3 ms·

Wait, SaaS is evil now? Even if track.a.com and track.b.com are both CNAMEd to eviltracker.com, the server at eviltracker.com doesn't have any special ability

Wait, SaaS is evil now? Even if track.a.com and track.b.com are both CNAMEd to eviltracker.com, the server at eviltracker.com doesn't have any special ability to crossreference traffic between those two domains. At this point, you're effectively blocking first party tracking. Except, if you make it hard for sites to employ even SaaS-based first-party tracking solutions, then you probably encourage them to roll their own or use hosted first-party tracking, which is less likely to support features like cookie opt-outs or GDPR compliant data handling.

viraptor 6y ago
> server at eviltracker.com doesn't have any special ability to crossreference traffic between those two domains Sure it does. It generates the IDs in the first place, so it knows how if they match between the sites. Not perfectly precisely (at least not for now), but with high confidence by the source of traffic and browser fingerprint. > use hosted first-party tracking, which is less likely to support features like cookie opt-outs or GDPR compliant data handling On the other hand it doesn't aggregate data between unrelated services. And the first party can access a lot of the same data just from standard logs.