[dudus]

Also related:

"""

Google Analytics protects the confidentiality of Google Analytics data in several ways:

Google Analytics data may not be shared without customer consent, except under certain limited circumstances, such as when required by law.

Security-dedicated engineering teams at Google guard against external threats to data. Internal access to data (e.g., by employees) is regulated and subject to the Employee Access Controls and Procedures.

"""

https://support.google.com/analytics/answer/6004245?hl=en

[pdkl95]

> protects the confidentiality

For their definition of "confidential", which they can change at any time.

> certain limited circumstances

If they only intended the "required by law" example, they wouldn't use such a broad - and completely undefined - set of circumstances.

> guard against external threats

Google may have good security practices now, but an continually growing collection of highly-revealing tracking data is a very tempting target for many businesses, governments, etc. If Google (or anybody else) wants to claim that they are protecting your data, they should indemnify the subjects of their spying against any damages those caused by those "external threats".

[ThisIs_MyName]

>they should indemnify the subjects of their spying against any damages those caused by those "external threats"

I despise GA as much as the next guy, but you'd have to be pretty crazy to expect any business to provide such a guarantee. Google isn't your insurance company.

[pdkl95]

I don't really expect that anyone would make that kind of guarantee; I'm arguing in the style of a proof by contradiction. These businesses shouldn't be making this kind of claim, and they shouldn't be holding onto data beyond what is necessary. Data should be expunged as soon as possible, because then there isn't anything to protect.

Businesses are acting like there is no risk in holding personal information. When people complain, they respond with claims that the data is safe. When businesses act like they are secured and that we should trust them, we should be asking them to stand behind those claims. I agree, this is crazy, but businesses really want to make strong claims but not be bound by those claims. An honest business that actually believed in their own promises shouldn't have problem putting those promises into a formal guarantee.

[ThisIs_MyName]

>I don't really expect that anyone would make that kind of guarantee

Yet you do seem to expect that guarantee:

> An honest business that actually believed in their own promises shouldn't have problem putting those promises into a formal guarantee.

You can't use such guarantees to vet businesses because no sane company would meet your requirements!

[fabulist]

That seems to say Google won't share your Analytics data without making any guarantee that they won't _use_ your analytics data.