> One of the nastiest things I've seen from the "analytics startups" espousing how they're GDPR friendly and compliant and privacy friendly is that they adverti

> One of the nastiest things I've seen from the "analytics startups" espousing how they're GDPR friendly and compliant and privacy friendly is that they advertise stuff like CNAME cloaking, using random URLs or hostnames for data collection, etc. > This is incredibly disgusting behaviour: the end-user has EXPLICITLY signaled intent to opt out, gone out of their way to try and protect themselves while blatantly signaling that intent that they do not want it, and the "privacy respecting and caring new not-like-the-other-guys" data collection service is attempting to repeatedly force itself on the end-user, sometimes trying multiple times pretending to be different hostnames, lying about what it is, etc. > I have seen bullshit "analytics" SaaS bruteforce its way through dozens of generically-named cloudfront or akamai hostnames until they find one that works. I agree with you; this is very bad. I might suggest for the user software to allow setting a list of allowed requests and prohibit others (if random URLs or hostnames are used, then this will block data collection, since if they try it, it will just end up annoying the user keeping asking), and/or to have an option tiat if too many improper accesses are attempted then all access will be denied (if it tries to bruteforce it ways through dozens of stuff, then none of them will work, especially if the browser pretends that the connection is just really slow!!!).