14 ms·

We made our SaaS home page cookie-free

382 points by jivings 6y ago

jivings 6y ago
TL:DR; We set out to have a no-cookie homepage. Replaced Google Analytics, Crisp Chat and Cloudflare with privacy friendly alternatives!
- gcatalfamo 6y ago
  How do you retarget on potentially interested customers?
  - bochoh 6y ago
    I think the whole point of being privacy focused is that you don't retarget and your product sells by its own merits.
    - ponderingfish 6y ago
      That's hard and I hope they can achieve this strategy!
    - jamiequint 6y ago
      > your product sells by its own merits This is a common yet naive thing to say that is rarely ever true in practice.
  - mrweasel 6y ago
    How effective is retargeting? I’m understand that it varys from business to business, but from what I saw 5 years ago in consumer electronic, gaming and toys, it’s not really going to be a significate revenue source. The retargeting most of us are see is the failed kind where you’re trying to sell a fridge to the person who already ordered one two days ago, and you’re the person who sold it, but your retargeting partner does actually support registering a purchases.
    - jsjohnst 6y ago
      > The retargeting most of us are see is the failed kind where you’re trying to sell a fridge to the person who already ordered one two days ago I’ve paid close attention over the past few years and have found >80% of the retargeted ads are for something I just purchased (and they are usually the “single purchase” type product, similar to the fridge analogy you used)
    - konha 6y ago
      Very effective. Even if a big share of your ad impressions falsely target someone who already bought (see sibling comment) the remaining impressions lead to an increase in conversions at a comparatively low cost per conversion. As you said, this will vary from business to business, but I have seen very successful retargeting campaigns in b2c e-commerce as well as b2b lead generation.
    - shostack 6y ago
      It varies by advertiser. Smart ones do incrementality testing to prove its added value and optimize accordingly.
- criddell 6y ago
  Just out of curiosity, how important is live chat? I don't think I've ever had a good experience using a site's chat function.
  - jivings 6y ago
    We have a rather difficult onboarding process and users often message via the chat for help. For the homepage I'd say visitors message rarely so it is less useful. That said, the ones that do are usually the same who convert as they are already fairly qualified leads and just want a little extra info before they sign up.
  - stjohnswarts 6y ago
    Back when I was doing web stuff for clients I got a lot of help through hostgator chat function and it was great. It all depends on how knowledgeable the person on the other side is. The medium is fine in and of itself.
    - criddell 6y ago
      I've had two types of experience. One - the person on the other end works for a different company and they can answer a few common questions, but everything else is "call this 800 number." Cell phone companies do this. Two - the person immediately says "give me your phone number and lets talk on the phone" (car dealers are terrible for this). I guess there is a third type - companies using a laughably terrible bot. I encountered this with Sony after I bought a game online and it wouldn't start. I eventually called in and they instantly refunded my money because I think it was a common problem.
      - BenjiWiebe 6y ago
        There is a fourth type. The MVNO I have my phone plan (and friends/family) with actually utilizes their live chat for support, and usually I get a very knowledgeable person in 30ish seconds. It's great. Red Pocket Mobile is the name.
villgax 6y ago
The cloudflare cookie still persists.
- speedgoose 6y ago
  I wish cloudfare could allow removing this cookie. I'm willing to pay for that feature.
  - dkyc 6y ago
    That cookie can be disabled on Cloudflare's Enterprise plan [0] (which, to be fair, starts at like $60k a year). [0] https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682 https://support.cloudflare.com/hc/en-us/articles/200170156-U...
    - judge2020 6y ago
      The enterprise plan is a very custom plan - if you only need access to one or two features and/or only have a few million requests a month, the price can be pretty cheap (much less than the 5k/mo price advertised on the CF dashboard), but if you want mission-critical features like bot management[0], access to China datacenters[1], etc. it definitely can get into the 6-figure range - and they do have over 550 customers paying 6 figures or more [2]. But just getting one to remove the cookie is probably not worth it since it will end up costing more than a business plan (200/mo) regardless. 0: https://www.cloudflare.com/products/bot-management/ https://www.cloudflare.com/products/bot-management/ 1: https://www.cloudflare.com/network/china/ https://www.cloudflare.com/network/china/ 2: http://d18rn0p25nwr6d.cloudfront.net/CIK-0001477333/09769260-9f46-44c1-8597-90a682a7b219.pdf#page=63 http://d18rn0p25nwr6d.cloudfront.net/CIK-0001477333/09769260... (page 63)
      - eli 6y ago
        I think you can negotiate with them if you only need some enterprise features.
    - speedgoose 6y ago
Jsharm 6y ago
Naively did not realise using cloudflare as a cdn meant subjecting users to cookies. I don't have a consent banner... Does Netlify?
- deleted 6y ago
  [deleted]
- donbrae 6y ago
  Netlify doesn't seem to have a consent banner but sites hosted on it don't set cookies, despite using Cloudflare (at least that's my experience hosting a blog on it).
  - iruoy 6y ago
    Netlify doesn't use cloudflare. Their DNS[1] is managed by NS1 and they host their websites on the edge[2] instead of using a cdn. [1]: https://ns1.com/blog/netlify-leverages-ns1-to-improve-performance-across-60-000-sites https://ns1.com/blog/netlify-leverages-ns1-to-improve-perfor... [2]: https://www.netlify.com/products/edge/ https://www.netlify.com/products/edge/
    - donbrae 6y ago
      Ah, thanks. Didn’t realise that.
- wongarsu 6y ago
  At least under EU cookie laws and GDPR you shouldn't need a consent banner for Cloudflare cookies, as they provide essential functions (for availability and security) and don't track users. You might have to mention them and their purpose in your privacy policy though. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies https://support.cloudflare.com/hc/en-us/articles/200170156-U... goes in some detail what the cookies do and (more importantly here) what they don't do.
  - ancymon 6y ago
deleted 6y ago
[deleted]
danieleguia 6y ago
nice write-up with good suggestions on how to accomplish the no cookie page
danieleguia 6y ago
Nice write-up on how to make a cookie-free page. Thanks
eli 6y ago
> But it's possible to hit this button again and re-enable Cloudflare forwarding temporarily if we find ourselves under attack, so I figure this is a good option. Plan to redeploy your production server to a new IP address too since the attacker will still be able to hit it directly.
- Waterluvian 6y ago
  Can you not just reject or ignore all connections not coming from cloud flare? Or does that still do damage during a ddos?
  - jgrahamc 6y ago
    That doesn't help if your pipe to the Internet is full (think Gbps) or if the router/switch can't process packets fast enough (think Mpps).
    - matteocontrini 6y ago
      Considering that the website the articles refers to is hosted on DigitalOcean, in this case the problem would be DigitalOcean's DDoS policy, which is basically null route the IP traffic for 4 hours or so when an attack is detected.
tarjei 6y ago
I've been thinking of trying to combine self-hosted analytics and adding ad info in the urls of ads so I can track if a user arrived at my site via an ad without divulging that to any third parties. Has anyone tried something like that? Did it work? Obviously what you give up is retargeting but that may have to go anyhow.
- patja 6y ago
  I always thought this was a fairly common practice so you can verify you are getting the ad traffic you paid for.
- hapidjus 6y ago
  Isn't this basically UTM Tracking?
- wongarsu 6y ago
  Tracking ads via URL parameters is pretty standard (utm parameters), and self-hosted matomo can be set to run without cookies. This means that some metrics can't be tracked [1]. The most impactful of those is attributing people to a campaign if come via an ad, view your website, but only convert after leaving and coming back some time later. If you leave cookies enabled everything just works just just as you would expect, with full conversion tracking etc. Some ad services try to optimize ads according to tracking data you send them, which obviously doesn't work if you don't run their tracking code. 1: https://matomo.org/faq/general/faq_156/ https://matomo.org/faq/general/faq_156/
- marban 6y ago
  I store the url param in a DB and rewrite the Url to a cleaned one via JS in case the user bookmarks the page.
romanovcode 6y ago
ERR_TOO_MANY_REDIRECTS
perlpimp 6y ago
Safari cannot open the page because too many redirects occurred.
- jivings 6y ago
  I assume HN hug of death! It's back now.
deleted 6y ago
[deleted]
stevage 6y ago
Urgh, the irony - can't open this page, because there is some problem to do with too many redirects. Which you can maybe fix by clearing cookies.
- jivings 6y ago
  Ghost instance crashed, I assume HN hug of death! It's back now.
donbrae 6y ago
Getting redirects too. The page on the Wayback Machine: http://web.archive.org/web/20201103140506/https://blog.leavemealone.app/no-more-cookies/ http://web.archive.org/web/20201103140506/https://blog.leave...
nwsm 6y ago
I was recently tasked with making an "Accept our use of cookies" banner for our public site. Before that banner we did not store any cookies at all; now we have one to store their consent.
- unfunco 6y ago
  If you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing.
  - deleted 6y ago
    [deleted]
  - TonyTrapp 6y ago
    Try explaining that to the non-technical people the requirement came from.
    - samoa42 6y ago
      also perfect excuse to introduce some other usage of cookies https://news.ycombinator.com/item?id=24979895 https://news.ycombinator.com/item?id=24979895
    - encom 6y ago
      That shouldn't be very difficult. It's not a complex situation. I don't have a sign in front of my house saying "Beware of the dog", because I don't have a dog.
      - rootusrootus 6y ago
        OTOH, if you got asked often enough if you had a scary dog, you may consider putting up a sign saying "There is no dog here."
        JoshTriplett 6y ago
        At which point the more common question will become "what's with the sign?", and the sign may become the bigger source of concern. (See also https://knowyourmeme.com/memes/a-lot-of-questions-already-answered-by-the-shirt https://knowyourmeme.com/memes/a-lot-of-questions-already-an... .) You might instead consider asking people why they're asking, and figuring out ways to promote more widespread understanding. Concretely: you might actively promote adblockers and tell people why they should use them. And rather than saying "we don't use tracking cookies", you could explain "here's why so many sites have cookie banners, here's why we don't".
m1aw 6y ago
Is it necessary to get consent from the user about _cfduid? From what I understand functional cookies are excluded from the consent banner.
- achairapart 6y ago
  The problem with _cfduid is that it is essentially a third-party cookie (even if it's set on your own domain). So I think you are still required to inform users of the cookie usage, the purpose of the cookies and link to the relevant Cloudflare privacy/cookie policies.
  - jivings 6y ago
    This is what I assumed too.
- stjohnswarts 6y ago
  They wanted to get rid of cookies as much as possible as that's part of their business plan (privacy). So they found a better CDN that didn't use cookies at all, so I'd say they made out like a bandit.
distantsounds 6y ago
how to make a website sans cookies: don't use cookies. saved you all a click.
- raxxorrax 6y ago
  You could use localstorage and a script for setting/getting the info via xmlhttp. Technically not a cookie and there is nothing automatically send. I think cookies are great if they weren't abused as much. (not saying the site is using any alternative approaches, I think their ambition is laudable)
  - cseleborg 6y ago
    I believe localStorage is equivalent to cookies as far as the European cookie banner directive is concerned.
    - volument 6y ago
      The eDirective states that the browser and device information (like the URL) is private data and you need a permission to access it for non-essential purposes such as analytics. This is why Simple Analytics also needs a cookie banner, contrast to what their marketing says.
      - Vespasian 6y ago
        I'm not quite up to date, was it passed since 2018? I remember it being delayed quite a bit. My Google-Fu has proved insufficient.
        volument 6y ago
        EU is still working on a new version of the directive. I heard they have been doing it for three years now.
- cseleborg 6y ago
  Well... turns out, it's not that easy. I, too, removed the cookies from my website [1] and was thrilled to finally get rid of the cookie banner, but had to jump through some hoops: - It's a WooCommerce store. WooCommerce stores one persistent cookie to keep track of your cart. I had to hack up a little snippet of PHP code to turn that into a session cookie. It's not quite documented behavior, but the hack feels robust enough that I can live with it. (Sessions cookies are allowed, as per GDPR.) - YouTube embeds had to go, as even their youtube-nocookie domain sets cookies (thanks, YT). Vimeo has a "dnt" option that seems close to what I want, but it still sets some ID in localStorage, which the GDPR views as equivalent to cookies in this regard. So my current workaround is to just have the video thumbnail and link to the proper video on YT, but that sucks because now my visitors leave the website. - Replaced Google Analytics with self-hosted Matomo, carefully configured to not set cookies (it's not trivial), which now regularly brings my cheap hosted server to the limit ;-) So even a relatively simple website that does little fancy is not easy to get free of cookies. [1] https://dascask.com https://dascask.com
Hnrobert42 6y ago
In case leavemealone.app is reading these messages, I will leave this here. I failed to sign up. After clicking the sign up button, the button began pulsing but did nothing more. When I tried reporting the failure via chat, nothing happened when I clicked send. After clicking send, I noticed that my initial chat message had been truncated halfway. I don’t know if these two failures are related. I am using Firefox Focus on an iPhone 7 running iOS 14.1.
- jivings 6y ago
  We're getting a bit smashed by HN traffic right now and server is running a little more slow than usual! I hope you check back in a little while.
volument 6y ago
Cookies are not an issue for GDPR, it's all about respecting users' privacy. In fact you can freely store anonymous data to cookies, localStorage, and sessionStorage without issues. The problem comes when you are dealing with personally identifiable information such as permanent identifiers. You definitely need a "cookie banner" when using Simple Analytics, Fathom, or Plausible. Any service that accesses the device information such as the URL needs a permission from the user according the ePrivacy directive. We have consulted EU law specialists when building our upcoming analytics service that is as privacy-friendly as Simple Analytics, while still measuring important things like retention and conversions. More information: https://volument.com/learn/data-privacy https://volument.com/learn/data-privacy
- AdriaanvRossum 6y ago
  Founder of Simple Analytics [1] here. There is a lot of information around cookie banners that is just not true. For example cookies are not limited to the technology of cookies, it contains any piece of information that you can use the track a user. An IP address, localStorage, sessionStorage, ... You are allowed to add a functional cookie with a dark mode setting for example without a cookie banner. You can't use an analytics cookie without a cookie banner. What you are sharing is simply not true and I will clarify. A cookie banner is required when you store PII data. This is personal identifiable information. This includes, but is not limited to an IP address, a cookie with an user identifier, ... You are free to collect data that is not part of this without a cookie banner. You are also referring to a URL as being device information, this is not device information but basically a page view. You are allowed to collect page views and URLs that a linked to this page views with a cookie banner. You are describing retention for your business. That's only possible with a cookie banner. It makes perfect sense because you need to calculate retention somehow. If you can calculate retention and conversions you are tracking a user. So you need a cookie banner. Cookie banners are also a thing that are implemented on the web in many wrong ways. You should always have a way to disable cookies. Just a "accept all cookies" is legally invalid under the GDPR. The e-Privacy was already in place before the GDPR and the GDPR is somewhat a clarification of it. Simple Analytics does not use cookies and does not require a cookie banner. We don't track your visitors and don't calculate retention or conversions. If your service does this, they a tracking your user and you might need a cookie banner. [1] https://simpleanalytics.com https://simpleanalytics.com
jlelse 6y ago
BunnyCDN is nice! Switched from Cloudflare one or two years ago and not looking back, it's a "real" CDN and doesn't require cookies.
- pier25 6y ago
  I tried to use their push CDN service but I could never upload a file through their API. I went back and forth with support but nothing got solved. Also, the API for their dashboard was super slow for me. I mean waiting up to 10 seconds for every click on the dashboard or API interaction.
  - axelthegerman 6y ago
    Can't find it right now but I definitely uploaded some files via their API - weird you couldn't figure it out together with support. Also their pages load as fast as anything these days, no problem there either. Super happy with BunnyCDN - even the pricing!
  - gkbrk 6y ago
    I have a script [1] that uploads my website to BunnyCDN. [1]: https://github.com/gkbrk/scripts/blob/master/bunnycdn-sync.py https://github.com/gkbrk/scripts/blob/master/bunnycdn-sync.p...
    - pier25 6y ago
      Thanks, I don't know Python but it looks pretty standard. It's similar to what I did in Node.
      - axelthegerman 6y ago
        Ha I actually just came across my snippet - this is what I used in curl: curl -X PUT --data "@./<file>.html" -H 'AccessKey: <YOUR_KEY>' https://<REGION>.storage.bunnycdn.com/<SPACE>/<PATH>/<FILE> https://<REGION>.storage.bunnycdn.com/<SPACE>/<PATH>/<FILE>
  - 6y ago
Aldipower 6y ago
This is a really good write up! I wish more companies and SaaS put this the cookie-less directive on top of their priorities. We are do the same, expect we have a jwt-cookie, but which is strictly bound to our domain. Additionally we avoid third-party scripts and apps, fonts or things like the facebook commenting system. Basically all stuff sending user traces to foreign parties. We did a write-up about this here, if you are interessted, how we did it: https://www.tredict.com/blog/we_do_not_track_you/ https://www.tredict.com/blog/we_do_not_track_you/
Saar1991 6y ago
i like the idea of having a public analytics tracking page. How early in your journey did you introduce that?
- jivings 6y ago
  From the start!
tarasmatsyk 6y ago
This is an awesome idea, I really love the writing and products presented (TLDR; SimpleAnalytics, BunnyCDN, Intergram). Good luck with LMA, this is an awesome product IMO, the "cookies banner" does not help to make internet safer, only worsening UI, add a few more banners and there is no content left. How many people who don't know how internet works hit "Disagree" if we still refuse to pay for e-services
GordonS 6y ago
> This means we are now just using Cloudflare for DNS. But it's possible to hit this button again and re-enable Cloudflare forwarding temporarily if we find ourselves under attack, so I figure this is a good option. Without this enabled, attackers know what your backend IP address is, so even if you enabled it later, they could continue to DDOS your IP directly, without doing a DNS lookup. You'd only get what you want if you both re-enabled this and switched to different IP addresses.
- eloff 6y ago
  Also the Cloudflare cookie is clearly for technical purposes, not marketing. So no consent is needed under GDPR, in my understanding. Getting rid of it didn't accomplish anything useful.
  - calcifer 6y ago
    > Also the Cloudflare cookie is clearly for technical purposes, not marketing. How do you know that? Because they say so?
    - edoceo 6y ago
      Here's what they say for anyone who's looking https://www.cloudflare.com/en-gb/gdpr/introduction/ https://www.cloudflare.com/en-gb/gdpr/introduction/
- mattrick 6y ago
  You could firewall off non-Cloudflare requests: https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses https://support.cloudflare.com/hc/en-us/articles/201897700-A...
  - Okx 6y ago
    A software firewall is useless against a DDoS attack. It will only serve to help your IP not get discovered in the first place.
ThePhysicist 6y ago
Well, cookies are not per se evil and you can use them in a privacy-friendly way. You should ask for consent for non-functional cookies (for the Cloudflare cookie you probably wouldn't need to ask for consent, for example) and make sure your consent workflow is compliant with the GDPR. The European Data Protection Board just published guidelines on this btw (in May): https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... We e.g. offer an open-source consent management solution that is compliant with GDPR (as much as you can say that with confidence) and which you can self host: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro Building sites without cookies is possible but it's a bit extreme IMHO. Properly scoped and limited first-party cookies do not pose a large privacy risk to indivuals and can make certain legitimate use cases like analytics much easier (or even possible, in some cases).
varispeed 6y ago
Isn't the problem about actual tracking and not the cookies? If you track someone without using any cookie you still need to ask for consent. I kind of don't understand the this post. Can someone explain why is it okay to track someone without cookie?
- judge2020 6y ago
  Exactly - cookies are only the most used because they have the largest support by browsers (going back 10 years). If you used purely local storage instead, you’d still need consent to track.
- lmkg 6y ago
  GDPR regulates tracking individuals, and is not particular about the means or form. On the whole, GDPR is pretty sensible. There is an older law called the ePrivacy Directive that regulates cookies. Under this law, cookies require consent even if they are not used for tracking, unless they are strictly necessary for technical reasons. This law is a big pain the butt because many reasonable and legitimate uses for cookies aren't "strictly necessary." The ePrivacy Directive technically applies to reading or writing data from a browser, so it will equally apply to any fingerprinting method you care to think of.
aratob 6y ago
It's interesting to see the visitor stats [0] on the blog itself , provided by Simple Analytics: 12K hits for the blogpost, HN is the top traffic source with 7,5K referrals. [0]: https://simpleanalytics.com/blog.leavemealone.app https://simpleanalytics.com/blog.leavemealone.app
flibble 6y ago
Can anyone recommend and good articles on how to track paid advertising without being reliant on cookies?
Geee 6y ago
There's no cookie banner on apple.com, but they use cookies. There's a cookie banner on google.com, but no way to decline.
- maxton 6y ago
  Assuming Apple is only using cookies for technical purposes, like providing a way to log in or use a shopping cart, then there is no need to use a banner. Google needs the banner because they are using cookies for advertising and tracking purposes, and you can probably guess why there's no way to decline
the_gastropod 6y ago
A little bit off topic, but this thing looks suspiciously a lot like https://lunchmoney.app/ https://lunchmoney.app/ and as far as I can tell is totally unrelated. Even the Lunch Money logo is used under the pricing section... Is this just a coincidence / did Lunch Money also use some stock illustrations that’re used here? Or is just good old fashioned copying?
- jnfr 6y ago
  Lunch Money founder here! Thanks for flagging :) My guess is that it was definitely inspired by Lunch Money as the founders here have reached out to me before about liking my branding. I did not use any stock illustrations for our logo– the idea was thought up by me and subsequently digitally illustrated by me also. I've had my logo/branding both partly and fully copied time and time again, and while seeing this is a bit annoying, I'd chalk it up to "heavy inspiration" over out-right copying. That being said, Leave Me Alone is doing great stuff in a different space and I am rooting for their success.
ss3000 6y ago
I enjoyed the post and appreciate that more people are looking for privacy focused alternatives to traditional vendors. Though I'm disappointed hear that one of the conclusions seems to be there's no privacy-focused chat vendor that does something as simple as not collecting identifying information on users until they interact with the chat app, with integrated consent collection (which is essentially what they've implemented with their fork). Maybe the wider HN community might know of such a service?
- jivings 6y ago
  I think there's a gap in the market here!
- mickael-kerjean 6y ago
  There's ton of open source ones, I use intergram (https://github.com/idoco/intergram https://github.com/idoco/intergram) but there's more: - https://github.com/LiveHelperChat/livehelperchat https://github.com/LiveHelperChat/livehelperchat - https://github.com/chatwoot/chatwoot https://github.com/chatwoot/chatwoot - https://github.com/papercups-io/papercups https://github.com/papercups-io/papercups
amzans 6y ago
Super excited to see many websites exploring alternatives to the traditional services. This is pretty much how I got started on https://panelbear.com https://panelbear.com Feeling super lucky as I just launched last month and already several hundred websites are actively using it. There is a free plan if you just want to try it out.
jokethrowaway 6y ago
This is just feedback as a user and fellow maker - so you can calibrate your target audience (given that only people who care about being tracked are vocal on this): I love your service because I can easily get rid of crappy newsletter but I don't care if a website is tracking me and I'd prefer if you'd spend more time on the product instead of this bike shedding. I understand the marketing plan and getting traffic from HN and I respect that, but as a user, I'm slightly put off by this. I hate crappy emails like I hate cookie banners. It's not because of privacy concerns, it's because it's a PITA.

382 points by jivings 6y ago

TL:DR; We set out to have a no-cookie homepage. Replaced Google Analytics, Crisp Chat and Cloudflare with privacy friendly alternatives!

gcatalfamo 6y ago
How do you retarget on potentially interested customers?
- bochoh 6y ago
  I think the whole point of being privacy focused is that you don't retarget and your product sells by its own merits.
  - ponderingfish 6y ago
    That's hard and I hope they can achieve this strategy!
  - jamiequint 6y ago
    > your product sells by its own merits This is a common yet naive thing to say that is rarely ever true in practice.
- mrweasel 6y ago
  How effective is retargeting? I’m understand that it varys from business to business, but from what I saw 5 years ago in consumer electronic, gaming and toys, it’s not really going to be a significate revenue source. The retargeting most of us are see is the failed kind where you’re trying to sell a fridge to the person who already ordered one two days ago, and you’re the person who sold it, but your retargeting partner does actually support registering a purchases.
  - jsjohnst 6y ago
    > The retargeting most of us are see is the failed kind where you’re trying to sell a fridge to the person who already ordered one two days ago I’ve paid close attention over the past few years and have found >80% of the retargeted ads are for something I just purchased (and they are usually the “single purchase” type product, similar to the fridge analogy you used)
  - konha 6y ago
    Very effective. Even if a big share of your ad impressions falsely target someone who already bought (see sibling comment) the remaining impressions lead to an increase in conversions at a comparatively low cost per conversion. As you said, this will vary from business to business, but I have seen very successful retargeting campaigns in b2c e-commerce as well as b2b lead generation.
  - shostack 6y ago
    It varies by advertiser. Smart ones do incrementality testing to prove its added value and optimize accordingly.
criddell 6y ago
Just out of curiosity, how important is live chat? I don't think I've ever had a good experience using a site's chat function.
- jivings 6y ago
  We have a rather difficult onboarding process and users often message via the chat for help. For the homepage I'd say visitors message rarely so it is less useful. That said, the ones that do are usually the same who convert as they are already fairly qualified leads and just want a little extra info before they sign up.
- stjohnswarts 6y ago
  Back when I was doing web stuff for clients I got a lot of help through hostgator chat function and it was great. It all depends on how knowledgeable the person on the other side is. The medium is fine in and of itself.
  - criddell 6y ago
    I've had two types of experience. One - the person on the other end works for a different company and they can answer a few common questions, but everything else is "call this 800 number." Cell phone companies do this. Two - the person immediately says "give me your phone number and lets talk on the phone" (car dealers are terrible for this). I guess there is a third type - companies using a laughably terrible bot. I encountered this with Sony after I bought a game online and it wouldn't start. I eventually called in and they instantly refunded my money because I think it was a common problem.
    - BenjiWiebe 6y ago
      There is a fourth type. The MVNO I have my phone plan (and friends/family) with actually utilizes their live chat for support, and usually I get a very knowledgeable person in 30ish seconds. It's great. Red Pocket Mobile is the name.

villgax 6y ago

The cloudflare cookie still persists.

speedgoose 6y ago
I wish cloudfare could allow removing this cookie. I'm willing to pay for that feature.
- dkyc 6y ago
  That cookie can be disabled on Cloudflare's Enterprise plan [0] (which, to be fair, starts at like $60k a year). [0] https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682 https://support.cloudflare.com/hc/en-us/articles/200170156-U...
  - judge2020 6y ago
    The enterprise plan is a very custom plan - if you only need access to one or two features and/or only have a few million requests a month, the price can be pretty cheap (much less than the 5k/mo price advertised on the CF dashboard), but if you want mission-critical features like bot management[0], access to China datacenters[1], etc. it definitely can get into the 6-figure range - and they do have over 550 customers paying 6 figures or more [2]. But just getting one to remove the cookie is probably not worth it since it will end up costing more than a business plan (200/mo) regardless. 0: https://www.cloudflare.com/products/bot-management/ https://www.cloudflare.com/products/bot-management/ 1: https://www.cloudflare.com/network/china/ https://www.cloudflare.com/network/china/ 2: http://d18rn0p25nwr6d.cloudfront.net/CIK-0001477333/09769260-9f46-44c1-8597-90a682a7b219.pdf#page=63 http://d18rn0p25nwr6d.cloudfront.net/CIK-0001477333/09769260... (page 63)
    - eli 6y ago
      I think you can negotiate with them if you only need some enterprise features.
  - speedgoose 6y ago

Jsharm 6y ago

Naively did not realise using cloudflare as a cdn meant subjecting users to cookies. I don't have a consent banner... Does Netlify?

deleted 6y ago
[deleted]
donbrae 6y ago
Netlify doesn't seem to have a consent banner but sites hosted on it don't set cookies, despite using Cloudflare (at least that's my experience hosting a blog on it).
- iruoy 6y ago
  Netlify doesn't use cloudflare. Their DNS[1] is managed by NS1 and they host their websites on the edge[2] instead of using a cdn. [1]: https://ns1.com/blog/netlify-leverages-ns1-to-improve-performance-across-60-000-sites https://ns1.com/blog/netlify-leverages-ns1-to-improve-perfor... [2]: https://www.netlify.com/products/edge/ https://www.netlify.com/products/edge/
  - donbrae 6y ago
    Ah, thanks. Didn’t realise that.
wongarsu 6y ago
At least under EU cookie laws and GDPR you shouldn't need a consent banner for Cloudflare cookies, as they provide essential functions (for availability and security) and don't track users. You might have to mention them and their purpose in your privacy policy though. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies https://support.cloudflare.com/hc/en-us/articles/200170156-U... goes in some detail what the cookies do and (more importantly here) what they don't do.
- ancymon 6y ago

deleted 6y ago

[deleted]

danieleguia 6y ago

nice write-up with good suggestions on how to accomplish the no cookie page

danieleguia 6y ago

Nice write-up on how to make a cookie-free page. Thanks

eli 6y ago

> But it's possible to hit this button again and re-enable Cloudflare forwarding temporarily if we find ourselves under attack, so I figure this is a good option. Plan to redeploy your production server to a new IP address too since the attacker will still be able to hit it directly.

Waterluvian 6y ago
Can you not just reject or ignore all connections not coming from cloud flare? Or does that still do damage during a ddos?
- jgrahamc 6y ago
  That doesn't help if your pipe to the Internet is full (think Gbps) or if the router/switch can't process packets fast enough (think Mpps).
  - matteocontrini 6y ago
    Considering that the website the articles refers to is hosted on DigitalOcean, in this case the problem would be DigitalOcean's DDoS policy, which is basically null route the IP traffic for 4 hours or so when an attack is detected.

tarjei 6y ago

I've been thinking of trying to combine self-hosted analytics and adding ad info in the urls of ads so I can track if a user arrived at my site via an ad without divulging that to any third parties. Has anyone tried something like that? Did it work? Obviously what you give up is retargeting but that may have to go anyhow.

patja 6y ago
I always thought this was a fairly common practice so you can verify you are getting the ad traffic you paid for.
hapidjus 6y ago
Isn't this basically UTM Tracking?
wongarsu 6y ago
Tracking ads via URL parameters is pretty standard (utm parameters), and self-hosted matomo can be set to run without cookies. This means that some metrics can't be tracked [1]. The most impactful of those is attributing people to a campaign if come via an ad, view your website, but only convert after leaving and coming back some time later. If you leave cookies enabled everything just works just just as you would expect, with full conversion tracking etc. Some ad services try to optimize ads according to tracking data you send them, which obviously doesn't work if you don't run their tracking code. 1: https://matomo.org/faq/general/faq_156/ https://matomo.org/faq/general/faq_156/
marban 6y ago
I store the url param in a DB and rewrite the Url to a cleaned one via JS in case the user bookmarks the page.

romanovcode 6y ago

ERR_TOO_MANY_REDIRECTS

perlpimp 6y ago

Safari cannot open the page because too many redirects occurred.

jivings 6y ago
I assume HN hug of death! It's back now.

deleted 6y ago

[deleted]

stevage 6y ago

Urgh, the irony - can't open this page, because there is some problem to do with too many redirects. Which you can maybe fix by clearing cookies.

jivings 6y ago
Ghost instance crashed, I assume HN hug of death! It's back now.

donbrae 6y ago

Getting redirects too. The page on the Wayback Machine: http://web.archive.org/web/20201103140506/https://blog.leavemealone.app/no-more-cookies/ http://web.archive.org/web/20201103140506/https://blog.leave...

nwsm 6y ago

I was recently tasked with making an "Accept our use of cookies" banner for our public site. Before that banner we did not store any cookies at all; now we have one to store their consent.

unfunco 6y ago
If you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing.
- deleted 6y ago
  [deleted]
- TonyTrapp 6y ago
  Try explaining that to the non-technical people the requirement came from.
  - samoa42 6y ago
    also perfect excuse to introduce some other usage of cookies https://news.ycombinator.com/item?id=24979895 https://news.ycombinator.com/item?id=24979895
  - encom 6y ago
    That shouldn't be very difficult. It's not a complex situation. I don't have a sign in front of my house saying "Beware of the dog", because I don't have a dog.
    - rootusrootus 6y ago
      OTOH, if you got asked often enough if you had a scary dog, you may consider putting up a sign saying "There is no dog here."
      - JoshTriplett 6y ago
        At which point the more common question will become "what's with the sign?", and the sign may become the bigger source of concern. (See also https://knowyourmeme.com/memes/a-lot-of-questions-already-answered-by-the-shirt https://knowyourmeme.com/memes/a-lot-of-questions-already-an... .) You might instead consider asking people why they're asking, and figuring out ways to promote more widespread understanding. Concretely: you might actively promote adblockers and tell people why they should use them. And rather than saying "we don't use tracking cookies", you could explain "here's why so many sites have cookie banners, here's why we don't".

m1aw 6y ago

Is it necessary to get consent from the user about _cfduid? From what I understand functional cookies are excluded from the consent banner.

achairapart 6y ago
The problem with _cfduid is that it is essentially a third-party cookie (even if it's set on your own domain). So I think you are still required to inform users of the cookie usage, the purpose of the cookies and link to the relevant Cloudflare privacy/cookie policies.
- jivings 6y ago
  This is what I assumed too.
stjohnswarts 6y ago
They wanted to get rid of cookies as much as possible as that's part of their business plan (privacy). So they found a better CDN that didn't use cookies at all, so I'd say they made out like a bandit.

distantsounds 6y ago

how to make a website sans cookies: don't use cookies. saved you all a click.

raxxorrax 6y ago
You could use localstorage and a script for setting/getting the info via xmlhttp. Technically not a cookie and there is nothing automatically send. I think cookies are great if they weren't abused as much. (not saying the site is using any alternative approaches, I think their ambition is laudable)
- cseleborg 6y ago
  I believe localStorage is equivalent to cookies as far as the European cookie banner directive is concerned.
  - volument 6y ago
    The eDirective states that the browser and device information (like the URL) is private data and you need a permission to access it for non-essential purposes such as analytics. This is why Simple Analytics also needs a cookie banner, contrast to what their marketing says.
    - Vespasian 6y ago
      I'm not quite up to date, was it passed since 2018? I remember it being delayed quite a bit. My Google-Fu has proved insufficient.
      - volument 6y ago
        EU is still working on a new version of the directive. I heard they have been doing it for three years now.
cseleborg 6y ago
Well... turns out, it's not that easy. I, too, removed the cookies from my website [1] and was thrilled to finally get rid of the cookie banner, but had to jump through some hoops: - It's a WooCommerce store. WooCommerce stores one persistent cookie to keep track of your cart. I had to hack up a little snippet of PHP code to turn that into a session cookie. It's not quite documented behavior, but the hack feels robust enough that I can live with it. (Sessions cookies are allowed, as per GDPR.) - YouTube embeds had to go, as even their youtube-nocookie domain sets cookies (thanks, YT). Vimeo has a "dnt" option that seems close to what I want, but it still sets some ID in localStorage, which the GDPR views as equivalent to cookies in this regard. So my current workaround is to just have the video thumbnail and link to the proper video on YT, but that sucks because now my visitors leave the website. - Replaced Google Analytics with self-hosted Matomo, carefully configured to not set cookies (it's not trivial), which now regularly brings my cheap hosted server to the limit ;-) So even a relatively simple website that does little fancy is not easy to get free of cookies. [1] https://dascask.com https://dascask.com

Hnrobert42 6y ago

In case leavemealone.app is reading these messages, I will leave this here. I failed to sign up. After clicking the sign up button, the button began pulsing but did nothing more. When I tried reporting the failure via chat, nothing happened when I clicked send. After clicking send, I noticed that my initial chat message had been truncated halfway. I don’t know if these two failures are related. I am using Firefox Focus on an iPhone 7 running iOS 14.1.

jivings 6y ago
We're getting a bit smashed by HN traffic right now and server is running a little more slow than usual! I hope you check back in a little while.

volument 6y ago

Cookies are not an issue for GDPR, it's all about respecting users' privacy. In fact you can freely store anonymous data to cookies, localStorage, and sessionStorage without issues. The problem comes when you are dealing with personally identifiable information such as permanent identifiers. You definitely need a "cookie banner" when using Simple Analytics, Fathom, or Plausible. Any service that accesses the device information such as the URL needs a permission from the user according the ePrivacy directive. We have consulted EU law specialists when building our upcoming analytics service that is as privacy-friendly as Simple Analytics, while still measuring important things like retention and conversions. More information: https://volument.com/learn/data-privacy https://volument.com/learn/data-privacy

AdriaanvRossum 6y ago
Founder of Simple Analytics [1] here. There is a lot of information around cookie banners that is just not true. For example cookies are not limited to the technology of cookies, it contains any piece of information that you can use the track a user. An IP address, localStorage, sessionStorage, ... You are allowed to add a functional cookie with a dark mode setting for example without a cookie banner. You can't use an analytics cookie without a cookie banner. What you are sharing is simply not true and I will clarify. A cookie banner is required when you store PII data. This is personal identifiable information. This includes, but is not limited to an IP address, a cookie with an user identifier, ... You are free to collect data that is not part of this without a cookie banner. You are also referring to a URL as being device information, this is not device information but basically a page view. You are allowed to collect page views and URLs that a linked to this page views with a cookie banner. You are describing retention for your business. That's only possible with a cookie banner. It makes perfect sense because you need to calculate retention somehow. If you can calculate retention and conversions you are tracking a user. So you need a cookie banner. Cookie banners are also a thing that are implemented on the web in many wrong ways. You should always have a way to disable cookies. Just a "accept all cookies" is legally invalid under the GDPR. The e-Privacy was already in place before the GDPR and the GDPR is somewhat a clarification of it. Simple Analytics does not use cookies and does not require a cookie banner. We don't track your visitors and don't calculate retention or conversions. If your service does this, they a tracking your user and you might need a cookie banner. [1] https://simpleanalytics.com https://simpleanalytics.com

jlelse 6y ago

BunnyCDN is nice! Switched from Cloudflare one or two years ago and not looking back, it's a "real" CDN and doesn't require cookies.

pier25 6y ago
I tried to use their push CDN service but I could never upload a file through their API. I went back and forth with support but nothing got solved. Also, the API for their dashboard was super slow for me. I mean waiting up to 10 seconds for every click on the dashboard or API interaction.
- axelthegerman 6y ago
  Can't find it right now but I definitely uploaded some files via their API - weird you couldn't figure it out together with support. Also their pages load as fast as anything these days, no problem there either. Super happy with BunnyCDN - even the pricing!
- gkbrk 6y ago
  I have a script [1] that uploads my website to BunnyCDN. [1]: https://github.com/gkbrk/scripts/blob/master/bunnycdn-sync.py https://github.com/gkbrk/scripts/blob/master/bunnycdn-sync.p...
  - pier25 6y ago
    Thanks, I don't know Python but it looks pretty standard. It's similar to what I did in Node.
    - axelthegerman 6y ago
      Ha I actually just came across my snippet - this is what I used in curl: curl -X PUT --data "@./<file>.html" -H 'AccessKey: <YOUR_KEY>' https://<REGION>.storage.bunnycdn.com/<SPACE>/<PATH>/<FILE> https://<REGION>.storage.bunnycdn.com/<SPACE>/<PATH>/<FILE>
- 6y ago

Aldipower 6y ago

This is a really good write up! I wish more companies and SaaS put this the cookie-less directive on top of their priorities. We are do the same, expect we have a jwt-cookie, but which is strictly bound to our domain. Additionally we avoid third-party scripts and apps, fonts or things like the facebook commenting system. Basically all stuff sending user traces to foreign parties. We did a write-up about this here, if you are interessted, how we did it: https://www.tredict.com/blog/we_do_not_track_you/ https://www.tredict.com/blog/we_do_not_track_you/

Saar1991 6y ago

i like the idea of having a public analytics tracking page. How early in your journey did you introduce that?

jivings 6y ago
From the start!

tarasmatsyk 6y ago

This is an awesome idea, I really love the writing and products presented (TLDR; SimpleAnalytics, BunnyCDN, Intergram). Good luck with LMA, this is an awesome product IMO, the "cookies banner" does not help to make internet safer, only worsening UI, add a few more banners and there is no content left. How many people who don't know how internet works hit "Disagree" if we still refuse to pay for e-services

GordonS 6y ago

> This means we are now just using Cloudflare for DNS. But it's possible to hit this button again and re-enable Cloudflare forwarding temporarily if we find ourselves under attack, so I figure this is a good option. Without this enabled, attackers know what your backend IP address is, so even if you enabled it later, they could continue to DDOS your IP directly, without doing a DNS lookup. You'd only get what you want if you both re-enabled this and switched to different IP addresses.

eloff 6y ago
Also the Cloudflare cookie is clearly for technical purposes, not marketing. So no consent is needed under GDPR, in my understanding. Getting rid of it didn't accomplish anything useful.
- calcifer 6y ago
  > Also the Cloudflare cookie is clearly for technical purposes, not marketing. How do you know that? Because they say so?
  - edoceo 6y ago
    Here's what they say for anyone who's looking https://www.cloudflare.com/en-gb/gdpr/introduction/ https://www.cloudflare.com/en-gb/gdpr/introduction/
mattrick 6y ago
You could firewall off non-Cloudflare requests: https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses https://support.cloudflare.com/hc/en-us/articles/201897700-A...
- Okx 6y ago
  A software firewall is useless against a DDoS attack. It will only serve to help your IP not get discovered in the first place.

ThePhysicist 6y ago

Well, cookies are not per se evil and you can use them in a privacy-friendly way. You should ask for consent for non-functional cookies (for the Cloudflare cookie you probably wouldn't need to ask for consent, for example) and make sure your consent workflow is compliant with the GDPR. The European Data Protection Board just published guidelines on this btw (in May): https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... We e.g. offer an open-source consent management solution that is compliant with GDPR (as much as you can say that with confidence) and which you can self host: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro Building sites without cookies is possible but it's a bit extreme IMHO. Properly scoped and limited first-party cookies do not pose a large privacy risk to indivuals and can make certain legitimate use cases like analytics much easier (or even possible, in some cases).

varispeed 6y ago

Isn't the problem about actual tracking and not the cookies? If you track someone without using any cookie you still need to ask for consent. I kind of don't understand the this post. Can someone explain why is it okay to track someone without cookie?

judge2020 6y ago
Exactly - cookies are only the most used because they have the largest support by browsers (going back 10 years). If you used purely local storage instead, you’d still need consent to track.
lmkg 6y ago
GDPR regulates tracking individuals, and is not particular about the means or form. On the whole, GDPR is pretty sensible. There is an older law called the ePrivacy Directive that regulates cookies. Under this law, cookies require consent even if they are not used for tracking, unless they are strictly necessary for technical reasons. This law is a big pain the butt because many reasonable and legitimate uses for cookies aren't "strictly necessary." The ePrivacy Directive technically applies to reading or writing data from a browser, so it will equally apply to any fingerprinting method you care to think of.

aratob 6y ago

It's interesting to see the visitor stats [0] on the blog itself , provided by Simple Analytics: 12K hits for the blogpost, HN is the top traffic source with 7,5K referrals. [0]: https://simpleanalytics.com/blog.leavemealone.app https://simpleanalytics.com/blog.leavemealone.app

flibble 6y ago

Can anyone recommend and good articles on how to track paid advertising without being reliant on cookies?

Geee 6y ago

There's no cookie banner on apple.com, but they use cookies. There's a cookie banner on google.com, but no way to decline.

maxton 6y ago
Assuming Apple is only using cookies for technical purposes, like providing a way to log in or use a shopping cart, then there is no need to use a banner. Google needs the banner because they are using cookies for advertising and tracking purposes, and you can probably guess why there's no way to decline

the_gastropod 6y ago

A little bit off topic, but this thing looks suspiciously a lot like https://lunchmoney.app/ https://lunchmoney.app/ and as far as I can tell is totally unrelated. Even the Lunch Money logo is used under the pricing section... Is this just a coincidence / did Lunch Money also use some stock illustrations that’re used here? Or is just good old fashioned copying?

jnfr 6y ago
Lunch Money founder here! Thanks for flagging :) My guess is that it was definitely inspired by Lunch Money as the founders here have reached out to me before about liking my branding. I did not use any stock illustrations for our logo– the idea was thought up by me and subsequently digitally illustrated by me also. I've had my logo/branding both partly and fully copied time and time again, and while seeing this is a bit annoying, I'd chalk it up to "heavy inspiration" over out-right copying. That being said, Leave Me Alone is doing great stuff in a different space and I am rooting for their success.

ss3000 6y ago

I enjoyed the post and appreciate that more people are looking for privacy focused alternatives to traditional vendors. Though I'm disappointed hear that one of the conclusions seems to be there's no privacy-focused chat vendor that does something as simple as not collecting identifying information on users until they interact with the chat app, with integrated consent collection (which is essentially what they've implemented with their fork). Maybe the wider HN community might know of such a service?

jivings 6y ago
I think there's a gap in the market here!
mickael-kerjean 6y ago
There's ton of open source ones, I use intergram (https://github.com/idoco/intergram https://github.com/idoco/intergram) but there's more: - https://github.com/LiveHelperChat/livehelperchat https://github.com/LiveHelperChat/livehelperchat - https://github.com/chatwoot/chatwoot https://github.com/chatwoot/chatwoot - https://github.com/papercups-io/papercups https://github.com/papercups-io/papercups

amzans 6y ago

Super excited to see many websites exploring alternatives to the traditional services. This is pretty much how I got started on https://panelbear.com https://panelbear.com Feeling super lucky as I just launched last month and already several hundred websites are actively using it. There is a free plan if you just want to try it out.

jokethrowaway 6y ago

This is just feedback as a user and fellow maker - so you can calibrate your target audience (given that only people who care about being tracked are vocal on this): I love your service because I can easily get rid of crappy newsletter but I don't care if a website is tracking me and I'd prefer if you'd spend more time on the product instead of this bike shedding. I understand the marketing plan and getting traffic from HN and I respect that, but as a user, I'm slightly put off by this. I hate crappy emails like I hate cookie banners. It's not because of privacy concerns, it's because it's a PITA.