20 ms·

Is Google Analytics illegal in your country?

323 points by james_impliu 5y ago

sneak 5y ago
I frequently wonder what sort of tracking, if any, is happening via fonts.google.com and gstatic.com which are used widely across the web. Many sites break if you block resources from gstatic.com, as they depend on javascript libraries from it. The shortsightedness of using remote static assets on your own site is amazing to me.
melissalobos 5y ago
I like the scrolling banner on the side reminiscent of a news ticker being used for static data, it adds some vibrancy to the presentation. It might be nice to have more of the globe shown on the front, since it isn't "isgoogleanalyticsillegalintheEU". I really like the color scheme too, nice job!
- Cyberdog 5y ago
  I disagree about the "ticker." Items moving on a page without my request and particularly without any purpose are annoying to me at the best. Sadly, such nonsense is quite common in modern web design.
  - toqy 5y ago
    Plenty is wrong with the modern web, but this is harmless and seems to fit the theme well
  - alpaca128 5y ago
    I'm usually the first to complain about things like that as well as I'm very easily distracted, but in this case I think it's not that bad and looks kinda nice. I still wish websites would not only respect the disabled autoplay setting but also stop animations completely in that state. But right now it seems crashing video player UIs are the best we can get.
    - toqy 5y ago
      There's prefers-reduced-motion[1] but I don't think many sites actually implement anything for it. This one is open source though so someone that cares could submit a PR 1. https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...
      - alpaca128 5y ago
        Great to know, maybe one day this stuff catches on. tl;dr for enabling this in Firefox: about:config > add numeric ui.prefersReducedMotion field > set value to 1
  - BlueTemplar 5y ago
    Geocities might disagree about the "modern" part...
- donkarma 5y ago
  reminds me of PAYDAY 2
- deleted 5y ago
  [deleted]
GranPC 5y ago
Meta: this website consistently crashes my browser (Firefox on Linux) if I move the mouse in and out of the map a couple of times. Does this happen to anyone else? (edit: demo video url: https://dabbleam.com/jesus/Screen%20record%20from%202022-01-19%2016.13.28.mp4 https://dabbleam.com/jesus/Screen%20record%20from%202022-01-...) Edit 2: doesn't crash on a fresh Firefox profile. Crashes upon enabling gfx.webrender.all, gfx.webrender.compositor and gfx.webrender.compositor.force-enabled. Very intriguing stuff, I'll file a bug.
- spicybright 5y ago
  FF under macos. The entire page lags like crazy when hovering in or out of the map. What are they even doing to make that happen lol
- jacquesm 5y ago
  Checked, also FF on Linux, works here, no crash.
- melissalobos 5y ago
  Latest stable Firefox on Arch, it doesn't crash but the person stops moving after a few times.
- smoyer 5y ago
  FF 97.0b4 on Xubuntu 20.04 (up-to-date) - no crash mousing over the map (whether it's a highlighted country or now).
- alpaca128 5y ago
  Nope, FF 95.0.1 on Linux doesn't crash for me.
- rickstanley 5y ago
  Doesn't crash on Windows, but boy it uses CPU to the last register; it goes up to 95% usage.
taubek 5y ago
If it is illegal in one country does it make illegal in all other EU countries as well or is this left to individual law systems of each EU member state? BTW. your site looks great. I like the running ticker on the side.
- jacquesm 5y ago
  As mentioned in another thread on this subject: EU privacy law is harmonized, there may be local exceptions but these are increasingly rare and over time I would expect them to fade away completely. Note that the ruling confirms the GDPR, the EU legislation.
- lmkg 5y ago
  As a USAian, my rough impression is that it's similar to circuit splits in Federal courts. GDPR is a Regulation (not a Directive), so it's law in all EU states. But each country's court may interpret its requirements slightly differently. A ruling from the Court of Justice of the European Union (CJEU) would be binding on all member states. And in fact most rulings around Google Analytics are dealing with the boundaries of a CJEU ruling, Schrems II.
- roblabla 5y ago
  this kinda depends. I'm not 100% sure what kind of "law" the GDPR, but if it's a directive (which I think it is?), then each member state must implement a law that satisfies the GDPR requirements. Member states may chose to pass stricter laws than the GDPR technically requires, which could make something illegal in one EU country but not all the others. Also, enforcement may be very inconsistent, since it is mostly left to each member state to handle. EDIT: NVM, GDPR is a Regulation, not a Directive, so it's automatically law everywhere in Europe.
freshpots 5y ago
Your connection is not private Attackers might be trying to steal your information from isgoogleanalyticsillegal.com (for example, passwords, messages or credit cards). Learn more NET::ERR_CERT_AUTHORITY_INVALID No thanks.
- RedShift1 5y ago
  It's a Let's Encrypt certificate issued by R3, perhaps your root certs are not up to date?
  - wila 5y ago
    In particular because of this issue: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe...
- melissalobos 5y ago
  Huh, it is working for me. It looks like a valid cert from Let's Encrypt to me. Do you have any more details? So maybe the author can fix it.
- justsomehnguy 5y ago
  And this is why all that scary pages without explanation sucks. There is needed too many clicks to actually see the chain and certs.
  - alpaca128 5y ago
    Especially because you can get errors like that just from having an incorrect date/time set on the device. Confused me a few times.
- bastardoperator 5y ago
  LGTM, sure you're not having an issue on your side? I even see http redirect to https. Cert was also issued yesterday.
- 5y ago
ArtemZ 5y ago
hrdwdmrbl 5y ago
GDPR has gone too far. Privacy yes. Encryption yes. Data portability yes. Permissionless selling of personal data no. But the rules are nonsensical at this point.
- pgalvin 5y ago
  Could you elaborate? Which parts of the GDPR do you disagree with?
schleck8 5y ago
> PostHog is the only open source product analytics platform where customer data never leaves your infrastructure That's wrong. I can give you 3 other open source selfhosted options off the top of my head: Offen, Counter, Matomo. Edit: I just saw that their "alternatives to google analytics" page shows posthog's competitors as well and you can submit prs to add further options, fair play! https://isgoogleanalyticsillegal.com/alternatives https://isgoogleanalyticsillegal.com/alternatives
- deepstack 5y ago
  Got a 404 when going to the link.
  - deleted 5y ago
    [deleted]
  - schleck8 5y ago
    They might have changed it just now, or I copied the wrong one. Either way I replaced it with the correct url
  - timgl 5y ago
    Sorry! Had to rename it because of issues with uBlock ironically [0]. New URL is https://isgoogleanalyticsillegal.com/alternatives/ https://isgoogleanalyticsillegal.com/alternatives/ [0] https://news.ycombinator.com/item?id=29994768 https://news.ycombinator.com/item?id=29994768
- kingcharles 5y ago
  "Plausible" is another, even if I don't like their support.
  - Volker_W 5y ago
    Why don't you like plausible?
    - 5y ago
paulgb 5y ago
Funny enough, ublock (stock install) completely breaks the “alternatives” page. It must do some pattern matching on "component---src-pages-google-analytics-alternatives-js-8d1eb2b4c6482dba3dfd.js" and decide it's suspicious enough to deny it, even though it's a first-party request.
- toqy 5y ago
  It will block anything with google analytics string in it I think. We had a small google analytics image/link on an internal website that linked to some relevant GA dashboard and the image was blocked / hidden by ublock and possibly others. Changing the name fixed it.
- melissalobos 5y ago
  It is because it has google-analytics in the title of the resource: Rule: `-google-analytics-$script,domain=~wordpress.org` URL: https://isgoogleanalyticsillegal.com/component---src-pages-google-analytics-alternatives-js-8d1eb2b4c6482dba3dfd.js https://isgoogleanalyticsillegal.com/component---src-pages-g... Edit: Couldn't get this formatted well, but it has google-analytics highlighted in the URL
- timgl 5y ago
  Ha! I've renamed that page so this should work now!
yessirwhatever 5y ago
I dislike Google and their products pretty much universally, but having this sort of thing done by a competitor is not just distasteful, I see it as verging on corporatism. Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software. All tracking is bad, from Google or not. I understand the "companies need to make informed decisions" argument but I disagree with it, mainly because tracking software is involuntary and it's in the interest of the tracking software maker and the company using it to make it as stealthy as possible. PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq?hl=en#what_does_usin...
- franklampard 5y ago
  Isn’t a legal product a better one than an illegal counterpart?
  - amelius 5y ago
    Nope. It's because the illegal product has lower cost (because complying to regulations costs money one way or the other).
    - deleted 5y ago
      [deleted]
    - IanCal 5y ago
      It may not be cheaper when you have to deal with the repercussions of breaking the law though.
      - amelius 5y ago
        Those are usually just slaps on the wrist.
    - 5y ago
ritmatter 5y ago
This site seems like a great example of how the EU forces productive folks to jump through all kinds of regulatory hoops. Hopefully it’ll help them navigate the complex legislation.
- Rilfeu 5y ago
  The automotive industry has safety regulations. Why shouldn't IT have some regulation as well?
- marginalia_nu 5y ago
  This has been inevitable for years. The fact that 'productive folks' have been engaged in a chicken race with the regulators since GDPR came along in 2016 is entirely on them. The second shoe dropped with Schrems II in 2020, and the race to find plausible technicalities to keep doing the same thing continued. Still no real attempt at fixing the problems. If they had followed the spirit of the law rather than trying to get away with dubious technicalities, there would be no mad scramble to fix things now when it turned out those technicalities were in fact hopeful thinking at best.
- amelius 5y ago
  You're only on the watchdog's radars when you are a large company, in which case you should have an entire department devoted to complying to legislation anyway.
  - foxfluff 5y ago
    Even private individuals have been smacked with GDPR fines.
    - Volker_W 5y ago
      Do you have good examples?
      - lmkg 5y ago
        Go to https://www.enforcementtracker.com https://www.enforcementtracker.com, which collects and publishes GDPR fine information. Type in "Private Individual" as a filter in the "Controller/Processor" column. I see twenty-ish results, mostly from Spain. My Spanish is rusty and non-technical, but I think some of those fines are about posting videos to social media.
hericium 5y ago
Very specific domain name. Is Tag Manager different from Analytics? Have you seen Fonts' TOS?
Cenk 5y ago
Brought to you by PostHog. See also this tool by Fathom: https://illegal.analyticsscanner.com https://illegal.analyticsscanner.com
jhoelzel 5y ago
Welp Technically yes everywhere and it has been that way since the gdpr Practically this is the number one reason for our nice "attention, do not resits, we are using cookies on your electronic machinery" popups. For quite a few sites its the only cookie you actually accept. Its a s**t show really. Every single client ever now needs to have a cookie popup because google is going to punish you in your rankings if you do not use their integrations too. And if you do use their integrations... you need a popup.... and dont even get me started about "legitimate interest". But this is the way... I opt out as much as I can and block through the router as well as ublock. The most interesting thing that i noticed is that if you block third party cookies in safari on your phone, some sites will show you a blank screen. Timescale does this (I have reported this as a bug month ago but never received feedback). Its an amazing feature by now: - the page loads and you can see the content - the page trys to show you the cookie popup - since i dont have any cookies allowed, the script will just completly blank out my page welp. welcome to the future. Its not neccesarily better, but I can see them all now, which i guess is at least a step in the right direction.
- Volker_W 5y ago
  > Every single client ever now needs to have a cookie popup because google is going to punish you in your rankings if you do not use their integrations too. Source/proof?
  - deleted 5y ago
    [deleted]
- morelisp 5y ago
  > For quite a few sites its the only cookie you actually accept. If true, they don't need to show the popup. > google is going to punish you in your rankings if you do not use their integrations too. If you have evidence of this it would be the basis of a massive antitrust case. (I'm not disagreeing and would not be too surprised, but - real evidence is thin unless you include the AMP carousel which is not technically part of "rankings".)
kmeisthax 5y ago
Note that this isn't purely "do not use Google Analytics"; it's "do not export EU data". For context, there used to be a trade agreement to ensure EU companies were still allowed to use US server hosts, called US Privacy Shield; but that was torpedoed by other legal rulings. TBH, I personally do not understand how it is legal to provide a single shared service in the face of data localization requirements, especially if other countries were to adopt similar rules. Is it just a matter of having separate shards for each jurisdiction? Or do we need to instance the entire application so that US users don't even see EU users and vice-versa? Most off-the-shelf/FOSS webapps aren't built to be sharded this way, they assume One Big Database that has everything. That would include some of the GA alternatives they list; which, again, is a problem if those apps don't shard users by jurisdiction. I suppose for now, just hosting everything in the EU is fine, if only because the other jurisdictions with data localization requirements[0] pretty much can't be served with a shared application anyway. I'm imagining that's what the person who built this was figuring it would be used for. But if the US starts demanding data localization, the Internet is fucked. [0] China, AFAIK
- rileymat2 5y ago
  “ But if the US starts demanding data localization, the Internet is fucked.” The the demands that tiktok be sold?
  - kmeisthax 5y ago
    TikTok is an unusual case, because the US was determined to ratfuck Chinese social media apps a few years back. The executive orders in question only applied to a handful of companies in one country. There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. A general data localization requirement in US law would mean an end to self-hosting one website and serving two jurisdictions for the majority of web users.
    - pyrale 5y ago
      > There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. US claims are wider in scope, since they demand services operating in the US to hand over data, wherever it's located, and wherever the users it's about are located.
sdoering 5y ago
> This message is brought to you by > PostHog is the only open source product analytics platform where customer data never leaves your infrastructure. Hosting my own Matomo installation I beg to differ. Matomo is open source and my visitors data never leaves my own server. Except they only do backend tracking and see https traffic from website frontend tracking reaching my analytics server as it "leaves your infrastructure". But they at least made one thing obviously clear to me. I would never consider using them in the future. Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). So not caring about the law when implementing GA and doing it just wrong is forbidden in Austria. Who would have thought. Using it correctly and adhering to data privacy best practices is just fine with GA.
- ratww 5y ago
  > Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). That's some very interesting information. So, the real answer to the question of whether it's illegal in Austria or not is a "MAYBE", and it is quite easy to make it legal? If so, that should be on this site.
- ceejayoz 5y ago
  > Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). I've only got a machine translation of the ruling (https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_EN_bk.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...), but it includes: "The specific IP address used can no longer be determined by the complainant either. However, this is irrelevant, since the UUID in the cookies is already clearly linked to a person." I've been skeptical of the "just turn on anonymizeIp" approach for this reason; xxx.xxx.xxx.0 plus, say, the user agent, is likely plenty to identify me.
vorticalbox 5y ago
that side bar gives me <marquee> nostalgia.
deleted 5y ago
[deleted]
blibble 5y ago
I for one am overjoyed that the <marquee> tag seems to be coming back
calpaterson 5y ago
How do they decide to pick what towns to show in maps like this? Aberdeen is neither the capital not the largest town in Scotland and anyway is smaller than Cardiff which is the capital and largest town in Wales. Republic of Ireland doesn't get a single town but NI gets Belfast? There has to be a reasonable explanation, surely?
tupac_speedrap 5y ago
The detail is quite interesting. The Austrian interpretation seems to hinge on the US intelligence agencies having access to data as a third-party at any time because their surveillance laws are so broad and the fact that UUIDs are being used between cookies and therefore the anonymised data is actually not very anonymous if you slurp data like the NSA and can combine that with IPs addresses.
l30n4da5 5y ago
Years ago, I remember using GA on a project. Was unhappy with GA's realtime availability, so we wrote our own backend for it and stored all the analytics on our own infrastructure. Worked without any real issues. Didn't have to stop using GA on the frontend, either. Just had to point the frontend GA at our own endpoint. Theoretically, this would make usage of GA compliant with GDPR, too, I beleive.
amelius 5y ago
Why isn't France in red? IIRC, the French started the whole EU anti-Google campaign since they have the presidency of the EU. Also, Germany used to be far ahead almost anyone else when it comes to privacy, so why aren't they in red? This map seems wrong.
skilled 5y ago
This article[0] also has a solid list of open-source alternatives. [0]: https://stackdiary.com/open-source-analytics/ https://stackdiary.com/open-source-analytics/
tobyhinloopen 5y ago
Nice clickbait url with misleading information on the website.
TekMol 5y ago
The EU and especially Germany make it harder and harder for startups and indie makers to survive. Now when you start a project in Germany, not only do you have to have an "Imprint" on your site which shows your private address (if you work from home or are a digital nomad) but you also are at a disadvantage because you cannot use all the free tools that startup founders outside of the EU can use. Has anybody here in Europe considered moving to another country or setting up a company in another country because of this? How do all the famous indie makers from Europe handle this? I never find any information on their sites with an address and they all use Google Analytics.
- lawtalkinghuman 5y ago
  > you cannot use all the free tools that startup founders outside of the EU can use. You can use the ones that don't infringe on user privacy.
- 7steps2much 5y ago
  The "imprint" doesn't necessarily need to show your private address though, only an address of "someone responsible for the contents of these website." Do note that "someone responsible" can be a legal entity! Not only cooperations but also a "Verein" or a similar legal construct. Also, note that you do not need to list your address, only a "Anschrift", which often times is the same thing as an address, but really just means "If I write this on a letter it has to be delivered to you." So a postal box for example works just fine. If you are a startup you will have all of these things anyways, I don't know a single startup that isn't also a legal entity. Indie makers is a bit more tricky, but as mentioned before it is pretty easy to get around this requirement via a "Verein" or something similar. As for free tools not being usable, I honestly don't think it is that big a problem. Google Analytics doesn't work for you? There are other offers out there. Or you could selfhost matomo. Or if you want then you can just go ahead and run an awk script on your Webserver log. As for not finding information and on the sites of famous European indie makers, I am going to let you on on a secret. The "Impressum" was always intended so that consumers could have a look at who they are dealing with over the internet. To this day it is still handled like that. If you aren't selling anything or doing anything else that "a classic" company would do it is highly unlikely anyone is going to care whether or not you have an Impressum.
spankalee 5y ago
I don't understand how sending analytics data to your own host is supposed to solve the legal problem here. Do the GDPR requirements not apply in that case? And how is anyone supposed to build any kind of global data dashboard now? Do you have to have separate sites for EU analytics data vs the rest of the world? How do you do statistics to see where your visitors come from? How much time visitors from which countries, languages, etc., spend on your sites?
buf 5y ago
I just got off a zoom call with the cofounder of simpleanalytics.com. Humble, worked with my startup on pricing options, and cares a lot about privacy which was the reason why I set up the call. Shame on PostHog for this. You can do better than PostHog.
mfer 5y ago
> The safest solution is to use an analytics provider that keeps data on your own infrastructure. People don't want to run their own infrastructure anymore. Everything outside of their own business differentiator they want to outsource. Whether they "should" do it debatable and a long conversation with context like business value, cost effectiveness, velocity, and other non-technical things as part of the conversation. This would be a great advertising moment for an EU based analytics provider. A SaaS.
- openplatypus 5y ago
  There are many alternatives. Some are purely EU enterprises, some use hosting by US entities. But it appears that more than ever, there is a lot of to choose from. Just search in your search engine of choice and you will find plenty. Lots of comparison online. Some are more, some are less complete or accurate. With advent of affiliate marketing among vendors, the reviews start resembling VPN market. Not listing anything specific. My company has a product in this space, but I will spare you self-promotion.
keewee7 5y ago
>PostHog lol that is funny. "post hog" is a term that originated from the radical left r/ChapoTrapHouse subreddit. Are there other tech companies founded by openly anti-capitalist leftists?
coding123 5y ago
This is absolutely not a "Show HN" https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html
cardosof 5y ago
In the old world, a company would build the television, another would broadcast shows, another would measure the audience and another would measure sales to compare with media investments. Which of those steps Google does today? All of them, from browser to YouTube to shopping to audience data and sales measurements. This is not a case of "old people ranting about how the old world was simpler and better", it's a case of conflict of interest. But this isn't something new, everyone in the industry has been seeing that for two decades now, it's just something no one cares enough to pick a fight.
ianbutler 5y ago
So the reason people do emotionally charged marketing like this is because it generally works. We on HN are probably not (entirely) the same group that this is getting sold to, we may see the BS here a little more clearly or have a more principled view on things like this. BUT most people do not have the same distaste towards this type of marketing so -- don't hate the players, hate the game. If you want things like this to stop then it's probably up to government regulation to curtail it otherwise, for smaller competitors where it's already difficult enough to establish a market position, they would just be hamstringing themselves by not playing to the same emotionally charged marketing style. If you're a business and you deliberately stay away from marketing like this -- that's great, honestly I'm personally more likely to try your product and I'd like to think I'd do the same in my own work but I really can't blame companies who take this route either.
- deleted 5y ago
  [deleted]
101008 5y ago
I have a few blogs with visitors from around the world hosted in NYC in a shared hosting. What's a legal alternative to Google Analytics that would be as easy to setup? I dont want to host anything myself, just replace the JS that Analytics provide and that's all. If I can import my historic data from GA to the new service that would be perfect. Does such a service exist? We can't ask bloggers who install Wordpress to run a instance of Matomo, PostHog, Plausible or whatever.
- ceejayoz 5y ago
  Frankly, "hosted in NYC" probably has the same issues as "uses Google Analytics". Data on EU citizens is leaving the EU for a country without similar privacy protections.
  - 101008 5y ago
    What's the solution then? Block my website for European visitors? It is not a bussiness, just a blog.
    - BlueTemplar 5y ago
      I've seen websites do just that. But why analytics would be more important to you than readership itself ?
    - pyrale 5y ago
      In that case, you probably don't have to respect GDPR, as personal or household activities are exempted from its scope [1]. In any case, I would recommend looking up how to make sure your users' privacy is respected, it's always nice to make sure that, should their data be leaked, people are safe. [1]: https://www.fff-legal.com/the-household-exemption-in-gdpr/ https://www.fff-legal.com/the-household-exemption-in-gdpr/
    - MinorTom 5y ago
      > Block my website for European visitors? Under a strict interpretation of the law, yes.* (GDPR does apply to blogs, even if they're private) In practice removing analytics for EU visitors would probably be enough. * Note that the physical location of the data won't matter for you because you are located in the US and are the data processor.
thinkindie 5y ago
I think this page is pretty misleading https://isgoogleanalyticsillegal.com/alternatives/ https://isgoogleanalyticsillegal.com/alternatives/ they are listing PostHog as a valid alternative that would be GDPR-friendly but as per their terms of use PostHog is based in the US and they would be bound by the same Cloud Act as Google Analytics.
GordonS 5y ago
Anyone have suggestions for a lightweight, OSS Google Analytics alternative, preferably using a Postgres backend, and preferably server-side so no cookies or JavaScript are required? Only needs to handle max 10K visitors a day, which is nothing really. I had a quick look at PostHog, but it seems to need all of these in addition to the web UI: - Postgres - Redis - ClickHouse - ZooKeeper - Kafka That's... a lot. I realise there is a Docker Compose file available, but it's the amount of resources used that is concerning, and given my very modest requirements I was hoping for something very light.
AtNightWeCode 5y ago
Is this accurate? We have the Schrems II ruling that made some countries think they could not use services like Cloudflare and Azure. Still Cloudflare and Azure are widely used within EU. (Germany is an outcast). One should as always be transparent about what data is collected. From the GA projects I been involved in (in EU) GDPR has never been a concern.
StreamBright 5y ago
I hope it will be soon.
cblconfederate 5y ago
Europe celebrating for becoming a regulatory minefield is not a good sign.
adhesive_wombat 5y ago
Nice to see something happening in the GDPR compliance areas, because well over 90% of cookie banners are noncompliant with GDPR because they don't give "allow" and "reject" equal prominence (or they load cookies before you click accept). For example, OneTrust gets it right on their website, but I have never seen a client of theirs get it right. So either OneTrust doesn't use their own software, or all their clients are specifically configuring it in a non-compliant way. I have yet to hear of any general enforcement of this, despite noyb.eu's reporting of hundreds of websites to regulators.
mleonhard 5y ago
Firebase client libraries silently import and enable Google Analytics in apps [0]. Then your app silently sends a lot of user behavior data to Google [1]. Android apps which use push notifications must use the Firebase Cloud Messaging library. I think many app developers don't realize that adding that library also adds and enables analytics. For example, adding the `firebase_messaging` module [2] to a Flutter app causes the Android build to import [3] the `com.google.firebase:firebase-bom` Java dep which includes `firebase-analytics` [4]. Once the Java library is included in the build, it starts working automatically [0]. To disable Google Analytics in an app: * Firebase > Docs > Engage > Configure Analytics Data Collection and Usage [5] * dart > firebase_analytics > FirebaseAnalytics > setAnalyticsCollectionEnabled method [6] * Be sure to check the logs to make sure your change took effect. See "Firebase Google Group > Disabling analytics for iOS has no effect?" [7] [0] https://support.google.com/analytics/answer/9353532 https://support.google.com/analytics/answer/9353532 [1] https://support.google.com/firebase/answer/9234069 https://support.google.com/firebase/answer/9234069 [2] https://pub.dev/packages/firebase_messaging https://pub.dev/packages/firebase_messaging [3] https://github.com/FirebaseExtended/flutterfire/blob/a9562bac60ba927fb3664a47a7f7eaceb277dca6/packages/firebase_messaging/firebase_messaging/android/build.gradle#L52 https://github.com/FirebaseExtended/flutterfire/blob/a9562ba... [4] https://mvnrepository.com/artifact/com.google.firebase/firebase-bom/29.0.3 https://mvnrepository.com/artifact/com.google.firebase/fireb... [5] https://firebase.google.com/docs/analytics/configure-data-collection https://firebase.google.com/docs/analytics/configure-data-co... [6] https://pub.dev/documentation/firebase_analytics/latest/firebase_analytics/FirebaseAnalytics/setAnalyticsCollectionEnabled.html https://pub.dev/documentation/firebase_analytics/latest/fire... [7] https://groups.google.com/g/firebase-talk/c/rved9bIBT0g/m/YNUJ0B39BAAJ https://groups.google.com/g/firebase-talk/c/rved9bIBT0g/m/YN...
jbergens 5y ago
The bigger issue in my view is that Azure, AWS and GCP may be illegal. What should we use instead? How much will it cost to switch?
no_time 5y ago
"nooooo I have to put extra effort into loading up my saas grifting operation with the required amount of spyware" I'm not gonna lie, these tears are delicious.
kennu 5y ago
My country was cropped out even though it's part of the EU. Silly website.

323 points by james_impliu 5y ago

I frequently wonder what sort of tracking, if any, is happening via fonts.google.com and gstatic.com which are used widely across the web. Many sites break if you block resources from gstatic.com, as they depend on javascript libraries from it. The shortsightedness of using remote static assets on your own site is amazing to me.

melissalobos 5y ago

I like the scrolling banner on the side reminiscent of a news ticker being used for static data, it adds some vibrancy to the presentation. It might be nice to have more of the globe shown on the front, since it isn't "isgoogleanalyticsillegalintheEU". I really like the color scheme too, nice job!

Cyberdog 5y ago
I disagree about the "ticker." Items moving on a page without my request and particularly without any purpose are annoying to me at the best. Sadly, such nonsense is quite common in modern web design.
- toqy 5y ago
  Plenty is wrong with the modern web, but this is harmless and seems to fit the theme well
- alpaca128 5y ago
  I'm usually the first to complain about things like that as well as I'm very easily distracted, but in this case I think it's not that bad and looks kinda nice. I still wish websites would not only respect the disabled autoplay setting but also stop animations completely in that state. But right now it seems crashing video player UIs are the best we can get.
  - toqy 5y ago
    There's prefers-reduced-motion[1] but I don't think many sites actually implement anything for it. This one is open source though so someone that cares could submit a PR 1. https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...
    - alpaca128 5y ago
      Great to know, maybe one day this stuff catches on. tl;dr for enabling this in Firefox: about:config > add numeric ui.prefersReducedMotion field > set value to 1
- BlueTemplar 5y ago
  Geocities might disagree about the "modern" part...
donkarma 5y ago
reminds me of PAYDAY 2
deleted 5y ago
[deleted]

GranPC 5y ago

Meta: this website consistently crashes my browser (Firefox on Linux) if I move the mouse in and out of the map a couple of times. Does this happen to anyone else? (edit: demo video url: https://dabbleam.com/jesus/Screen%20record%20from%202022-01-19%2016.13.28.mp4 https://dabbleam.com/jesus/Screen%20record%20from%202022-01-...) Edit 2: doesn't crash on a fresh Firefox profile. Crashes upon enabling gfx.webrender.all, gfx.webrender.compositor and gfx.webrender.compositor.force-enabled. Very intriguing stuff, I'll file a bug.

spicybright 5y ago
FF under macos. The entire page lags like crazy when hovering in or out of the map. What are they even doing to make that happen lol
jacquesm 5y ago
Checked, also FF on Linux, works here, no crash.
melissalobos 5y ago
Latest stable Firefox on Arch, it doesn't crash but the person stops moving after a few times.
smoyer 5y ago
FF 97.0b4 on Xubuntu 20.04 (up-to-date) - no crash mousing over the map (whether it's a highlighted country or now).
alpaca128 5y ago
Nope, FF 95.0.1 on Linux doesn't crash for me.
rickstanley 5y ago
Doesn't crash on Windows, but boy it uses CPU to the last register; it goes up to 95% usage.

taubek 5y ago

If it is illegal in one country does it make illegal in all other EU countries as well or is this left to individual law systems of each EU member state? BTW. your site looks great. I like the running ticker on the side.

jacquesm 5y ago
As mentioned in another thread on this subject: EU privacy law is harmonized, there may be local exceptions but these are increasingly rare and over time I would expect them to fade away completely. Note that the ruling confirms the GDPR, the EU legislation.
lmkg 5y ago
As a USAian, my rough impression is that it's similar to circuit splits in Federal courts. GDPR is a Regulation (not a Directive), so it's law in all EU states. But each country's court may interpret its requirements slightly differently. A ruling from the Court of Justice of the European Union (CJEU) would be binding on all member states. And in fact most rulings around Google Analytics are dealing with the boundaries of a CJEU ruling, Schrems II.
roblabla 5y ago
this kinda depends. I'm not 100% sure what kind of "law" the GDPR, but if it's a directive (which I think it is?), then each member state must implement a law that satisfies the GDPR requirements. Member states may chose to pass stricter laws than the GDPR technically requires, which could make something illegal in one EU country but not all the others. Also, enforcement may be very inconsistent, since it is mostly left to each member state to handle. EDIT: NVM, GDPR is a Regulation, not a Directive, so it's automatically law everywhere in Europe.

freshpots 5y ago

Your connection is not private Attackers might be trying to steal your information from isgoogleanalyticsillegal.com (for example, passwords, messages or credit cards). Learn more NET::ERR_CERT_AUTHORITY_INVALID No thanks.

RedShift1 5y ago
It's a Let's Encrypt certificate issued by R3, perhaps your root certs are not up to date?
- wila 5y ago
  In particular because of this issue: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe...
melissalobos 5y ago
Huh, it is working for me. It looks like a valid cert from Let's Encrypt to me. Do you have any more details? So maybe the author can fix it.
justsomehnguy 5y ago
And this is why all that scary pages without explanation sucks. There is needed too many clicks to actually see the chain and certs.
- alpaca128 5y ago
  Especially because you can get errors like that just from having an incorrect date/time set on the device. Confused me a few times.
bastardoperator 5y ago
LGTM, sure you're not having an issue on your side? I even see http redirect to https. Cert was also issued yesterday.
5y ago

ArtemZ 5y ago

hrdwdmrbl 5y ago

GDPR has gone too far. Privacy yes. Encryption yes. Data portability yes. Permissionless selling of personal data no. But the rules are nonsensical at this point.

pgalvin 5y ago
Could you elaborate? Which parts of the GDPR do you disagree with?

schleck8 5y ago

> PostHog is the only open source product analytics platform where customer data never leaves your infrastructure That's wrong. I can give you 3 other open source selfhosted options off the top of my head: Offen, Counter, Matomo. Edit: I just saw that their "alternatives to google analytics" page shows posthog's competitors as well and you can submit prs to add further options, fair play! https://isgoogleanalyticsillegal.com/alternatives https://isgoogleanalyticsillegal.com/alternatives

deepstack 5y ago
Got a 404 when going to the link.
- deleted 5y ago
  [deleted]
- schleck8 5y ago
  They might have changed it just now, or I copied the wrong one. Either way I replaced it with the correct url
- timgl 5y ago
  Sorry! Had to rename it because of issues with uBlock ironically [0]. New URL is https://isgoogleanalyticsillegal.com/alternatives/ https://isgoogleanalyticsillegal.com/alternatives/ [0] https://news.ycombinator.com/item?id=29994768 https://news.ycombinator.com/item?id=29994768
kingcharles 5y ago
"Plausible" is another, even if I don't like their support.
- Volker_W 5y ago
  Why don't you like plausible?
  - 5y ago

paulgb 5y ago

Funny enough, ublock (stock install) completely breaks the “alternatives” page. It must do some pattern matching on "component---src-pages-google-analytics-alternatives-js-8d1eb2b4c6482dba3dfd.js" and decide it's suspicious enough to deny it, even though it's a first-party request.

toqy 5y ago
It will block anything with google analytics string in it I think. We had a small google analytics image/link on an internal website that linked to some relevant GA dashboard and the image was blocked / hidden by ublock and possibly others. Changing the name fixed it.
melissalobos 5y ago
It is because it has google-analytics in the title of the resource: Rule: `-google-analytics-$script,domain=~wordpress.org` URL: https://isgoogleanalyticsillegal.com/component---src-pages-google-analytics-alternatives-js-8d1eb2b4c6482dba3dfd.js https://isgoogleanalyticsillegal.com/component---src-pages-g... Edit: Couldn't get this formatted well, but it has google-analytics highlighted in the URL
timgl 5y ago
Ha! I've renamed that page so this should work now!

yessirwhatever 5y ago

I dislike Google and their products pretty much universally, but having this sort of thing done by a competitor is not just distasteful, I see it as verging on corporatism. Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software. All tracking is bad, from Google or not. I understand the "companies need to make informed decisions" argument but I disagree with it, mainly because tracking software is involuntary and it's in the interest of the tracking software maker and the company using it to make it as stealthy as possible. PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq?hl=en#what_does_usin...

franklampard 5y ago
Isn’t a legal product a better one than an illegal counterpart?
- amelius 5y ago
  Nope. It's because the illegal product has lower cost (because complying to regulations costs money one way or the other).
  - deleted 5y ago
    [deleted]
  - IanCal 5y ago
    It may not be cheaper when you have to deal with the repercussions of breaking the law though.
    - amelius 5y ago
      Those are usually just slaps on the wrist.
  - 5y ago

ritmatter 5y ago

This site seems like a great example of how the EU forces productive folks to jump through all kinds of regulatory hoops. Hopefully it’ll help them navigate the complex legislation.

Rilfeu 5y ago
The automotive industry has safety regulations. Why shouldn't IT have some regulation as well?
marginalia_nu 5y ago
This has been inevitable for years. The fact that 'productive folks' have been engaged in a chicken race with the regulators since GDPR came along in 2016 is entirely on them. The second shoe dropped with Schrems II in 2020, and the race to find plausible technicalities to keep doing the same thing continued. Still no real attempt at fixing the problems. If they had followed the spirit of the law rather than trying to get away with dubious technicalities, there would be no mad scramble to fix things now when it turned out those technicalities were in fact hopeful thinking at best.
amelius 5y ago
You're only on the watchdog's radars when you are a large company, in which case you should have an entire department devoted to complying to legislation anyway.
- foxfluff 5y ago
  Even private individuals have been smacked with GDPR fines.
  - Volker_W 5y ago
    Do you have good examples?
    - lmkg 5y ago
      Go to https://www.enforcementtracker.com https://www.enforcementtracker.com, which collects and publishes GDPR fine information. Type in "Private Individual" as a filter in the "Controller/Processor" column. I see twenty-ish results, mostly from Spain. My Spanish is rusty and non-technical, but I think some of those fines are about posting videos to social media.

hericium 5y ago

Very specific domain name. Is Tag Manager different from Analytics? Have you seen Fonts' TOS?

Cenk 5y ago

Brought to you by PostHog. See also this tool by Fathom: https://illegal.analyticsscanner.com https://illegal.analyticsscanner.com

jhoelzel 5y ago

Welp Technically yes everywhere and it has been that way since the gdpr Practically this is the number one reason for our nice "attention, do not resits, we are using cookies on your electronic machinery" popups. For quite a few sites its the only cookie you actually accept. Its a s**t show really. Every single client ever now needs to have a cookie popup because google is going to punish you in your rankings if you do not use their integrations too. And if you do use their integrations... you need a popup.... and dont even get me started about "legitimate interest". But this is the way... I opt out as much as I can and block through the router as well as ublock. The most interesting thing that i noticed is that if you block third party cookies in safari on your phone, some sites will show you a blank screen. Timescale does this (I have reported this as a bug month ago but never received feedback). Its an amazing feature by now: - the page loads and you can see the content - the page trys to show you the cookie popup - since i dont have any cookies allowed, the script will just completly blank out my page welp. welcome to the future. Its not neccesarily better, but I can see them all now, which i guess is at least a step in the right direction.

Volker_W 5y ago
> Every single client ever now needs to have a cookie popup because google is going to punish you in your rankings if you do not use their integrations too. Source/proof?
- deleted 5y ago
  [deleted]
morelisp 5y ago
> For quite a few sites its the only cookie you actually accept. If true, they don't need to show the popup. > google is going to punish you in your rankings if you do not use their integrations too. If you have evidence of this it would be the basis of a massive antitrust case. (I'm not disagreeing and would not be too surprised, but - real evidence is thin unless you include the AMP carousel which is not technically part of "rankings".)

kmeisthax 5y ago

Note that this isn't purely "do not use Google Analytics"; it's "do not export EU data". For context, there used to be a trade agreement to ensure EU companies were still allowed to use US server hosts, called US Privacy Shield; but that was torpedoed by other legal rulings. TBH, I personally do not understand how it is legal to provide a single shared service in the face of data localization requirements, especially if other countries were to adopt similar rules. Is it just a matter of having separate shards for each jurisdiction? Or do we need to instance the entire application so that US users don't even see EU users and vice-versa? Most off-the-shelf/FOSS webapps aren't built to be sharded this way, they assume One Big Database that has everything. That would include some of the GA alternatives they list; which, again, is a problem if those apps don't shard users by jurisdiction. I suppose for now, just hosting everything in the EU is fine, if only because the other jurisdictions with data localization requirements[0] pretty much can't be served with a shared application anyway. I'm imagining that's what the person who built this was figuring it would be used for. But if the US starts demanding data localization, the Internet is fucked. [0] China, AFAIK

rileymat2 5y ago
“ But if the US starts demanding data localization, the Internet is fucked.” The the demands that tiktok be sold?
- kmeisthax 5y ago
  TikTok is an unusual case, because the US was determined to ratfuck Chinese social media apps a few years back. The executive orders in question only applied to a handful of companies in one country. There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. A general data localization requirement in US law would mean an end to self-hosting one website and serving two jurisdictions for the majority of web users.
  - pyrale 5y ago
    > There was no concomitant demand for, say, EU companies or anyone else to shard off US users on domestically-hosted infrastructure. US claims are wider in scope, since they demand services operating in the US to hand over data, wherever it's located, and wherever the users it's about are located.

sdoering 5y ago

> This message is brought to you by > PostHog is the only open source product analytics platform where customer data never leaves your infrastructure. Hosting my own Matomo installation I beg to differ. Matomo is open source and my visitors data never leaves my own server. Except they only do backend tracking and see https traffic from website frontend tracking reaching my analytics server as it "leaves your infrastructure". But they at least made one thing obviously clear to me. I would never consider using them in the future. Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). So not caring about the law when implementing GA and doing it just wrong is forbidden in Austria. Who would have thought. Using it correctly and adhering to data privacy best practices is just fine with GA.

ratww 5y ago
> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). That's some very interesting information. So, the real answer to the question of whether it's illegal in Austria or not is a "MAYBE", and it is quite easy to make it legal? If so, that should be on this site.
ceejayoz 5y ago
> Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well). I've only got a machine translation of the ruling (https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_EN_bk.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...), but it includes: "The specific IP address used can no longer be determined by the complainant either. However, this is irrelevant, since the UUID in the cookies is already clearly linked to a person." I've been skeptical of the "just turn on anonymizeIp" approach for this reason; xxx.xxx.xxx.0 plus, say, the user agent, is likely plenty to identify me.

vorticalbox 5y ago

that side bar gives me <marquee> nostalgia.

deleted 5y ago

[deleted]

blibble 5y ago

I for one am overjoyed that the <marquee> tag seems to be coming back

calpaterson 5y ago

How do they decide to pick what towns to show in maps like this? Aberdeen is neither the capital not the largest town in Scotland and anyway is smaller than Cardiff which is the capital and largest town in Wales. Republic of Ireland doesn't get a single town but NI gets Belfast? There has to be a reasonable explanation, surely?

tupac_speedrap 5y ago

The detail is quite interesting. The Austrian interpretation seems to hinge on the US intelligence agencies having access to data as a third-party at any time because their surveillance laws are so broad and the fact that UUIDs are being used between cookies and therefore the anonymised data is actually not very anonymous if you slurp data like the NSA and can combine that with IPs addresses.

l30n4da5 5y ago

Years ago, I remember using GA on a project. Was unhappy with GA's realtime availability, so we wrote our own backend for it and stored all the analytics on our own infrastructure. Worked without any real issues. Didn't have to stop using GA on the frontend, either. Just had to point the frontend GA at our own endpoint. Theoretically, this would make usage of GA compliant with GDPR, too, I beleive.

amelius 5y ago

Why isn't France in red? IIRC, the French started the whole EU anti-Google campaign since they have the presidency of the EU. Also, Germany used to be far ahead almost anyone else when it comes to privacy, so why aren't they in red? This map seems wrong.

skilled 5y ago

This article[0] also has a solid list of open-source alternatives. [0]: https://stackdiary.com/open-source-analytics/ https://stackdiary.com/open-source-analytics/

tobyhinloopen 5y ago

Nice clickbait url with misleading information on the website.

TekMol 5y ago

The EU and especially Germany make it harder and harder for startups and indie makers to survive. Now when you start a project in Germany, not only do you have to have an "Imprint" on your site which shows your private address (if you work from home or are a digital nomad) but you also are at a disadvantage because you cannot use all the free tools that startup founders outside of the EU can use. Has anybody here in Europe considered moving to another country or setting up a company in another country because of this? How do all the famous indie makers from Europe handle this? I never find any information on their sites with an address and they all use Google Analytics.

lawtalkinghuman 5y ago
> you cannot use all the free tools that startup founders outside of the EU can use. You can use the ones that don't infringe on user privacy.
7steps2much 5y ago
The "imprint" doesn't necessarily need to show your private address though, only an address of "someone responsible for the contents of these website." Do note that "someone responsible" can be a legal entity! Not only cooperations but also a "Verein" or a similar legal construct. Also, note that you do not need to list your address, only a "Anschrift", which often times is the same thing as an address, but really just means "If I write this on a letter it has to be delivered to you." So a postal box for example works just fine. If you are a startup you will have all of these things anyways, I don't know a single startup that isn't also a legal entity. Indie makers is a bit more tricky, but as mentioned before it is pretty easy to get around this requirement via a "Verein" or something similar. As for free tools not being usable, I honestly don't think it is that big a problem. Google Analytics doesn't work for you? There are other offers out there. Or you could selfhost matomo. Or if you want then you can just go ahead and run an awk script on your Webserver log. As for not finding information and on the sites of famous European indie makers, I am going to let you on on a secret. The "Impressum" was always intended so that consumers could have a look at who they are dealing with over the internet. To this day it is still handled like that. If you aren't selling anything or doing anything else that "a classic" company would do it is highly unlikely anyone is going to care whether or not you have an Impressum.

spankalee 5y ago

I don't understand how sending analytics data to your own host is supposed to solve the legal problem here. Do the GDPR requirements not apply in that case? And how is anyone supposed to build any kind of global data dashboard now? Do you have to have separate sites for EU analytics data vs the rest of the world? How do you do statistics to see where your visitors come from? How much time visitors from which countries, languages, etc., spend on your sites?

buf 5y ago

I just got off a zoom call with the cofounder of simpleanalytics.com. Humble, worked with my startup on pricing options, and cares a lot about privacy which was the reason why I set up the call. Shame on PostHog for this. You can do better than PostHog.

mfer 5y ago

> The safest solution is to use an analytics provider that keeps data on your own infrastructure. People don't want to run their own infrastructure anymore. Everything outside of their own business differentiator they want to outsource. Whether they "should" do it debatable and a long conversation with context like business value, cost effectiveness, velocity, and other non-technical things as part of the conversation. This would be a great advertising moment for an EU based analytics provider. A SaaS.

openplatypus 5y ago
There are many alternatives. Some are purely EU enterprises, some use hosting by US entities. But it appears that more than ever, there is a lot of to choose from. Just search in your search engine of choice and you will find plenty. Lots of comparison online. Some are more, some are less complete or accurate. With advent of affiliate marketing among vendors, the reviews start resembling VPN market. Not listing anything specific. My company has a product in this space, but I will spare you self-promotion.

keewee7 5y ago

>PostHog lol that is funny. "post hog" is a term that originated from the radical left r/ChapoTrapHouse subreddit. Are there other tech companies founded by openly anti-capitalist leftists?

coding123 5y ago

This is absolutely not a "Show HN" https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html

cardosof 5y ago

In the old world, a company would build the television, another would broadcast shows, another would measure the audience and another would measure sales to compare with media investments. Which of those steps Google does today? All of them, from browser to YouTube to shopping to audience data and sales measurements. This is not a case of "old people ranting about how the old world was simpler and better", it's a case of conflict of interest. But this isn't something new, everyone in the industry has been seeing that for two decades now, it's just something no one cares enough to pick a fight.

ianbutler 5y ago

So the reason people do emotionally charged marketing like this is because it generally works. We on HN are probably not (entirely) the same group that this is getting sold to, we may see the BS here a little more clearly or have a more principled view on things like this. BUT most people do not have the same distaste towards this type of marketing so -- don't hate the players, hate the game. If you want things like this to stop then it's probably up to government regulation to curtail it otherwise, for smaller competitors where it's already difficult enough to establish a market position, they would just be hamstringing themselves by not playing to the same emotionally charged marketing style. If you're a business and you deliberately stay away from marketing like this -- that's great, honestly I'm personally more likely to try your product and I'd like to think I'd do the same in my own work but I really can't blame companies who take this route either.

deleted 5y ago
[deleted]

101008 5y ago

I have a few blogs with visitors from around the world hosted in NYC in a shared hosting. What's a legal alternative to Google Analytics that would be as easy to setup? I dont want to host anything myself, just replace the JS that Analytics provide and that's all. If I can import my historic data from GA to the new service that would be perfect. Does such a service exist? We can't ask bloggers who install Wordpress to run a instance of Matomo, PostHog, Plausible or whatever.

ceejayoz 5y ago
Frankly, "hosted in NYC" probably has the same issues as "uses Google Analytics". Data on EU citizens is leaving the EU for a country without similar privacy protections.
- 101008 5y ago
  What's the solution then? Block my website for European visitors? It is not a bussiness, just a blog.
  - BlueTemplar 5y ago
    I've seen websites do just that. But why analytics would be more important to you than readership itself ?
  - pyrale 5y ago
    In that case, you probably don't have to respect GDPR, as personal or household activities are exempted from its scope [1]. In any case, I would recommend looking up how to make sure your users' privacy is respected, it's always nice to make sure that, should their data be leaked, people are safe. [1]: https://www.fff-legal.com/the-household-exemption-in-gdpr/ https://www.fff-legal.com/the-household-exemption-in-gdpr/
  - MinorTom 5y ago
    > Block my website for European visitors? Under a strict interpretation of the law, yes.* (GDPR does apply to blogs, even if they're private) In practice removing analytics for EU visitors would probably be enough. * Note that the physical location of the data won't matter for you because you are located in the US and are the data processor.

thinkindie 5y ago

I think this page is pretty misleading https://isgoogleanalyticsillegal.com/alternatives/ https://isgoogleanalyticsillegal.com/alternatives/ they are listing PostHog as a valid alternative that would be GDPR-friendly but as per their terms of use PostHog is based in the US and they would be bound by the same Cloud Act as Google Analytics.

GordonS 5y ago

Anyone have suggestions for a lightweight, OSS Google Analytics alternative, preferably using a Postgres backend, and preferably server-side so no cookies or JavaScript are required? Only needs to handle max 10K visitors a day, which is nothing really. I had a quick look at PostHog, but it seems to need all of these in addition to the web UI: - Postgres - Redis - ClickHouse - ZooKeeper - Kafka That's... a lot. I realise there is a Docker Compose file available, but it's the amount of resources used that is concerning, and given my very modest requirements I was hoping for something very light.

AtNightWeCode 5y ago

Is this accurate? We have the Schrems II ruling that made some countries think they could not use services like Cloudflare and Azure. Still Cloudflare and Azure are widely used within EU. (Germany is an outcast). One should as always be transparent about what data is collected. From the GA projects I been involved in (in EU) GDPR has never been a concern.

StreamBright 5y ago

I hope it will be soon.

cblconfederate 5y ago

Europe celebrating for becoming a regulatory minefield is not a good sign.

adhesive_wombat 5y ago

Nice to see something happening in the GDPR compliance areas, because well over 90% of cookie banners are noncompliant with GDPR because they don't give "allow" and "reject" equal prominence (or they load cookies before you click accept). For example, OneTrust gets it right on their website, but I have never seen a client of theirs get it right. So either OneTrust doesn't use their own software, or all their clients are specifically configuring it in a non-compliant way. I have yet to hear of any general enforcement of this, despite noyb.eu's reporting of hundreds of websites to regulators.

mleonhard 5y ago

Firebase client libraries silently import and enable Google Analytics in apps [0]. Then your app silently sends a lot of user behavior data to Google [1]. Android apps which use push notifications must use the Firebase Cloud Messaging library. I think many app developers don't realize that adding that library also adds and enables analytics. For example, adding the `firebase_messaging` module [2] to a Flutter app causes the Android build to import [3] the `com.google.firebase:firebase-bom` Java dep which includes `firebase-analytics` [4]. Once the Java library is included in the build, it starts working automatically [0]. To disable Google Analytics in an app: * Firebase > Docs > Engage > Configure Analytics Data Collection and Usage [5] * dart > firebase_analytics > FirebaseAnalytics > setAnalyticsCollectionEnabled method [6] * Be sure to check the logs to make sure your change took effect. See "Firebase Google Group > Disabling analytics for iOS has no effect?" [7] [0] https://support.google.com/analytics/answer/9353532 https://support.google.com/analytics/answer/9353532 [1] https://support.google.com/firebase/answer/9234069 https://support.google.com/firebase/answer/9234069 [2] https://pub.dev/packages/firebase_messaging https://pub.dev/packages/firebase_messaging [3] https://github.com/FirebaseExtended/flutterfire/blob/a9562bac60ba927fb3664a47a7f7eaceb277dca6/packages/firebase_messaging/firebase_messaging/android/build.gradle#L52 https://github.com/FirebaseExtended/flutterfire/blob/a9562ba... [4] https://mvnrepository.com/artifact/com.google.firebase/firebase-bom/29.0.3 https://mvnrepository.com/artifact/com.google.firebase/fireb... [5] https://firebase.google.com/docs/analytics/configure-data-collection https://firebase.google.com/docs/analytics/configure-data-co... [6] https://pub.dev/documentation/firebase_analytics/latest/firebase_analytics/FirebaseAnalytics/setAnalyticsCollectionEnabled.html https://pub.dev/documentation/firebase_analytics/latest/fire... [7] https://groups.google.com/g/firebase-talk/c/rved9bIBT0g/m/YNUJ0B39BAAJ https://groups.google.com/g/firebase-talk/c/rved9bIBT0g/m/YN...

jbergens 5y ago

The bigger issue in my view is that Azure, AWS and GCP may be illegal. What should we use instead? How much will it cost to switch?

no_time 5y ago

"nooooo I have to put extra effort into loading up my saas grifting operation with the required amount of spyware" I'm not gonna lie, these tears are delicious.

kennu 5y ago

My country was cropped out even though it's part of the EU. Silly website.