4 ms·

The basic functionality of Google Analytics does not have a way to identify you server-side. It uses first party cookies and does not store personally identifyi

The basic functionality of Google Analytics does not have a way to identify you server-side. It uses first party cookies and does not store personally identifying information. Therefore the only reliable way to opt out of it is client-side. Obviously ad blockers will accomplish that. But Google can’t just tell people “go install ublock origin.” It’s not a project under their control and they’re not going to vouch for it in that way. And of course they don’t want to promote ad blocking in general. One of the comments posted the code; it seems pretty simple. It looks like it just tells every website the same thing: basically “this browser opts out of GA.”

fault1 5y ago
> The basic functionality of Google Analytics does not have a way to identify you server-side. I know that used to be true, but is that true anymore? I saw comments like this in previous discussions about this snippet: https://news.ycombinator.com/item?id=18680149 https://news.ycombinator.com/item?id=18680149
Nextgrid 5y ago
> The basic functionality of Google Analytics does not have a way to identify you server-side You absolutely can identify someone server-side with heuristics. Your browser sends its IP address, user-agent and possibly referer header at a minimum when fetching the Google Analytics JS, and I'm not even talking about fingerprinting your TCP or TLS stack.
- judge2020 5y ago
  user-agents are becoming increasingly frozen[0], and IP addresses are getting even more temporary with IPv6 (they already are for mobile networks). It's indeed possible to tie a browser to a user account server-side without cookies, but it's by no means reliable and providing a guarantee based on circumstances you can't control is a terrible idea. 0: https://chromestatus.com/feature/5704553745874944 https://chromestatus.com/feature/5704553745874944
  - deleted 5y ago
    [deleted]
  - jspazz 5y ago
    > IP addresses are getting even more temporary with IPv6 That's true but kinda irrelevant. IPv6 is at best as bad for privacy as static IPv4 since you're assigned a fixed range, so the adversary can both identify you by the static part of your address, and possibly resolve devices behind the router which would be hidden by NAT in IPv4.
greyface- 5y ago
They could have opted to respect the DNT header.
- ratww 5y ago
  They control the browser and the server, so they could also implement GPC if they have any objections to DNT. https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/
- dylan604 5y ago
  bwhahahahaha, Googs respecting user choices. LOL. you should try stand up. seriously though, to expect the Googs to do anything that would negatively impact their operations is just naive or super hopeful the world is a nice place. It would be nice to live in a world like that, but sadly it's not this one. Am I just super cynical? Maybe, but it's companies like Googs that have made me that way.
deleted 5y ago
[deleted]
XCSme 5y ago
I provide a self-hosted analytics platform and I have the same issue. Also, if someone sends an email requesting to have their session stats somehow deleted, it's almost impossible as I can't link their session to their person in any way, so I can't know which one to delete.

fault1 5y ago

> The basic functionality of Google Analytics does not have a way to identify you server-side. I know that used to be true, but is that true anymore? I saw comments like this in previous discussions about this snippet: https://news.ycombinator.com/item?id=18680149 https://news.ycombinator.com/item?id=18680149

Nextgrid 5y ago

> The basic functionality of Google Analytics does not have a way to identify you server-side You absolutely can identify someone server-side with heuristics. Your browser sends its IP address, user-agent and possibly referer header at a minimum when fetching the Google Analytics JS, and I'm not even talking about fingerprinting your TCP or TLS stack.

judge2020 5y ago
user-agents are becoming increasingly frozen[0], and IP addresses are getting even more temporary with IPv6 (they already are for mobile networks). It's indeed possible to tie a browser to a user account server-side without cookies, but it's by no means reliable and providing a guarantee based on circumstances you can't control is a terrible idea. 0: https://chromestatus.com/feature/5704553745874944 https://chromestatus.com/feature/5704553745874944
- deleted 5y ago
  [deleted]
- jspazz 5y ago
  > IP addresses are getting even more temporary with IPv6 That's true but kinda irrelevant. IPv6 is at best as bad for privacy as static IPv4 since you're assigned a fixed range, so the adversary can both identify you by the static part of your address, and possibly resolve devices behind the router which would be hidden by NAT in IPv4.

greyface- 5y ago

They could have opted to respect the DNT header.

ratww 5y ago
They control the browser and the server, so they could also implement GPC if they have any objections to DNT. https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/
dylan604 5y ago
bwhahahahaha, Googs respecting user choices. LOL. you should try stand up. seriously though, to expect the Googs to do anything that would negatively impact their operations is just naive or super hopeful the world is a nice place. It would be nice to live in a world like that, but sadly it's not this one. Am I just super cynical? Maybe, but it's companies like Googs that have made me that way.

deleted 5y ago

[deleted]

XCSme 5y ago

I provide a self-hosted analytics platform and I have the same issue. Also, if someone sends an email requesting to have their session stats somehow deleted, it's almost impossible as I can't link their session to their person in any way, so I can't know which one to delete.