10 ms·

I have switched one of my sites to cookieless analytics and it is bad for everybody. I can't even say how many users this site has now. It could be the same us

by TekMol 3y ago

I have switched one of my sites to cookieless analytics and it is bad for everybody. I can't even say how many users this site has now. It could be the same user coming back over and over. Or many users. How would I know. Yes, I could track a ton of stats about every pageview like user agent, screen resolution etc and then try to stitch it back together. Trying to figure out how many different users there are. But this type of "stitching together" would probably also count as PII. I cannot test new features and see if it makes users happy so they come back more often. I cannot see if the site has issues on some hardware, software, language. Because I wouldn't see if users affected come back less often. I can't test if an introduction text at the beginning helps users discover important features. Because I can't make the connection between showing the text early on in the user journey and usage of features later on. Because I can't see a user journey. This is a site I run for the enjoyment of me and the other users. Probably a few thousand a month. And I can say the site was much easier to develop with a normal cookie approach to tracking. I have gone the cookieless way for about a year now. And I can say with certainty that it would be a better site now if I kept the cookie approach. When the developer flies blind, that's bad for everybody. I think for a commercial site, where a degradation of 10% in user experience can tank the business, there is no way around cookie tracking to figure out what works for users and what doesn't. This is another reason, why European internet companies do not stand a snowball's chance in hell to compete with their US competitors. European companies need to bug all users and beg for cookies. While US companies only need to do that with their European users.

pelorat 3y ago
Why would you need to know anything but hits/month and ad-revenue/month? Why don't you just hash the IP-address and count unique users that way?
- kmlx 3y ago
  that's easy: to improve the service.
  - austinjp 3y ago
    This is the generic reason that is always given, but I don't think I've ever seen exactly how the service will be improved and why cookies (or any uniquely-identifying data) are the only way to achieve the desired outcomes.
    - janejeon 3y ago
      I'm sorry, but have you tried making and hosting a website? Product Analytics is a very popular category for a reason.
      - austinjp 3y ago
        Many, many times :) My point is that it's never described. Even in the detailed options for those cookie banners that permit you to tweak things. Sure, there are (some) details about "our partners" and advertising etc, but exactly how the service will be improved is never explained. The reason is simple and obvious: nobody knows. Companies collect data in the belief it will be useful in improving the service, but generally chuck it into a data-swamp and occasionally rake it over to extract basic info like navigation routes. I'm also rarely convinced that improvements can't be better determined by focus groups and other similar methods. "Improving our service" is a glib catch-all that rarely stands up to scrutiny. There may be specific examples where a cookie is genuinely the best method to improve a feature -- in which case: name the feature, list the metrics, declare success/fail criteria, and stop collecting the cookie after the decision has been made. Edit: typos.
  - dingledork69 3y ago
    Okay, how? Provide details, thanks.
- mvdtnz 3y ago
  He gave several valid examples in the comment you're replying to.
- seri4l 3y ago
  >hash the IP-address How would that work? I can't think of any approach where getting the original IP back from the hash isn't trivial.
  - throwaway71271 3y ago
    you dont need to get the original ip back, just need to know how many unique ips are there, so sha(ip) is good enough
    - seri4l 3y ago
      I apologize for the double negative. What I meant is that hashing doesn't improve privacy because if you know the hash and the hashing function it's easy to build a hashmap of all the possible IPv4s (around 3.5B). Unless the hash uses some sort of expensive key derivation function, but that doesn't scale.
      - GordonS 3y ago
        You could simply salt the hash, though you'd need to treat the salt as a secret. Alternatively, you could use a new salt every day, which would only allow you to track an individual for a 24 hour period (likely enough for many).
    - quesomaster9000 3y ago
      With little over 4 billion IPv4 addresses. From a stackoverflow post from 12 years ago: > I know I do 622 million SHA-256's per sec on a Radeon HD5830. Which would take around 6 seconds to brute force a 32bit address space.
      - throwaway71271 3y ago
        you can just salt it with some stable random thing
        toast0 3y ago
quickthrower2 3y ago
My violin is probably small-medium sized for this problem. You can talk to your users in person and ask them, or poll them via email. Do usability tests etc. I guess it just costs more. Other industries have to do this, they can't just default-spy on their customers.
- kmlx 3y ago
  > You can talk to your users in person and ask them doesn't scale. > poll them via email doesn't work. > default-spy on their customers analytics is not spying.
  - quickthrower2 3y ago
    you don't need scale, you need good data
    - charcircuit 3y ago
      Good data requires statistical significance which needs scale
      - throwaway71271 3y ago
        you only need 5 people to test poison
  - pydry 3y ago
    You can poll them via pop ups. Ive seen this done a couple of times. The sites took care to make it unobtrusive, sensibly placed and with short, meaningful questions. Frankly I think the data they got drove better decisions than analytics. I liked that they let you write a message too.
    - GordonS 3y ago
      I like this method. Earlier today I filled in some gov forms online, and at the end it asked if I'd like to do a short survey on my experience - I was happy to oblige, because I have a personal interest in service improvement.
SanderNL 3y ago
This is similar to law enforcement saying: "You mean we cannot track everything you say and do. How in the world are we supposed to do our jobs safely and efficiently?" Answer is, you basically can't. Not safely and not (as) efficiently. Because the world will turn dystopian and will destroy the very thing we are trying to create/maintain. (Happiness, etc) It's nice to be able to A/B test your blog or product. It's cool and efficient, but it also hurts and to me that hurt outweighs your company's marginal benefits although it is a nuanced and difficult discussion to be fair. I'm being simplistic here to make the point clear. I hope.
- TekMol 3y ago
  The difference is that keeping cookies is a user choice. You can set your browser to not store cookies at all. Or to discard cookies when you close it. Or you can delete cookies whenever you feel like.
  - arendtio 3y ago
    The problem is that there are good and bad cookies: - session cookie: good - tracking cookie: bad I remember a time when browsers would ask you for every website if you wanted to keep the cookies and because most cookies were good cookies, everybody agreed to accept them. Later came the ad industry and started to introduce bad cookies.
- arp242 3y ago
  > it also hurts How is simple analytics or A/B testing that's NOT internet-wide tracking (that is, only for the website you're on) or sold (which would be outright illegal without explicit consent) hurting you? Genuine question, because I don't see it. Internet-wide tracking across many sites: sure. But that's a very different thing – it's the difference between "I'm home Darling, I saw Sander at the mall today" vs. "Hello everyone, here is everything Sander did this week".
  - andirk 3y ago
    The data is that of "I have a person who likes monkey paws" and then they can sell that to the monkey paw conglomerate. Next thing you know you're getting monkey paws in the mail!
avgcorrection 3y ago
Oh no. But that’s how all desktop programs without telemetry work.
arendtio 3y ago
How about tracking the users pulse while he reads your website via his smartwatch. Wouldn't that give you even more insights into the emotional journey? My point is: You have to draw the line somewhere (and I think the GDPR line is very reasonable). If you are a business relying on having a perfect website, you can use other means like UX labs.
MrVandemar 3y ago
For some reason my empathy-o-meter isn't really registering your plight. Look, the needle isn't budging, not even a bit.
akomtu 3y ago
IP address + User-Agent gives you enough data to track "user journeys" whatever this is. I'm curious, what is your favorite example of improving your website based on cookies that you couldn't do with basic IP+UA tracking?
phh 3y ago
Not really cookie-less and it can be considered a regression compared to cookies because of JS, but something that can work is doing stats + anonymization client-side. You can store information client-side, without sending them over network, but randomly send digests back to your server. For instance you can store a counter of the times the user went to visit the website, and randomly with a 1% probability send that counter to your server. (It's better to make it random, because if you send every +=1 you would end up being able to track users). At my work, I do a lot of statistics of user usage, but I always work to do my best not to leak PII. I'm not a security or privacy researcher, so my work is probably not great but still, the way I do it I believe is largely private: - No unique ID sent, but a daily digest (some people send every single event to their statistics server, and thus need a unique ID to know how many time one person did one action. With a digest that already counts the actions there is no need) - bucketized persistent data: for example the available storage size of the device the app is running on. Sending precise value would make it easier to track digests from one day to the other and track users - For booleans, add some white noise (because 20 booleans is enough to identify someone) - For open-ended information (for instance the list of countries contacted by your SMS app), booleanize it (one boolean per country, cf previous line), and maybe keep a counter to know how many you didn't take into account to know whether you're still missing a lot. Yes overall doing it with no PII requires much more work, but then Big Tech (and smaller techs like Clearview) clearly showed that any PII can and WILL be used against their users. The best way to never leak user's data remains to never have them in the first place.
danielrpa 3y ago
UIs were developed in the pre-web world without tracking or analytics. If you clearly explain that the cookie is for improving the UI and the user doesn't want it, it's because they don't care about it as much as you do.
manicennui 3y ago
This is all bullshit. We literally did this sort of thing for years on the Internet before all of this tracking was common. Every company claims that they are doing this stuff to make things better for users, and it never is.
- jobs_throwaway 3y ago
  > We literally did this sort of thing for years on the Internet before all of this tracking was common. You mean back when your average website was hot garbage? The yearning for the days of static HTML pages is childish atavism
  - manicennui 3y ago
    Who said anything about static HTML pages? Keep beating that strawman though.
  - manicennui 3y ago
    You are literally using a website that was created by someone who started an online storefront app in 1995. Amazon started around the same time. Google a few years later.
  - AlexandrB 3y ago
    The average site today is hot garbage. But now it requires several orders of magnitude more bandwidth and processing power to render. Not sure this is progress.
- jacobsimon 3y ago
  Genuinely asking - what is the easiest method for doing this other than cookie tracking? I’m inclined to agree with the commenter above and it feels like a community of developers would sympathize with this but it seems like everyone is acting like it’s not a big deal.
mtkhaos 3y ago
Local Storage? Cookies are just a Dumb Implementation and only persist due to advertising.
- Veuxdo 3y ago
  You can't use LS or anything like that to get around GDPR.
- Rygian 3y ago
  GDPR is about tracking, not about cookies.
  - jodrellblank 3y ago
    GDPR isn't "about tracking", it isn't even about computers, it's General data protection regulation. If your local grocer keeps a regular customer's record on paper to give you discounts, that's covered by the GDPR. See the UK Gov summary site here: https://www.gov.uk/data-protection https://www.gov.uk/data-protection Or detailed law here: https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacte... And note Part 1 section 3 points 4 and 7: "'Processing', in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as— (a)collection, recording, organisation, structuring or storage" and "“Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually".
dingledork69 3y ago
Sure you can. Just stop crying because you can't share data about your users with 3rd parties without asking them first and get over it.
reportgunner 3y ago
> I can't even say how many users this site has now. > I cannot test new features and see if it makes users happy so they come back more often. > I cannot see if the site has issues on some hardware, software, language. Because I wouldn't see if users affected come back less often. > I can't test if an introduction text at the beginning helps users discover important features. Because I can't make the connection between showing the text early on in the user journey and usage of features later on. Because I can't see a user journey. Why don't you just ask your users about these things ?
layer8 3y ago
> I cannot test new features and see if it makes users happy so they come back more often. Users coming back more often does not imply that they are happy. There’s no substitute for actual user studies.
ff317 3y ago
I'm not saying it's easy or perfect, but Wikipedia does tracker-less analytics, and yet still produces https://stats.wikimedia.org/#/all-projects https://stats.wikimedia.org/#/all-projects . We do use cookies for part of the analysis, but they're not unique user-tracking cookies. Instead there's one that simply tracks a self-reported datestamp on when the user last visited, which looks something like: WMF-Last-Access=2023-01-01,Expires=Wed, 01 Feb 2023 12:00:00 GMT (we send a Set-Cookie for this with the current datestamp only to the 1-day accuracy, which expires ~32 days after it's set (but rounded to 12-hour accuracy), and is replaced constantly). There's another more-recent one we use that's explicitly about differential privacy, which send back info on the hashes of the 10 most recent URLs you've visited on the site, IIRC. None of them are unique tracker hashes for a given user, though.
- snthd 3y ago
  >which send back info on the hashes of the 10 most recent URLs you've visited on the site, IIRC. None of them are unique tracker hashes for a given user, though. That seems highly unlikely to never be unique for some users.
  - ff317 3y ago
    The hash is keyed and rotates once a day, so it's not a long-term history. And in any case, nobody's trying to build a unique tracker out of it on the other end, which is the main thing (even in our internal analytics, we even throw away the PII we get directly from request attributes after 90 days).
denton-scratch 3y ago
> and it is bad for everybody Hang on, it's not bad for me. If I visit your site, it's not because I want to participate in some kind of A/B testing (whose results you'll never tell me about). And if your site only works if I happen to have hardware X installed, you don't need analytics to tell you that your site is broken. > European companies need to bug all users and beg for cookies. That's nonsense. If cookies are needed for the correct operation of the site, then there's no need to beg or bug. So your banner should be saying: "Can I please set tracking cookies that make no difference at all to the correct operation of the site? [Accept] [Reject]". Then count the number that say Accept, note that the number is approximately zero, and then scrap the banner.
- ApolloFortyNine 3y ago
  If you paid for said site, sure. If you didn't pay, I'm not sure why you feel entitled to anything.
- pie_flavor 3y ago
  > If I visit your site, it's not because I want to participate in some kind of A/B testing Nobody wants to be part of the A/B testing; everyone wants the polished product that's the result of A/B testing. > And if your site only works if I happen to have hardware X installed, you don't need analytics to tell you that your site is broken. What? Yes you do, or something similar. > If cookies are needed for the correct operation of the site, then there's no need to beg or bug. Strictly needed. Suppose I have a dark theme slider, or a language selector, for users who don't want me to follow their OS's settings (or can't or don't know how to change their OS's settings). That's a nonessential cookie which requires the banner. And if you disagree, your opinion is not worth a lawsuit; the only way to be sure that your use of cookies is limited to those strictly necessary is hire a very expensive european consultant.
  - xigoi 3y ago
    > everyone wants the polished product that's the result of A/B testing. I'd prefer a polished product that's the result of communicating with users.
operator-name 3y ago
But it's not a question of PII, it's about processing for legitimate interests[0]. If you follow the guidelines then collecting and processing specific anonamised stories is not a problem, cookies or not. [0]: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
jodrellblank 3y ago
You could ask people! There is hardly a site I use day to day that I couldn't send a ten paragraph rant about poor usability to the company, if that was socially permissible and felt like they'd care. There's hardly a site I use where I think the developers have ever used it themselves, or ever seen someone trying to use it, for that matter. > "Because I can't see a user journey." Today's worst offender was trying to follow an invite and register an account within a company account, it took me two goes through the signup form, two attempts to edit my profile, trying to login to three different subdomains, one useless search of their documentation site, three error messages, two rounds of asking my coworker to check their admin side, before I saw the right thing to do. "You" (big silicon valley company) don't need tracking cookies to "see a user journey" or to tell you that "I really love your site because I keep coming back to it and looking around", you need to grab someone in a hallway and push them through the workflow and watch them fall on their face over and over. > "I think for a commercial site, where a degradation of 10% in user experience can tank the business" Imagine how amazing websites would be if that were at all true. Have you seen the user experience of Amazon? or eBay? or Facebook? or 'new' GMail or new Reddit or non-websites like Teams or WebEx?

by TekMol 3y ago

pelorat 3y ago

Why would you need to know anything but hits/month and ad-revenue/month? Why don't you just hash the IP-address and count unique users that way?

kmlx 3y ago
that's easy: to improve the service.
- austinjp 3y ago
  This is the generic reason that is always given, but I don't think I've ever seen exactly how the service will be improved and why cookies (or any uniquely-identifying data) are the only way to achieve the desired outcomes.
  - janejeon 3y ago
    I'm sorry, but have you tried making and hosting a website? Product Analytics is a very popular category for a reason.
    - austinjp 3y ago
      Many, many times :) My point is that it's never described. Even in the detailed options for those cookie banners that permit you to tweak things. Sure, there are (some) details about "our partners" and advertising etc, but exactly how the service will be improved is never explained. The reason is simple and obvious: nobody knows. Companies collect data in the belief it will be useful in improving the service, but generally chuck it into a data-swamp and occasionally rake it over to extract basic info like navigation routes. I'm also rarely convinced that improvements can't be better determined by focus groups and other similar methods. "Improving our service" is a glib catch-all that rarely stands up to scrutiny. There may be specific examples where a cookie is genuinely the best method to improve a feature -- in which case: name the feature, list the metrics, declare success/fail criteria, and stop collecting the cookie after the decision has been made. Edit: typos.
- dingledork69 3y ago
  Okay, how? Provide details, thanks.
mvdtnz 3y ago
He gave several valid examples in the comment you're replying to.
seri4l 3y ago
>hash the IP-address How would that work? I can't think of any approach where getting the original IP back from the hash isn't trivial.
- throwaway71271 3y ago
  you dont need to get the original ip back, just need to know how many unique ips are there, so sha(ip) is good enough
  - seri4l 3y ago
    I apologize for the double negative. What I meant is that hashing doesn't improve privacy because if you know the hash and the hashing function it's easy to build a hashmap of all the possible IPv4s (around 3.5B). Unless the hash uses some sort of expensive key derivation function, but that doesn't scale.
    - GordonS 3y ago
      You could simply salt the hash, though you'd need to treat the salt as a secret. Alternatively, you could use a new salt every day, which would only allow you to track an individual for a 24 hour period (likely enough for many).
  - quesomaster9000 3y ago
    With little over 4 billion IPv4 addresses. From a stackoverflow post from 12 years ago: > I know I do 622 million SHA-256's per sec on a Radeon HD5830. Which would take around 6 seconds to brute force a 32bit address space.
    - throwaway71271 3y ago
      you can just salt it with some stable random thing
      - toast0 3y ago

quickthrower2 3y ago

My violin is probably small-medium sized for this problem. You can talk to your users in person and ask them, or poll them via email. Do usability tests etc. I guess it just costs more. Other industries have to do this, they can't just default-spy on their customers.

kmlx 3y ago
> You can talk to your users in person and ask them doesn't scale. > poll them via email doesn't work. > default-spy on their customers analytics is not spying.
- quickthrower2 3y ago
  you don't need scale, you need good data
  - charcircuit 3y ago
    Good data requires statistical significance which needs scale
    - throwaway71271 3y ago
      you only need 5 people to test poison
- pydry 3y ago
  You can poll them via pop ups. Ive seen this done a couple of times. The sites took care to make it unobtrusive, sensibly placed and with short, meaningful questions. Frankly I think the data they got drove better decisions than analytics. I liked that they let you write a message too.
  - GordonS 3y ago
    I like this method. Earlier today I filled in some gov forms online, and at the end it asked if I'd like to do a short survey on my experience - I was happy to oblige, because I have a personal interest in service improvement.

SanderNL 3y ago

This is similar to law enforcement saying: "You mean we cannot track everything you say and do. How in the world are we supposed to do our jobs safely and efficiently?" Answer is, you basically can't. Not safely and not (as) efficiently. Because the world will turn dystopian and will destroy the very thing we are trying to create/maintain. (Happiness, etc) It's nice to be able to A/B test your blog or product. It's cool and efficient, but it also hurts and to me that hurt outweighs your company's marginal benefits although it is a nuanced and difficult discussion to be fair. I'm being simplistic here to make the point clear. I hope.

TekMol 3y ago
The difference is that keeping cookies is a user choice. You can set your browser to not store cookies at all. Or to discard cookies when you close it. Or you can delete cookies whenever you feel like.
- arendtio 3y ago
  The problem is that there are good and bad cookies: - session cookie: good - tracking cookie: bad I remember a time when browsers would ask you for every website if you wanted to keep the cookies and because most cookies were good cookies, everybody agreed to accept them. Later came the ad industry and started to introduce bad cookies.
arp242 3y ago
> it also hurts How is simple analytics or A/B testing that's NOT internet-wide tracking (that is, only for the website you're on) or sold (which would be outright illegal without explicit consent) hurting you? Genuine question, because I don't see it. Internet-wide tracking across many sites: sure. But that's a very different thing – it's the difference between "I'm home Darling, I saw Sander at the mall today" vs. "Hello everyone, here is everything Sander did this week".
- andirk 3y ago
  The data is that of "I have a person who likes monkey paws" and then they can sell that to the monkey paw conglomerate. Next thing you know you're getting monkey paws in the mail!

avgcorrection 3y ago

Oh no. But that’s how all desktop programs without telemetry work.

arendtio 3y ago

How about tracking the users pulse while he reads your website via his smartwatch. Wouldn't that give you even more insights into the emotional journey? My point is: You have to draw the line somewhere (and I think the GDPR line is very reasonable). If you are a business relying on having a perfect website, you can use other means like UX labs.

MrVandemar 3y ago

For some reason my empathy-o-meter isn't really registering your plight. Look, the needle isn't budging, not even a bit.

akomtu 3y ago

IP address + User-Agent gives you enough data to track "user journeys" whatever this is. I'm curious, what is your favorite example of improving your website based on cookies that you couldn't do with basic IP+UA tracking?

phh 3y ago

Not really cookie-less and it can be considered a regression compared to cookies because of JS, but something that can work is doing stats + anonymization client-side. You can store information client-side, without sending them over network, but randomly send digests back to your server. For instance you can store a counter of the times the user went to visit the website, and randomly with a 1% probability send that counter to your server. (It's better to make it random, because if you send every +=1 you would end up being able to track users). At my work, I do a lot of statistics of user usage, but I always work to do my best not to leak PII. I'm not a security or privacy researcher, so my work is probably not great but still, the way I do it I believe is largely private: - No unique ID sent, but a daily digest (some people send every single event to their statistics server, and thus need a unique ID to know how many time one person did one action. With a digest that already counts the actions there is no need) - bucketized persistent data: for example the available storage size of the device the app is running on. Sending precise value would make it easier to track digests from one day to the other and track users - For booleans, add some white noise (because 20 booleans is enough to identify someone) - For open-ended information (for instance the list of countries contacted by your SMS app), booleanize it (one boolean per country, cf previous line), and maybe keep a counter to know how many you didn't take into account to know whether you're still missing a lot. Yes overall doing it with no PII requires much more work, but then Big Tech (and smaller techs like Clearview) clearly showed that any PII can and WILL be used against their users. The best way to never leak user's data remains to never have them in the first place.

danielrpa 3y ago

UIs were developed in the pre-web world without tracking or analytics. If you clearly explain that the cookie is for improving the UI and the user doesn't want it, it's because they don't care about it as much as you do.

manicennui 3y ago

This is all bullshit. We literally did this sort of thing for years on the Internet before all of this tracking was common. Every company claims that they are doing this stuff to make things better for users, and it never is.

jobs_throwaway 3y ago
> We literally did this sort of thing for years on the Internet before all of this tracking was common. You mean back when your average website was hot garbage? The yearning for the days of static HTML pages is childish atavism
- manicennui 3y ago
  Who said anything about static HTML pages? Keep beating that strawman though.
- manicennui 3y ago
  You are literally using a website that was created by someone who started an online storefront app in 1995. Amazon started around the same time. Google a few years later.
- AlexandrB 3y ago
  The average site today is hot garbage. But now it requires several orders of magnitude more bandwidth and processing power to render. Not sure this is progress.
jacobsimon 3y ago
Genuinely asking - what is the easiest method for doing this other than cookie tracking? I’m inclined to agree with the commenter above and it feels like a community of developers would sympathize with this but it seems like everyone is acting like it’s not a big deal.

mtkhaos 3y ago

Local Storage? Cookies are just a Dumb Implementation and only persist due to advertising.

Veuxdo 3y ago
You can't use LS or anything like that to get around GDPR.
Rygian 3y ago
GDPR is about tracking, not about cookies.
- jodrellblank 3y ago
  GDPR isn't "about tracking", it isn't even about computers, it's General data protection regulation. If your local grocer keeps a regular customer's record on paper to give you discounts, that's covered by the GDPR. See the UK Gov summary site here: https://www.gov.uk/data-protection https://www.gov.uk/data-protection Or detailed law here: https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacte... And note Part 1 section 3 points 4 and 7: "'Processing', in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as— (a)collection, recording, organisation, structuring or storage" and "“Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually".

dingledork69 3y ago

Sure you can. Just stop crying because you can't share data about your users with 3rd parties without asking them first and get over it.

reportgunner 3y ago

> I can't even say how many users this site has now. > I cannot test new features and see if it makes users happy so they come back more often. > I cannot see if the site has issues on some hardware, software, language. Because I wouldn't see if users affected come back less often. > I can't test if an introduction text at the beginning helps users discover important features. Because I can't make the connection between showing the text early on in the user journey and usage of features later on. Because I can't see a user journey. Why don't you just ask your users about these things ?

layer8 3y ago

> I cannot test new features and see if it makes users happy so they come back more often. Users coming back more often does not imply that they are happy. There’s no substitute for actual user studies.

ff317 3y ago

I'm not saying it's easy or perfect, but Wikipedia does tracker-less analytics, and yet still produces https://stats.wikimedia.org/#/all-projects https://stats.wikimedia.org/#/all-projects . We do use cookies for part of the analysis, but they're not unique user-tracking cookies. Instead there's one that simply tracks a self-reported datestamp on when the user last visited, which looks something like: WMF-Last-Access=2023-01-01,Expires=Wed, 01 Feb 2023 12:00:00 GMT (we send a Set-Cookie for this with the current datestamp only to the 1-day accuracy, which expires ~32 days after it's set (but rounded to 12-hour accuracy), and is replaced constantly). There's another more-recent one we use that's explicitly about differential privacy, which send back info on the hashes of the 10 most recent URLs you've visited on the site, IIRC. None of them are unique tracker hashes for a given user, though.

snthd 3y ago
>which send back info on the hashes of the 10 most recent URLs you've visited on the site, IIRC. None of them are unique tracker hashes for a given user, though. That seems highly unlikely to never be unique for some users.
- ff317 3y ago
  The hash is keyed and rotates once a day, so it's not a long-term history. And in any case, nobody's trying to build a unique tracker out of it on the other end, which is the main thing (even in our internal analytics, we even throw away the PII we get directly from request attributes after 90 days).

denton-scratch 3y ago

> and it is bad for everybody Hang on, it's not bad for me. If I visit your site, it's not because I want to participate in some kind of A/B testing (whose results you'll never tell me about). And if your site only works if I happen to have hardware X installed, you don't need analytics to tell you that your site is broken. > European companies need to bug all users and beg for cookies. That's nonsense. If cookies are needed for the correct operation of the site, then there's no need to beg or bug. So your banner should be saying: "Can I please set tracking cookies that make no difference at all to the correct operation of the site? [Accept] [Reject]". Then count the number that say Accept, note that the number is approximately zero, and then scrap the banner.

ApolloFortyNine 3y ago
If you paid for said site, sure. If you didn't pay, I'm not sure why you feel entitled to anything.
pie_flavor 3y ago
> If I visit your site, it's not because I want to participate in some kind of A/B testing Nobody wants to be part of the A/B testing; everyone wants the polished product that's the result of A/B testing. > And if your site only works if I happen to have hardware X installed, you don't need analytics to tell you that your site is broken. What? Yes you do, or something similar. > If cookies are needed for the correct operation of the site, then there's no need to beg or bug. Strictly needed. Suppose I have a dark theme slider, or a language selector, for users who don't want me to follow their OS's settings (or can't or don't know how to change their OS's settings). That's a nonessential cookie which requires the banner. And if you disagree, your opinion is not worth a lawsuit; the only way to be sure that your use of cookies is limited to those strictly necessary is hire a very expensive european consultant.
- xigoi 3y ago
  > everyone wants the polished product that's the result of A/B testing. I'd prefer a polished product that's the result of communicating with users.

operator-name 3y ago

But it's not a question of PII, it's about processing for legitimate interests[0]. If you follow the guidelines then collecting and processing specific anonamised stories is not a problem, cookies or not. [0]: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

jodrellblank 3y ago

You could ask people! There is hardly a site I use day to day that I couldn't send a ten paragraph rant about poor usability to the company, if that was socially permissible and felt like they'd care. There's hardly a site I use where I think the developers have ever used it themselves, or ever seen someone trying to use it, for that matter. > "Because I can't see a user journey." Today's worst offender was trying to follow an invite and register an account within a company account, it took me two goes through the signup form, two attempts to edit my profile, trying to login to three different subdomains, one useless search of their documentation site, three error messages, two rounds of asking my coworker to check their admin side, before I saw the right thing to do. "You" (big silicon valley company) don't need tracking cookies to "see a user journey" or to tell you that "I really love your site because I keep coming back to it and looking around", you need to grab someone in a hallway and push them through the workflow and watch them fall on their face over and over. > "I think for a commercial site, where a degradation of 10% in user experience can tank the business" Imagine how amazing websites would be if that were at all true. Have you seen the user experience of Amazon? or eBay? or Facebook? or 'new' GMail or new Reddit or non-websites like Teams or WebEx?