4 ms·

Using Analytics Is Not a Privacy Violation

2 points by shubhamjain 4y ago

Nextgrid 4y ago
When using self-hosted, first-party analytics, maybe. But when using a third-party I strongly disagree. > No PII was sent with any request and IP Addresses were anonymized, which means they couldn’t have possibly tracked an installation to a particular machine. False. The IP address and the fingerprint of the host's TCP & TLS stack was sent. It's up to the receiver to decide whether to "anonymize" those. > Unless Google is explicitly lying, there is no way anyone involved could say Person A installed Package B. [emphasis mine] Why do you think that wouldn't be the case? Google (and others) have a proven track record of breaking the law when it comes to privacy. For 4 years after the GDPR went into effect they intentionally shipped a non-compliant implementation. Facebook lied and ended up using 2FA phone numbers for advertising purposes, and so did Twitter. Instead of looking at whether a company would lie or not, I'd suggest looking at any reasons that would push them to lie. The fact that their entire business model relies on stalking everyone for ad targeting should be a good enough red flag. They also wouldn't be offering Google Analytics for free to everyone unless they benefited from it somehow. > But if my app/website is small and does a very specific thing, it’s hard to imagine how one can probe into their behavior by tracking their usage. The concern here isn't your own usage of analytics, it's more what the analytics provider (or anyone who compromised them and got access to the data) can infer from the data (including from other web properties you don't have access to). This is exactly why Google offers analytics for free - at a small cost of offering developers an analytics service, they get a view of users' behavior across the vast majority of the web. > Of course, you have a reason to not trust a big corporation. However, a public company, that’s already on the antitrust radar, doesn’t have a good reason to outright lie publicly. Just like they wouldn't have a good reason to intentionally breach the GDPR for 4 years?
nonrandomstring 4y ago
If you host a site on your own bare VPS and only use server-side analytics then one could argue that's "not violating privacy". The client browser is volunteering up UA and other network information. You may have the most ethical intentions and respect for your web users. But sadly, you throw all that to the crows the moment you outsource to third party "cloud" services. Free and cheap webhosting and analytics services all make their money by spying on traffic and selling it to aggregators and whatnot. As soon as you add third party JavaScript to a page you abdicate all such claims and control.

2 points by shubhamjain 4y ago

When using self-hosted, first-party analytics, maybe. But when using a third-party I strongly disagree. > No PII was sent with any request and IP Addresses were anonymized, which means they couldn’t have possibly tracked an installation to a particular machine. False. The IP address and the fingerprint of the host's TCP & TLS stack was sent. It's up to the receiver to decide whether to "anonymize" those. > Unless Google is explicitly lying, there is no way anyone involved could say Person A installed Package B. [emphasis mine] Why do you think that wouldn't be the case? Google (and others) have a proven track record of breaking the law when it comes to privacy. For 4 years after the GDPR went into effect they intentionally shipped a non-compliant implementation. Facebook lied and ended up using 2FA phone numbers for advertising purposes, and so did Twitter. Instead of looking at whether a company would lie or not, I'd suggest looking at any reasons that would push them to lie. The fact that their entire business model relies on stalking everyone for ad targeting should be a good enough red flag. They also wouldn't be offering Google Analytics for free to everyone unless they benefited from it somehow. > But if my app/website is small and does a very specific thing, it’s hard to imagine how one can probe into their behavior by tracking their usage. The concern here isn't your own usage of analytics, it's more what the analytics provider (or anyone who compromised them and got access to the data) can infer from the data (including from other web properties you don't have access to). This is exactly why Google offers analytics for free - at a small cost of offering developers an analytics service, they get a view of users' behavior across the vast majority of the web. > Of course, you have a reason to not trust a big corporation. However, a public company, that’s already on the antitrust radar, doesn’t have a good reason to outright lie publicly. Just like they wouldn't have a good reason to intentionally breach the GDPR for 4 years?

nonrandomstring 4y ago

If you host a site on your own bare VPS and only use server-side analytics then one could argue that's "not violating privacy". The client browser is volunteering up UA and other network information. You may have the most ethical intentions and respect for your web users. But sadly, you throw all that to the crows the moment you outsource to third party "cloud" services. Free and cheap webhosting and analytics services all make their money by spying on traffic and selling it to aggregators and whatnot. As soon as you add third party JavaScript to a page you abdicate all such claims and control.