Your website can’t just be “kinda” compliant with privacy laws

Frequently asked questions

AWS & DigitalOcean have servers in the EU, why couldn't you use them?

Because those EU servers are owned by US cloud providers, they're subject to FISA and they're completely defenceless against EO12333. The Schrems II ruling invalidated the EU-US privacy shield, meaning we could no longer rely on that as a legal transfer mechanism for us to process pageviews/events.

All internet requests include an IP address, which is Personal Data under the GDPR, so we couldn't transfer that to US-owned infrastructure without consent, even if the servers were located in the EU. If we didn't build EU Isolation, you would have to place ugly, detailed consent notices all over your website.

How fast and reliable is your EU infrastructure?

Our EU Cloud is monitored 24/7, highly available, multi-region and has enough capacity to process Bieber-level traffic. And, as usual, this feature is available to all customers on all plans.

Can I route all of my traffic through the EU?

Yes. Some of our customers want to route all of their traffic, even from folks in the US, through EU Isolation. This isn’t required by law, and is usually a case of not wanting US cloud providers to handle *any* traffic. If you want to route all of your traffic through the EU, even traffic outside of the EU, you can set EU Isolation to “Extreme” after you set-up a custom domain for your site.

Are other analytics companies breaking the law?

Other analytics companies that are using US-controlled cloud providers (DigitalOcean, AWS, etc.), are required to put SCCs in place, along with adequate supplementary measures to protect EU visitor Personal Data (IP address, etc.). Simple, right?

Unfortunately, the EDPB (European Data Protection Board) states the following in Use Case 6: Transfer to cloud services providers or other processors which require access to data in the clear:

94. A data exporter transfers personal data, whether by electronic transmission or by making it available to a cloud service provider or other processor to have personal data processed according to its instructions in a third country (e.g., for the provision of technical support or any type of cloud processing), and this data is not - or cannot- be pseudonymised as described in Use Case 2 or encrypted as described in Use Case 1 because the processing requires accessing data in the clear.

If

1. a controller transfers personal data to a cloud service provider or other processor,
2. the cloud service provider or other processor needs access to the data in the clear in order to execute the task assigned, and
3. the power granted to public authorities of the recipient country to access the transferred data in question goes beyond what is necessary and proportionate in a democratic society, where in practice problematic legislation of the third country applies to the transfers in question (see Step 3).

then the EDPB is, considering the current state of the art, incapable of envisioning an effective technical measure to prevent that access from infringing on the data subject’s fundamental rights. The EDPB does not rule out that further technological development may offer measures that achieve the intended business purposes, without requiring access in the clear.

95. In the given scenarios, where unencrypted personal data is technically necessary for the provision of the service by the processor, transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys. Source: Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

This is why we spent many months building Fathom's EU Isolation feature, working with our lawyers and privacy officer to get specific details correct. With our automatic EU Isolation feature, you don't have to worry about US-controlled cloud providers accessing data in the clear.

How do I enable EU isolation?

If you’re a Fathom customer, then congratulations, you’re already using EU isolation and complying with privacy laws! We enable this by default for everyone on every plan. You can turn on “Extreme” by going into your site settings and adjusting it there.

Is EU isolation available to me on my current plan?

Yes! Even with our lowest plan, you can take advantage of EU isolation for your Fathom account. It’s enabled by default.

Why process and anonymize an IP address in the first place?

Whenever you visit a website, your IP address and User-Agent are sent to that website's servers (that's just how the internet works). Some websites retain raw logs of that information, keeping tabs on what you're browsing. Whilst others (i.e Fathom) guarantee that your visit is anonymized and not used against you. You can read more about this on our data journey.

Fathom is a Canadian company, how does this work legally?

Canada has adequacy ruling under the GDPR. This means we can simply work with a German cloud hosting provider and not transfer any personal data (IP) of EU data subjects to US-controlled servers.