...
The first question it addresses is "Do we need to appoint a Data Protection Officer?", for which the answer can be "no", depending on your activities and type of organisation.
Roughly, it's a no if you are not a government body and your PII handling is secondary (such as for HR in your startup) rather than a core activity at large scale (such as running a HR service or user-tracking service).
As a startup it is plausible that you are a "yes" if you handle PII as a core activity, for example if you are taking user's PII such as their names, addresses, locations, etc. But even than, you may not be doing so at large enough scale to require a DPO. If you are, though, it's time to hire one, and you're probably at a scale where you can afford to.
Broadly, you could think of a DPO as more like an auditor or independent overseer in a particular area, whose job is to check you are complying. Just like an auditor or security professional, you can hire an external one in to ensure your business is complying and show that you've done so. Larger companies doing large and more intrusive activities need it, the same way as those are the companies which need other forms of auditing and independent oversight.
It's a different function from the DPC (data protection controller), who is in charge of actually processing the PII you hold. See "What are 'controllers' and 'processors'?":
https://ico.org.uk/for-organisations/guide-to-data-protectio...
At a one person startup the DPC is almost certainly you, as you make the decisions on how to process PII, even if you delegate the actual processing sometimes. You have responsibilities as a DPC, but you can do it, and it'll just be one more, among the many duties you have as a director of a one person company. Imho, being a DPC isn't any more onerous than the other duties of a director.
Its easy to say "I'm small and don't need a DPO"... but the law is nothing close to clear on this issue.
And the guidance clearly states that I cannot be the DPO while also holding all the other positions in the company.
"Basically this means the DPO cannot hold a position within your organization that leads him or her to determine the purposes and the means of the processing of personal data."
i think that is a calculation only op can make. the european union covers over 400 million people. making some early design decisions in what data you collect, how you store it, for a lot of people is an acceptable cost to open up to such a large quantity of people.
in fact, it think advising a founder that is bootstrapping their business that the only "reasonable" course of action is to exclude large swathes of the developed world is frankly, misguided.
This is exactly the kind of thing I'm talking about. "How you store it" very well may include "on any cloud server owned by a US company," including AWS, Google, and Azure. That's a pretty big issue for a solo founder with no legal advice beyond GDPR wishcasting on HN.
Is there any gotcha related to Admob/GDPR in 2022?
Yes, if you're using Google Analytics and Google Fonts, you'll need to get permission from each user before loading any of that. Those services are used to track users around the internet and for marketing/ad purposes within Google.
I actually think it's near impossible to make something "GDPR compliant." For example, let's say that you try to do all the right things - trying to be as strict as possible. You put up a cookie banner that has both "accept" and "deny". Molly presses "accept". Two days later, Jane is using the same computer. Jane didn't accept. You're now tracking Jane who did not consent.
I think showing a good-faith approach and genuine caring about user data will go a long way with regulators (but IANAL so don't take that as advice). Things like Google Fonts/Analytics are easy targets because we know they leak data to Google. If you're hosting a MySQL database on Azure, theoretically the US government could get a search warrant and serve it to Microsoft and get access to your database. I personally think regulators should be focusing on the rampant bad-faith compliance targets rather than "well, technically maybe the US government could do X." Websites are putting up "Accept all" and "Manage choices" buttons where you'd have to spend an hour opting out. C'mon, that shows such a blatant disregard for user's rights. Having a database hosted on Azure that the US government could technically get a warrant to search your database and because Microsoft is a US company they'd have to give them access is certainly something that could happen, but such an unlikely vector compared to someone embedding GIPHY and now Facebook knows all the page views.
Realistically, if the EU pushes too far, the US is going to say "you can't ban US companies from the internet in Europe." If the EU seriously said that you couldn't use Azure because Microsoft is a US company (or any other US company), I'm guessing the US would take it to the WTO (World Trade Organization) and it'd likely be considered in violation of trade treaties. There's a certain amount of local rules and regulations you can put in place and some might have a protectionist impact on foreigners, but outright banning foreign companies wouldn't fly.
Plus, the US's reach often extends to EU companies. Hetzner and OVH both have a US presence. I don't know, but I'd guess that people on-call in the US can access a lot of their EU presence. Why wake up someone in Germany or France at 3am when it's 9pm in the US? The US presents their US subsidiary (or US employees) with a warrant and the warrant expressly forbids them from disclosing to anyone so the European parent doesn't even know to restrict access from their US employees, etc. At some point, one needs to be realistic about the threat vectors.
On a practical level, stop using third party services where you (and your users) are the product. Google Fonts is free because you're paying for it with user data. An Azure-hosted database costs money because Microsoft doesn't get access to what you're storing in that database. Do get DPA agreements from your third parties and give them a look over to make sure they seem reasonable. Do genuinely care about your users' data. That does take a bit of effort (not just good feelings). For example, you need to know that Google Analytics feeds the data into Google's larger marketing machine rather than being private storage for you.
On perhaps the most practical level, check what third-party stuff you're serving on your site - javascript, images, fonts, etc. People don't know where your database is stored unless you tell them. They can easily see that you're loading a Facebook tracking pixel since that's in the page you're serving to them. That gives them an easy way to see if going to your website is loading something that's tracking them without their consent - even if you're not wanting that third party to do that tracking. Your users complained to you about the things they could see. I think those are often the most likely ways that GDPR violations will happen too - companies haven't really built their businesses around backend data stealing (err, sharing) because they'd need to make an SDK for Java, C#, PHP, Python, Ruby, etc. JavaScript lets them write once and even push updates without you needing to update dependencies. Focus on the front-end stuff that users can see - both because it's the most likely place you'll have compliance issues and because it's probably the most likely place you'll be caught with compliance issues.
Again, I am not a lawyer and none of this is advice.
A consent popup that makes it harder to decline than to accept is not compliant, nor one that merely cares about cookies/local storage while still loading third-party scripts and leaking your IP address & browser fingerprint.
A compliant consent flow would require explicit consent before loading any non-essential third-party scripts, but I'm not aware of any mainstream solution that does this, primarily because an actually compliant solution would put certain employees and maybe even entire companies out of business, thus pseudo-compliance is preferred over actual compliance.
Furthermore, even if you do actually handle tracking consent properly, it is only part of your GDPR compliance approach. It does't matter if your website tracking is compliant if your backend then uses the data without appropriate legal basis.
The problem is that a lot of businesses (or careers) just won't be possible without breaching the GDPR, and that's not something a "compliance-as-a-service" company would fix. A honest company would tell you to close your business or severely downsize your marketing team, a dishonest one would just take your money and give you a false sense of security.
- for any personal data (PII) all companies must declare the following :
- purpose of the collection and the treatment of the specific data
— legal base of the treatment (6 available, they are the field card in Magic the gathering, they define a context of what is possible to do)
- data category (what type of data you are collecting i.e if you declare collecting delivery shipping information for a purpose, you limit yourself to data that correspond to that category )
- data retention duration (how long you declare storing the data in production and then in archive)
- list of recipients (all the 3rd party companies who will access the data)
- security measures (what is the level of security for keeping that data safe from breaches)
- some infos about the company, the data controller (who is responsible) etc…
https://github.com/uropa-project/uropa
- consent is just one of the 6 legal bases to collect and treat data. The comment above that everything is possible with consent is wrong.
- below 250 employees you don’t need officially a DPO