5 ms·

Server side GTM (and similar devious tactics) should be what gets legislated (since that's the thing that adblockers can't protect us against).

closewith 4y ago
Adblockers can still (and do) protect against server-side GTM, as the requests are not obfuscated in any way. That may change in the future, but it’s not the case now. Besides, the CNIL ruling already applies to server-side GTM implementations.
- gorhill 4y ago
  > as the requests are not obfuscated in any way How do you know for sure that the requests are "not obfuscated in any way"?
  - closewith 4y ago
    Right now, because the requests are identical to the same requests sent to Google Analytics but with a different hostname. It's trivial to identify and block them, and current ad blockers already do.
    - gorhill 4y ago
      > same requests sent to Google Analytics but with a different hostname There are instructions out there to also modify the path of the requests[1]. Consider this paragraph in the Summary section: > Cynics could say that this is an improved way to circumvent ad blockers. And they’d be right! This does make it easier to circumvent ad blockers, as their heuristics target not just the googletagmanager.com domain but also the gtm.js file and the GTM-... container ID. * * * [1] https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/#request-path https://www.simoahava.com/analytics/custom-gtm-loader-server...
      - closewith 4y ago
        You can do that, and you can also proxy encoded requests which obfuscates all data, but you could also do that with the previous version of Google Analytics via the Measurement API. In practice - in the EU, at least - I haven't seen any examples of this, and it would be unlawful without consent anyway, thanks to the GDPR. It's also still fairly easy to classify requests (if you have access to the unencrypted request in the browser) based on heuristics. That's partly what the company I work for does. Separately, thank you for your contribution to the Internet - it's as big and important as all the behemoths, but unfortunately will never be rewarded in the same way.
- pieterhg 4y ago
  How?
- gigel82 4y ago
  Once server-side analytics get implemented widely, we've lost. We'll keep chasing each other with tricks like renaming the api endpoints, randomizing the javascript hash, etc. for a while but if we end up having to run an ML model in the browser to attempt to detect when our data is being stolen we've lost a long time before. Might be better to shame any website caught using it with some crowd-sourced list of some kind - then at least we'd know who the bad actors are and force their content through an isolated container / proxy / VPN, or simply stop using them altogether.
  - closewith 4y ago
    If that's the case, then the war is already lost. But happily, in the EU - the market I operate in - server-side analytics is seen as an avenue towards compliance. Obviously server-side GTM will be abused in the absence of regulation, but that was also true of the existing technologies. Strong and consistent enforcement can and is bringing companies into compliance.
  - trasz 4y ago
    Unless we start actively jamming analytics by injecting lots of fake data. Which well eventually have to do anyway.
    - closewith 4y ago
      Some competitors in hyper-competitive markets already do this, and analytics services are already pretty good at filtering it out.
      - trasz 4y ago
        In the long run analytics will be on the losing side though - because it's possible to jam with patterns generated by other humans, just mashed together, and there is no way to reliably detect that without also making it possible for humans to use it masquerade as generated traffic.
        4y ago
tremon 4y ago
The GDPR legislation is about means and goals, not specific implementations. What makes you think GTM isn't similarly illegal already?
- gigel82 4y ago
  That's great, and we need more legislation (on this side of the pond as well).
ec109685 4y ago
Server side transmission of data to Google would be illegal too.

closewith 4y ago

Adblockers can still (and do) protect against server-side GTM, as the requests are not obfuscated in any way. That may change in the future, but it’s not the case now. Besides, the CNIL ruling already applies to server-side GTM implementations.

gorhill 4y ago
> as the requests are not obfuscated in any way How do you know for sure that the requests are "not obfuscated in any way"?
- closewith 4y ago
  Right now, because the requests are identical to the same requests sent to Google Analytics but with a different hostname. It's trivial to identify and block them, and current ad blockers already do.
  - gorhill 4y ago
    > same requests sent to Google Analytics but with a different hostname There are instructions out there to also modify the path of the requests[1]. Consider this paragraph in the Summary section: > Cynics could say that this is an improved way to circumvent ad blockers. And they’d be right! This does make it easier to circumvent ad blockers, as their heuristics target not just the googletagmanager.com domain but also the gtm.js file and the GTM-... container ID. * * * [1] https://www.simoahava.com/analytics/custom-gtm-loader-server-side-tagging/#request-path https://www.simoahava.com/analytics/custom-gtm-loader-server...
    - closewith 4y ago
      You can do that, and you can also proxy encoded requests which obfuscates all data, but you could also do that with the previous version of Google Analytics via the Measurement API. In practice - in the EU, at least - I haven't seen any examples of this, and it would be unlawful without consent anyway, thanks to the GDPR. It's also still fairly easy to classify requests (if you have access to the unencrypted request in the browser) based on heuristics. That's partly what the company I work for does. Separately, thank you for your contribution to the Internet - it's as big and important as all the behemoths, but unfortunately will never be rewarded in the same way.
pieterhg 4y ago
How?
gigel82 4y ago
Once server-side analytics get implemented widely, we've lost. We'll keep chasing each other with tricks like renaming the api endpoints, randomizing the javascript hash, etc. for a while but if we end up having to run an ML model in the browser to attempt to detect when our data is being stolen we've lost a long time before. Might be better to shame any website caught using it with some crowd-sourced list of some kind - then at least we'd know who the bad actors are and force their content through an isolated container / proxy / VPN, or simply stop using them altogether.
- closewith 4y ago
  If that's the case, then the war is already lost. But happily, in the EU - the market I operate in - server-side analytics is seen as an avenue towards compliance. Obviously server-side GTM will be abused in the absence of regulation, but that was also true of the existing technologies. Strong and consistent enforcement can and is bringing companies into compliance.
- trasz 4y ago
  Unless we start actively jamming analytics by injecting lots of fake data. Which well eventually have to do anyway.
  - closewith 4y ago
    Some competitors in hyper-competitive markets already do this, and analytics services are already pretty good at filtering it out.
    - trasz 4y ago
      In the long run analytics will be on the losing side though - because it's possible to jam with patterns generated by other humans, just mashed together, and there is no way to reliably detect that without also making it possible for humans to use it masquerade as generated traffic.
      - 4y ago

tremon 4y ago

The GDPR legislation is about means and goals, not specific implementations. What makes you think GTM isn't similarly illegal already?

gigel82 4y ago
That's great, and we need more legislation (on this side of the pond as well).

ec109685 4y ago

Server side transmission of data to Google would be illegal too.