3 ms·

> we don't tie GA or any other usage analytics to individual users You may not identify individual users but Google probably do... > we should put this somewh

> we don't tie GA or any other usage analytics to individual users You may not identify individual users but Google probably do... > we should put this somewhere more prominent You should make it opt in by default. Or stop doing it!

gnicholas 8y ago
We're totally open to making this opt-in. I'm curious how we should gather usage data, which some of our nonprofit funders require us to report for their impact questionnaire. How can we know how much the tools are being used if it's opt-in? Or are there other systems (other than Google) that raise fewer concerns? I really appreciate all the candid advice in this thread and hope that we — and others in similar situations — can use it to improve our products.
- fny 8y ago
  A few other meandering thoughts, you'll need to be the one to figure out what makes sense. - You're already not getting data from people with ad-blockers, consider also respecting Do Not Track[0] - Be transparent about what you track and how it's used - The data collected from opt-in users might end up being enough to build convincing enough reports for impact questionnaires? - Your privacy policy seems confused: "We think the best way to ensure that your personal information stays safe is to never collect any in the first place" then "we only use Google Analytics, which gathers information about our site users and generates aggregate reports to help us figure out who is using our site and extensions, and in what ways" [0]: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/doNotTrack https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...
blowski 8y ago
IANAL, but have worked on GDPR a fair bit. Google Analytics is already GDPR compliant, as long as: * you are not pushing any unencrypted customer data to them in the clear * you're careful regards who has access to your Google Analytics data You can (and most businesses will) argue that you need to know how your website is used. It's a completely standard practice that doesn't put user privacy at risk. Moreover, Google has already offered an opt-out to Google Analytics globally, and you would be covered by that. As such, you don't need them to opt-in.
- asfdsfggtfd 8y ago
  This isn't about law it is about ethics. I wouldn't like it if someone followed me around meatspace with a clipboard all day. I don't like it online either.
  - jfz 8y ago
    That's not the best analogy - it's more like someone has two chairs in their waiting room and they note which chair is more popular among people waiting, so they can replace the worse chair with a copy of the better one.
    - asfdsfggtfd 8y ago
      Except that this business saves money by allowing a representative of a third party to take the notes. The third party then notes down who sits in the chairs, follows them into the appointment and follows their client to the next business and do the same there.
dahart 8y ago
> You should make it opt in by default. Or stop doing it! What? Can you post some examples of sites that already do this? Everybody has analytics on their landing pages, and I don't think I've ever personally seen an opt-in. What you can find are thousands of examples of site policy pages that say something like: "by choosing to visit our site, you are sharing information with us that we log for the purposes of improving our customer experience. By using our service, you agree to this logging. If you don't want to be logged, then please don't use our service."

gnicholas 8y ago

We're totally open to making this opt-in. I'm curious how we should gather usage data, which some of our nonprofit funders require us to report for their impact questionnaire. How can we know how much the tools are being used if it's opt-in? Or are there other systems (other than Google) that raise fewer concerns? I really appreciate all the candid advice in this thread and hope that we — and others in similar situations — can use it to improve our products.

fny 8y ago
A few other meandering thoughts, you'll need to be the one to figure out what makes sense. - You're already not getting data from people with ad-blockers, consider also respecting Do Not Track[0] - Be transparent about what you track and how it's used - The data collected from opt-in users might end up being enough to build convincing enough reports for impact questionnaires? - Your privacy policy seems confused: "We think the best way to ensure that your personal information stays safe is to never collect any in the first place" then "we only use Google Analytics, which gathers information about our site users and generates aggregate reports to help us figure out who is using our site and extensions, and in what ways" [0]: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/doNotTrack https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...

blowski 8y ago

IANAL, but have worked on GDPR a fair bit. Google Analytics is already GDPR compliant, as long as: * you are not pushing any unencrypted customer data to them in the clear * you're careful regards who has access to your Google Analytics data You can (and most businesses will) argue that you need to know how your website is used. It's a completely standard practice that doesn't put user privacy at risk. Moreover, Google has already offered an opt-out to Google Analytics globally, and you would be covered by that. As such, you don't need them to opt-in.

asfdsfggtfd 8y ago
This isn't about law it is about ethics. I wouldn't like it if someone followed me around meatspace with a clipboard all day. I don't like it online either.
- jfz 8y ago
  That's not the best analogy - it's more like someone has two chairs in their waiting room and they note which chair is more popular among people waiting, so they can replace the worse chair with a copy of the better one.
  - asfdsfggtfd 8y ago
    Except that this business saves money by allowing a representative of a third party to take the notes. The third party then notes down who sits in the chairs, follows them into the appointment and follows their client to the next business and do the same there.

dahart 8y ago

> You should make it opt in by default. Or stop doing it! What? Can you post some examples of sites that already do this? Everybody has analytics on their landing pages, and I don't think I've ever personally seen an opt-in. What you can find are thousands of examples of site policy pages that say something like: "by choosing to visit our site, you are sharing information with us that we log for the purposes of improving our customer experience. By using our service, you agree to this logging. If you don't want to be logged, then please don't use our service."