Google Analytics provides statistics on website traffic. After receiving complaints from the NOYB association, the CNIL, in cooperation with its European counterparts, analysed the conditions under which the data collected through this service is transferred to the United States. The CNIL considers that these transfers are illegal and orders a French website manager to comply with the GDPR and, if necessary, to stop using this service under the current conditions.
A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.
因為 GDPR 內把 IP address 資訊視為 PII，所以看起來任何 3rd-party 的內嵌服務應該都會受到影響，來追起來看一下後續的發展好了...
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
比較重要的是 specified 與 explicit 這兩個詞，GDPR 規定必須明確指明用途，而可以從整理出來的文件「Inside the black box」裡的「Purported processing purpose」看到大量的極為廣泛的說明。
We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation.
The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.
但因為這個預設值開啟的關係，就算關掉後也足以把使用者再分類到另外一個區塊，仍然具有高度辨識性，不是你 Google 說無法辨識就算數。
另外如果看 source code 裡的說明：
// Note the criteria for attaching client experiment headers:
// 1. We only transmit to Google owned domains which can evaluate
// experiments.
// 1a. These include hosts which have a standard postfix such as:
// *.doubleclick.net or *.googlesyndication.com or
// exactly www.googleadservices.com or
// international TLD domains *.google. or *.youtube..
// 2. Only transmit for non-Incognito profiles.
// 3. For the X-Client-Data header, only include non-empty variation IDs.
Cookie walls that demand a website visitor agrees to their internet browsing being tracked for ad-targeting as the “price” of entry to the site are not compliant with European data protection law, the Dutch data protection agency clarified yesterday.
gslin@GSLIN-HOME [~] [14:32/W2] whois markdown.tw
Domain Name: markdown.tw
Domain Status: clientTransferProhibited
Registrant:
Not displayed due to GDPR
FR
Administrative Contact:
Not displayed due to GDPR
Technical Contact:
Not displayed due to GDPR
Record expires on 2020-03-07 (YYYY-MM-DD)
Record created on 2011-03-07 (YYYY-MM-DD)
Domain servers in listed order:
ns-171-a.gandi.net
ns-114-b.gandi.net
ns-144-c.gandi.net
Registration Service Provider: GANDI SAS
我自己的 git.tw 也是：
gslin@GSLIN-HOME [~] [14:34/W2] whois git.tw
Domain Name: git.tw
Domain Status: clientTransferProhibited
Registrant:
Not displayed due to GDPR
FR
Administrative Contact:
Not displayed due to GDPR
Technical Contact:
Not displayed due to GDPR
Record expires on 2019-05-23 (YYYY-MM-DD)
Record created on 2008-05-23 (YYYY-MM-DD)
Domain servers in listed order:
kristin.ns.cloudflare.com
paul.ns.cloudflare.com
Registration Service Provider: GANDI SAS
