11 ms·

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service. And as such it falls largerly in the same bucket as GA, because if

by eps 5y ago

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service. And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

jraph 5y ago
it's not the privacy-first analytics tool neither. It's a tool. Matomo is the privacy-friendly analytics tool that comes to my mind anyway. (I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)
- bsedlm 5y ago
  there's a difference between a service and a tool. do not blur out this distinction. thanks.
  - jraph 5y ago
    That was not my point and I didn't want to make my message more complicated. This point has already clearly been made by my parent comment. I agree with you though.
AdriaanvRossum 5y ago
I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-great-alternative-to-google-analytics#1-differences-in-core-values-privacy-first-vs-profit-first https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect https://docs.simpleanalytics.com/what-we-collect
- gspencley 5y ago
  You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with said business, not with Shopify, not with Google, not with Facebook or Twitter (I'm looking at those "sign in with" widgets that run social media code in my browser) or whatever 3rd party "SaaS" service the website is outsourcing my data to for ease of development or convenience. I don't consent to my data being shared with people I don't know about and did not consent to give a single shred of my information to.
  - chinathrow 5y ago
    > I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?
  - mwint 5y ago
    > any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?
    - scoutt 5y ago
      As long as Personal Data isn't being trasferred, there is no need to ask.
      - mwint 5y ago
        That CDN will know your IP and what site you’re from, and likely can do a decent job correlating visits with other sites. The internet is just not designed for privacy at a technical level.
someotherperson 5y ago
Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.
- simion314 5y ago
  >Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first. Edit:typos
  - germanier 5y ago
    On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)
    - simion314 5y ago
      >By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so those "partners" take a quick look?
      - 5y ago
buf 5y ago
You raise an interesting point. Who's data is it? If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal? What if the cameras block out your face and all identifying features. Is that legal? Do you own a blob of a person walking down an aisle? Does the grocery store?
- mnw21cam 5y ago
  If you walk into a shop and the cameras record what you do, then there has to be a mechanism in place to ensure that the data is only able to be used for the purpose it was collected for (that is, crime prevention and law enforcement), and that it is destroyed after a defined time-frame. That satisfies the GDPR, as you're collecting the data for a legitimate purpose (for which you don't need to seek consent) and preventing its use for any other purpose (which would need separate informed consent). The destruction time-limit also helps prevent its use for other purposes by reducing the opportunity for unauthorised access. You'd probably (IANAL) still have to have a "Smile, you're on camera" notice up though.
- yobbo 5y ago
  > If you walk into a grocery store, and cameras record In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.
  - deleted 5y ago
    [deleted]
  - arvindrajnaidu 5y ago
    Say they don’t do it secretly. They put up signs that they are doing it. Do they have to get explicit consent from each customer and save that info for audits?
    - robin_reala 5y ago
      No, they claim it under legitimate interest for fraud prevention and have a data deletion schedule.
lucideer 5y ago
You may have a good/decent/important broad point in general, but it's somewhat off-topic here. EU privacy directives and legislation are not particularly concerned (yet) with banning the sharing of data with third-parties, the focus at the moment is purely on regulating that sharing of data and ensuring it's only being shared with compliant third parties via compliant means. In this case, Google is non-compliant but the gp's service/tool does appear to be. I think you're underplaying the distinction here quite severely. TL;DR this is about what's illegal, not what's "evil".

by eps 5y ago

jraph 5y ago

it's not the privacy-first analytics tool neither. It's a tool. Matomo is the privacy-friendly analytics tool that comes to my mind anyway. (I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)

bsedlm 5y ago
there's a difference between a service and a tool. do not blur out this distinction. thanks.
- jraph 5y ago
  That was not my point and I didn't want to make my message more complicated. This point has already clearly been made by my parent comment. I agree with you though.

AdriaanvRossum 5y ago

I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-great-alternative-to-google-analytics#1-differences-in-core-values-privacy-first-vs-profit-first https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect https://docs.simpleanalytics.com/what-we-collect

gspencley 5y ago
You're within your rights to create and offer whatever kind of service you want. As an end-user, however, any data what-so-ever sent to a 3rd party without my knowledge or consent is too much. There is no such thing as "the right amount." I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with said business, not with Shopify, not with Google, not with Facebook or Twitter (I'm looking at those "sign in with" widgets that run social media code in my browser) or whatever 3rd party "SaaS" service the website is outsourcing my data to for ease of development or convenience. I don't consent to my data being shared with people I don't know about and did not consent to give a single shred of my information to.
- chinathrow 5y ago
  > I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?
- mwint 5y ago
  > any data what-so-ever sent to a 3rd party without my knowledge or consent is too much So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?
  - scoutt 5y ago
    As long as Personal Data isn't being trasferred, there is no need to ask.
    - mwint 5y ago
      That CDN will know your IP and what site you’re from, and likely can do a decent job correlating visits with other sites. The internet is just not designed for privacy at a technical level.

someotherperson 5y ago

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

simion314 5y ago
>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first. Edit:typos
- germanier 5y ago
  On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)
  - simion314 5y ago
    >By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so those "partners" take a quick look?
    - 5y ago

buf 5y ago

You raise an interesting point. Who's data is it? If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal? What if the cameras block out your face and all identifying features. Is that legal? Do you own a blob of a person walking down an aisle? Does the grocery store?

mnw21cam 5y ago
If you walk into a shop and the cameras record what you do, then there has to be a mechanism in place to ensure that the data is only able to be used for the purpose it was collected for (that is, crime prevention and law enforcement), and that it is destroyed after a defined time-frame. That satisfies the GDPR, as you're collecting the data for a legitimate purpose (for which you don't need to seek consent) and preventing its use for any other purpose (which would need separate informed consent). The destruction time-limit also helps prevent its use for other purposes by reducing the opportunity for unauthorised access. You'd probably (IANAL) still have to have a "Smile, you're on camera" notice up though.
yobbo 5y ago
> If you walk into a grocery store, and cameras record In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.
- deleted 5y ago
  [deleted]
- arvindrajnaidu 5y ago
  Say they don’t do it secretly. They put up signs that they are doing it. Do they have to get explicit consent from each customer and save that info for audits?
  - robin_reala 5y ago
    No, they claim it under legitimate interest for fraud prevention and have a data deletion schedule.

lucideer 5y ago

You may have a good/decent/important broad point in general, but it's somewhat off-topic here. EU privacy directives and legislation are not particularly concerned (yet) with banning the sharing of data with third-parties, the focus at the moment is purely on regulating that sharing of data and ensuring it's only being shared with compliant third parties via compliant means. In this case, Google is non-compliant but the gp's service/tool does appear to be. I think you're underplaying the distinction here quite severely. TL;DR this is about what's illegal, not what's "evil".