37 ms·

Companies must stop using Google Analytics

646 points by pseudotrash 3y ago

karles 3y ago
This has also happened in Denmark.
rightbyte 3y ago
I wonder if this also will apply to Google's ad related spyware? Going after just Analytics seems like quite a small step.
- Puts 3y ago
  This authority does not go after anybody. They got a complaint by NOYB regarding these specific companies and therefore was forced to investigate specifically them.
Pannoniae 3y ago
Analytics right now is basically "you won't get any useful information for your website because we value users' privacy, don't worry we see all of the data anyway" Remember, you aren't the customer if you embed Google Analytics, Google is. edit: if you want analytics, honestly just roll your own... you can't trust advertising companies with your users' data
- Cthulhu_ 3y ago
  "Roll your own" is hubris, unless you have the time, energy, inclination, theoretical knowledge, etc; I wouldn't try and solve solved problems if you can help it. But, host your own is definitely recommended IMO; a lot of the GDPR issues are resolved if you just host your own, because no data is shared to a 3rd party. Then you only need to worry about getting some approval and data retention. I'm sure data retention is a non-issue if you process raw analytics data (that can be traced back to a user) into generalized statistics, too.
  - gsatic 3y ago
    > unless you have the time, energy, inclination, theoretical knowledge Why does anyone need all that?
    - vntok 3y ago
      Because setting up useful analytics for almost any definition of "useful" is not a trivial "I could do this in a WE" project.
      - Pannoniae 3y ago
        The better question is.... what analytics do you actually need? I don't think cross-page tracking of the user is something most websites need... Useful information is more like, what users clicked, what platform did they use, how much time they spent on the website and things like that. Those aren't that hard to just track yourself.
        quickthrower2 3y ago
        I reckon server render based analytics (as opposed to cookies and pixels etc. on 3rd party domains) will be better because it wont be blocked by ad blockers. If the page got rendered and sent, well I know about it unless you blocked the site entirely.
  - Pannoniae 3y ago
    I'm much more productive since I realised I don't have to use "standard" tools. It saves me so much time. With that being said, I don't make everything myself, but just the thought that I'm not obliged to use the best-practice standard solution to the problem is liberating to me and it makes me so much more productive in actually doing stuff.
    - victorNicollet 3y ago
      Besides, even if you use the standard tool today, five years from now this will be "the tool that was standard five years ago" unless you actively migrate every so often. There are a few domains where the standard tools remain the same for a long while (Google Analytics being one), but often the standard tooling shifts more frequently than that.
- ehnto 3y ago
  Matomo is a good self hosted analytics option.
  - ra 3y ago
    As is snowplow https://github.com/snowplow/snowplow-javascript-tracker https://github.com/snowplow/snowplow-javascript-tracker
    - laichzeit0 3y ago
      Deploying the Snowplow backend is non-trivial (to put it mildly) and extremely expensive if you don't want to host it yourself.
      - shermozle 3y ago
        €0.02/day and easy enough for anyone with basic cloud skills: https://www.dumky.net/posts/own-your-web-analytics-pipeline-for-0.02-per-day-snowplow-terraform-dbt-bigquery-and-docker/ https://www.dumky.net/posts/own-your-web-analytics-pipeline-... (With caveats: This is a toy pipeline. More work required to make it robust and probably not a great option for any site with reasonable traffic. But easy to get started and play.)
  - sschueller 3y ago
    I am a bit concerned about how Matomo deals with security. All their PHP code is located in the public folder and they use nginx[1] rules to block access to scripts that are dangerous. [1] https://github.com/matomo-org/matomo-nginx/blob/master/sites-available/matomo.conf#L36 https://github.com/matomo-org/matomo-nginx/blob/master/sites...
  - jacooper 3y ago
    Plausible is a better alternative.
  - nerdbert 3y ago
    We found it to be nothing but trouble. Disappearing data, database servers bogging down under what should be trivial load because of inefficient SQL design, painful upgrade process, etc.
- EGreg 3y ago
  This is true not just for analytics but pretty much all features. Imagine you are a great speaker and instructor and have an audience. Right now you GIFT it to YouTube, Twitter, etc. and they monetize it for you, give you a tiny percentage, and even constantly direct your audience to competitors and other distractions. In fact YouTube even sells an option to advertise your videos on your competitor’s videos! I say — opt out. Run your own everything! Your own community software (instead of Discord). Your own videoconferencing, livestreaming, chats, presentations, gated content, accept payments with crypto in addition to PaymentRequest. It’s hard to build an open-source alternative that is good enough (no, Mastodon and Bluesky aren’t — yet). Which is why (shameless plug warning) I spent 12 years and $1 million dollars with my team to build it. https://github.com/Qbix/Platform https://github.com/Qbix/Platform Use it — as 1 of hundreds of features, you can have your own analytics on your own database on your own community site. The other features are here: https://qbix.com/features.pdf https://qbix.com/features.pdf PS: Don’t get me wrong. Keep using YouTube to host your content, etc. But relegate it to hosting short form teasers and highlights and testimonials all of which link to your site. People can discover you on the big sites but if they are serious about your long-form content and community they should buy a membership on YOUR site and have a direct relationship — then deplatforming or coersion will be the last of your worries.
  - kristiandupont 3y ago
    All the videos on qbix.com itself seem to be hosted on youtube? Also, the features pdf lists "nodejs" and "php" as features.. I don't mean to be snarky here, but I am simply not sure what this product is?
    - EGreg 3y ago
      Watch the videos for a start
      - nottorp 3y ago
        Who has time to watch videos without a high level overview? :)
- bennyp101 3y ago
  That's essentially what I did, don't need to know the browser or device or where they are from (the product is UK only, so it's largely irrelevant) - so as I control the server side, just log page visits and certain CTA's, and can see a rough journey of where people have been and if they placed an order or not. That's far more useful than hoping that people have JS enabled or tracking stuff blocked. (I.e. Can see that they visited an order page, then back to FAQ's, then clicked on a "whats is x" link - so should probably update the content on the order page to explain what X is) Obviously it depends on what data you actually need, but that gets me most of the way there without gathering a load of data that isn't needed
- jhpacker 3y ago
  Most alternatives are not made by advertising companies, but they also frequently aren't free... Rolling your own from the ground up is not necessary or typically advisable when there are so many good options, including many self-hosted and open source options if you're wanting that level of control. I usually describe the cost of GA as "subsidized by your customers' data".
appleflaxen 3y ago
I am so grateful for the progressive policies in Europe that help the entire globe.
- oneeyedpigeon 3y ago
  Me, too! Although I suspect you're an American and are being sarcastic...
  - nologic01 3y ago
    There are millions of people in this industry that feel moral choices should not stand in the way of lining their pockets... Ridiculing the laws of countries and people that happen to have some traces of a moral compass shows that basically people have every reason to be suspicious.
  - appleflaxen 3y ago
    I am completely sincere.
- pelasaco 3y ago
  Missing a /s ?
  - appleflaxen 3y ago
    No. I wish the US had stronger antitrust enforcement .
- moduspol 3y ago
  Yes. Every time I see a cookie consent dialog, I do a quick "thumbs up" to our pals in Europe.
  - gkbrk 3y ago
    And you don't consider that the website puts up a consent dialog because they want to (ab)use your personal data? No need to put a consent dialog if you are not stalking people.
AbhiAmbad 3y ago
why? then what are the alternatives of google analytics. Google is big guient that are collecting all world data. alternative platforms are doing the same. We are not secure anywhere i think. Privacy is already brocken, no options.
- Nextgrid 3y ago
  > then what are the alternatives Don't stalk people is the alternative.
  - AbhiAmbad 3y ago
    I am not stalking anything. I am asking not suggesting anything. Just read the comment first and react on that. No manners
- perlgeek 3y ago
  > Privacy is already brocken, no options. And thus you question every attempt to fix it?
  - AbhiAmbad 3y ago
    Yes, We need anaytics for our website. even for ranking on search engine. There is no other option. GA, GTM, GSC are the top tools we have to use. If you are a business website owner
    - input_sh 3y ago
      Spin up your own analytics from logs and voila!
    - cuu508 3y ago
      There are plenty of business websites that rank on search engines and don't use GA.
- poniko 3y ago
  Because of the law in US that the governments have right to all data stored on any server that a US company or its subsidiaritets own. That clash with the EU GDPR law and the fact that Sweden categorize IP-adress as a Privacy data point. I.e they can switch to a European vendor that do tracking and analytics.
nubinetwork 3y ago
https://news.ycombinator.com/item?id=36575305 https://news.ycombinator.com/item?id=36575305 among others
esalman 3y ago
Unrelated: I used ChatGPT to generate remark.js presentation HTML code from some content. It did generate the code, but it inserted a GA snippet along with a random GA account code at the bottom of the code. I did not even catch it immediately (laziness, totally my fault), but noticed it a couple of days later when I was modifying the presentation.
- weird-eye-issue 3y ago
  [flagged]
  - Pannoniae 3y ago
    If the world operated on a "who cares" basis, nothing interesting would ever happen.
- janus24 3y ago
  > totally my fault IMHO, it's not totally your fault; private information shouldn't be shared with others. It's your responsibility to verify what ChatGPT is writing before you use it; it's OpenAI's responsibility to not share private information.
  - oefrha 3y ago
    Google Analytics tracking ID is public information.
  - thumbuddy 3y ago
    Just like how google wasn't going to train ML models on your private possibly confidential information...
  - thissitesucks0 3y ago
    [flagged]
  - weird-eye-issue 3y ago
    Here you are making assumptions this was somebody's valid GA ID and not dummy data...
alkonaut 3y ago
Good. I hope the same authority does a round of fines for companies using noncompliant tracking opt out UX too. A nice chunk of total revenue as a fine without prior warning for anyone showing the "Accept all/Show purposes" question would be delicious.
- cuu508 3y ago
  To get the process started for a specific company, submit a complaint to the supervisory authority of the country the company is based in. Contacts: https://edpb.europa.eu/about-edpb/about-edpb/members_en https://edpb.europa.eu/about-edpb/about-edpb/members_en As an example, the article mentions these specific audits were triggered by complaints by NOYB.
deofoo 3y ago
For those who look for an alternative https://plausible.io https://plausible.io is a great replacement.
- Hamuko 3y ago
  Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.
  - rhn_mk1 3y ago
    GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.
    - Hamuko 3y ago
      The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.
  - konha 3y ago
    > Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.
  - jgrahamc 3y ago
    See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/
    - jacooper 3y ago
      I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.
perlgeek 3y ago
I had expected such orders after GDPR went into effect. I guess I was young and naive back then...
- yxhuvud 3y ago
  Government is a lot of things, but seldom fast.
weird-eye-issue 3y ago
I only use GA because our ad provider, Mediavine, requires it
- Cthulhu_ 3y ago
  That's cool and all, but in the end, you are the end-responsible for it; you can't hide behind your ad provider if the GDPR police comes after you.
  - weird-eye-issue 3y ago
    I don't care about GDPR
    - jkaplowitz 3y ago
      This entire thread is discussing a data protection authority’s decision which was based on the GDPR. It wasn’t a blog post arguing against GA due to concerns about Google or similar. If GDPR is irrelevant to whatever you’re trying to say, I think you’re in the wrong thread.
      - weird-eye-issue 3y ago
        I wasn't "trying to say" anything beyond why a lot of websites are forced into sticking with GA. In the content business industry you have to have GA to work with ad providers or if you want to ever sell your site it is a very important part of the due diligence You can argue with that all you want but its just the reality of the industry And am I saying it is an excuse or anything? No, I'm just stating how things are Sad I have to put so many disclaimers in such a simple comment but people like to read into things that aren't there or jump to conclusions.
mediascreen 3y ago
The heading seems very strong considering this is a governmental agency and since they audited a "version of Google Analytics from 14th of August 2020" and presumably not GA4 that works differently.
- mediascreen 3y ago
  Rereading it now seems like "companies" in the heading only refers to the three fined companies and that the decision may be applicable to other companies.
suddenclarity 3y ago
This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 this year. There are arguments that GA4 would fail the same requirements. Denmark hold that view but it hasn't been tried. Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. I find this argument objectively absurd considering how internet works but it possible that's how the law works. We wouldn't know before it has been tried though and I'd be sceptical about anyone claiming to know the result.
- yunohn 3y ago
  > Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. Agreed, this is absolutely ridiculous. And I say this as an EU resident! I’d rather NOT have websites start checking residency/citizenship to decide my data ownership.
  - eek2121 3y ago
    They already do.
    - yunohn 3y ago
      I’ve literally never had to provide such proof, and I would say I use the internet quite a bit. Any example websites?
- supriyo-biswas 3y ago
  The result is the balkanization of the internet, although most folks in the EU want that for nationalistic reasons and to prop up their own industries, under a thin veneer of opposing US imperialism (but being unable to do anything with respect to the things which actually threaten the EU, such as an over dependence on Russia.)
  - foepys 3y ago
j-a-a-p 3y ago
> According to the data protection regulation, GDPR, personal data may be transferred to third countries, i.e. countries outside the EU/EEA, if the European Commission has decided that the country in question has an adequate level of protection for personal data that corresponds to that within the EU/EEA. However, the CJEU ruled through the Schrems II ruling that the United States could not be considered to have such an adequate level of protection at the time of the ruling. - European Court of Justice (CJEU) I always thought that by asking for permission in the privacy statement, and in the cookie banner analytics cookies are also explicit usually, it would be OK. But indeed, even if you refuse the analytics cookies (I do that automatically, who doesn't?), that still does not stop the website from transferring PII to google analytics. I am assuming that here, not a user of analytics, but i suppose it will still work without cookies, maybe just a little less accurate.
- magriz 3y ago
  Thing is, the IP address is also considered personal information (since it can be combined with other data to identify a person), and it is getting transferred with every request. The CJEU ruling about the US is mainly due to the fact that US service providers have to hand over all data if US government agencies request it.
  - j-a-a-p 3y ago
    Yes - it is more or less the same. In the EU they have to provide the data to the local authorities as well. Using any analytics, hosted in US, in the EU or hosting it myself, will involve moving and storing PII. To be clear, I agree we should keep PII in EU. But I doubt that an EU solution will improve anything for the end user.
Gordonjcp 3y ago
I put Google Analytics on my forum because I thought that maybe having it would help it be found in Google Search. Google Lighthouse immediately started pissing and bitching about slow page load times because it had to wait for Google Analytics to load. My site still does not really show up much in Google Search. I binned Google Analytics because it basically did fuck all of any use. I don't have one of those fucking idiotic cookie popups, because it doesn't need one, no-one needs one, and they're entirely meaningless noise.
dijit 3y ago
My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se https://medieinstitutet.se) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6-12mo on new analytics systems (or, god forbid, not be an analyst at all!). I think we don't really assess the amount of lock-in we allow when we learn something that supposedly makes our lives simpler. Google Analytics was sold as a solution to you making your own analytics, because that's hard! and the cost is that google gets your information too- which most webmasters don't care about individually. However now we're in a situation where at least a few thousand people depend on this precise tool existing, and will be economically useless if it is banned. Personally I find this astonishingly foolish of the people who train exclusively on these tools instead of first principles and primitives. That said; we also have "Cloud Engineer" as a job title, so I'm not sure we will learn this lesson.
- znpy 3y ago
  what you wrote is mostly true but also partially incorrect: many competencies are transferrable. there are privacy-compliant products in that sense, unless you've been literally told "click here and click there" you should be able to employ old concepts with new tools.
  - vladvasiliu 3y ago
    Given GP's paragraph: > Personally I find this astonishingly foolish of the people who train exclusively on these tools instead of first principles and primitives. I wouldn't be surprised for this to be a "click here and click here" kind of training. I've seen a painful amount of those. And then, when the inevitable "new and improved ui" comes along, these people are lost and require a new training.
    - bdcravens 3y ago
      These are essentially "IT Factory Workers". To be honest, I think there's value in that, with the same economics of "traditional" factory workers.
acatton 3y ago
Who needs analytics? I'm confused. When I worked at companies using google analytics, 99.9% of the time they could have gotten this data from server logs with something like awstats or goaccess. To this day, I still don't get what's the point of embedding some javascript to do extra-requests or a tracking pixel, when the data was already given once.
- switch007 3y ago
  Marketing teams with large budgets. Not that they actually get questioned properly about actual stats, but they can confidently say they have GA set up and it’s showing some numbers, so just trust us. Google is “trusted”. Why would the person setting their budget put faith in some hand rolled/open source solution ?! /s
- darkr 3y ago
  It's a problem introduced at least in part by SPAs. When the application runs entirely in the client browser, save for a few API calls (that may be shared between multiple pages) it's difficult to tell which pages are actually being viewed, unless you have the client application report back to you (or to Google)
  - capableweb 3y ago
    Easily addressable by including a header like x-from-page where you declare which "SPA route" the backend requests were made from.
- jkukul 3y ago
  With server side tracking you're not able to identify and properly track non-logged in users. GA (and other client-side tools) take care of this, via cookies. Additionally, a common argument is that the server side logs contain a lot of logs from bots/crawlers and GA (and alike) can filter them. The other side of the coin is that GA (and alike) are not able to track users with Adblockers. EDIT: not sure why I'm downvoted - the OP asked for some reasons why people use client side tracking and I listed them. I didn't say that I support these practices, but maybe I should have made that explicit to comply with the overall sentiment of this site.
hamasho 3y ago
I've finally come to the conclusion that user tracking is generally a poor practices and should be regulated. As a web developer, I didn't see it as a big problem. We always do it to maximize ad revenue, find out where users leave to increase conversion rate, and simply to improve UX. But even when the intent is to improve UX, tracking is inappripriate. Imagine if a robot vacuum recorded videos of your home and uploaded them so that bunch of ML engineers can see and use it to improve the algorithm. Or the videos of your car's camera (both of inside and outside). I mean, I'm not surprised if this is already happening, but it's a disturbing thought and should be regulated. We can certainly develop functional services without tracking users.
- oneeyedpigeon 3y ago
  Advertising is the big gotcha here. What I think we need is for more and more companies to own their advertising rather than farming it out to third parties. We'd get better advertising AND it would be less intrusive.
  - robertlagrant 3y ago
    It just scales better to have web intern paste in a GA code snippet into their website and that's that - you get revenue and web analytics all in one. If you have to set up your own server (or at least your own subdomain that points to a GA server IP) then it's more likely to go wrong. I'm sure it'll happen, though.
- thumbuddy 3y ago
  It's almost certainly happening.
- sethammons 3y ago
  > Imagine if a robot vacuum recorded videos of your home and uploaded them so that bunch of ML engineers can see and use it to improve the algorithm. https://www.technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/ https://www.technologyreview.com/2022/12/19/1065306/roomba-i... Yup, happing. Recent news on a lady whose vacuum took a pic of her on the toilet being leaked.
pSYoniK 3y ago
What I am curios about is how much people actually use ALL the analytics information provided by a lot of these tools. I know Matomo and other such open source/self-hostable solutions, but how much info do you really use? I think for most use cases users would want to know if their content is consumed/read. Maybe how long someone spends on it and where they came from. For this sort of stuff you can write a small script to parse your logs. I did something along these lines to parse Caddy logs to get some idea of how many people visit a link. That's really all I needed and the great part is that I run it whenever I want an update, so it's not consuming resources constantly. The logs are cleared and the output is saved before logs are cleared so I know Article 1 had 39 views (or less!) and Article 2 had 5 views and so on... So I think we're overdoing it and we would benefit from taking a few minutes before going down the rabbit hole of analyzing EVERYTHING.
- oneeyedpigeon 3y ago
  > For this sort of stuff you can write a small script to parse your logs. IFF you have access to your logs.
  - sethammons 3y ago
    Why would you not have access to your logs? Not having access to logs doesn't even make sense to me. We honor hippa and gdpr and we can access logs. Beyond that, I am a proponent of structured logging and log aggregators that can help you see trends and analyze the logs, like Splunk or, to a lessor extent, DataDog.
  - pSYoniK 3y ago
    So you can setup GA but you can't check your web server logs?
    - oneeyedpigeon 3y ago
      That covers everything hosted on GitHub Pages, as one example.
- Pannoniae 3y ago
Garvi 3y ago
Every time a client makes me implement google analytics or facebook pixel code I die a little inside. And even though some actually use google ads, they have zero benefit from using analytics. I know, because I'm the one adjusting their campaigns. It's just another thing everyone does and one would be stupid not to, right, right? The lemming mentality always makes me sad because so many bad things in our society are a result of it. And every time someone says that rolling your own is a waste of time,.. I roll everything my own, including CMS / SPA frameworks, because it's a giant waste of time to do otherwise in the long run. The only time I waste regarding rolling on my own is when tobacco is involved.
- dieulot 3y ago
  Could you link to a site where you’ve rolled your own SPA? Or ideally the source code. I’d like to take a look as not many people do that, even less do so with enough attention to detail not to cause UX regressions (not that third-party solutions are brilliant either).
  - Garvi 3y ago
    I'm an enjoyer of anonymity online and would rather not doxx myself. However if you have a specific question, I'd be happy to answer. I use js/jq for the front-end and php for the backend. Once you have your own CMS, turning it into a SPA means turning your index.php into a index.html that is php free and relies on ajax calls to change the content. So at minimum you need a mainbody.php and a head.php that accept inputs. After that it's just onclick actions on buttons that trigger the ajax function changeMainbody(targetPage). Or changeHead() after a user loggs in. On the phone app side you use the regular WebView, to avoid any cross-origin blocks and problems. Alternatively you can run it locally and pass the cookies as inputs - depending on the app needs. Should be safe using https, right? I fully expect to be scolded by someone with 20years more experience, but I guess that's how you learn. Of course there's more to it, depending on the app needs. In my case it also auto refreshes the contents on a js timer. What UX regressions did you have in mind as troubling? Things like resetting one's password if forgotten? Well all those things need to be turned into their own ajax calls and php scripts as well and sometimes reworked to fit mobile users needs. For resetting passwords specifically I just copied what Twitch.com does.
TekMol 3y ago
One could still use Google Analytics by proxying the tracking events. Afaik only the IP is considered private data. So one could mask or (non-reversibly) hash the IP, remove anything else which might be considered private data and then send the event to Google. A simple PHP script with a few lines of code could do that. But Google lost me by: A) Making it impossible to convert your old data into the new Analytics version B) Abandoning the API which allowed you to code your own reports. Over the years, I wrote a ton of code that talks to the API. This is all worthless now. I recently switched to self-hosted Matomo. At first I did not think much about it, but now after I got used to it, I have to say it is much better than GA. The interface is so much nicer and snappier. And more logical. Apart from that, I like that it is open source. If there ever is a point in the road where the makers of Matomo decide on a non-compatible fork, I'm sure the community will write a converter that converts the old data into the new format. And after using it for a while, it hit me: You can write your own reporting tools by just querying the MariaDB database! Using SQL is so much better than it was to fight the insanely complex and unintuitive Google Analytics API. If I really wanted to still use Google Analytics, I would just write a converter, which pumps all the Matomo events into Google Analytics. That would be a GDPR-compliant way to use Google's tools. But I don't. I'm done with Google Analytics forever. Matomo is the promised land for me.
- bunnyfoofoo 3y ago
  You can’t hash an ipv4 address. It’s trivial to brute force all possibilities given the limited problem space.
  - leononame 3y ago
    But you could use a salt, right?
    - Qwertious 3y ago
      A salt will render rainbow tables useless, but AIUI will not prevent brute-forcing after the fact. IPv4 has ~4 billion addresses, which would be too expensive for data analytics but could be brute-forced if someone really wants this one piece of data in particular.
beefield 3y ago
So, a dumb question. What's the easiest way to run privacy friendly analytics on static github pages? "Privacy friendly" as in unambiguously no need for cookie/gdpr permission popups. "Analytics" can be as simple as page loads per day count. Anything beyond that is a bonus.
- marvinblum 3y ago
  I guess you can use any JS snippet integration available. There are plenty of alternatives: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv... I'm the co-founder of Pirsch (pirsch.io), so if you have any questions regarding analytics (any, not just ours), let me know. For our solution I can assure you that it's GDPR compliant and doesn't require a cookie consent banner.
  - beefield 3y ago
    Are those typically blocked by adblockers?
    - marvinblum 3y ago
      Yes, all of them. For a non-blockable approach you can use a proxy on your own domain or by using a server-side integration. https://docs.pirsch.io/get-started/proxy https://docs.pirsch.io/get-started/proxy
- alxmng 3y ago
  Put it behind CloudFlare free plan. You’ll get total uniques for the domain. No hosting or JS required.
bborud 3y ago
What analytics solutions are there that you can host yourself?
- jkukul 3y ago
  I tried the self-hosted version of Matomo [1][2] a few years back but I remember it was a bit underwhelming for the effort required to set it up. [1] https://matomo.org https://matomo.org [2] https://github.com/matomo-org https://github.com/matomo-org
amelius 3y ago
I'm afraid this is not going to help much. Instead, we should have a law against a panopticon. I wonder how fast we'd have such a law if Google were a Chinese company ... Perhaps the way to get rid of Google Analytics is thus to start a Chinese company and make everybody use their analytics tool.
dathinab 3y ago
Nothing surprising, this was kinda clear already not too long after the regulation was passed and since then quite a lot of curt decisions which bordered that topic have painted a very clear picture of "it's not really compatible with the law/regulation but you might get away with it anyway". Also given some scamy things google was found to be doing in their ad business and personal experiences people I know had when running different statistics and ad providers along side of google and noticing gross divergence I _personally_ really wouldn't trust google analytics or ads at all if I where a business.
draw_down 3y ago
[dead]
selfhoster69 3y ago
As long as it is via domains I am able to block, it is fine.
phartenfeller 3y ago
I am using a self-hosted Plausible [1] instance, which is GDPR-compliant out of the box with no cookies required. I am super happy with it. The only downside is that you need to run Postgres and Clickhouse which is overkill for my small sites (an option that only uses SQLite would be great). I don't want to track my users. I just want to see which pages get traffic. Sometimes I am also curious about where visitors come from (by country) and what devices they are using. In a newer update, they allow region tracking based on cities. I think this is too much information. I did not enable this and hope they won't add other more intrusive features. [1] https://plausible.io/ https://plausible.io/
- berkes 3y ago
  I'm using the hosted version of plausible. After I hit the FP of HN two times in a month, their billing warned me of overusage. One email, In which I explained the situation from me, and I got a very friendly email back, from a human, in which they allowed me to stay on my small plan despite the overuse.
openplatypus 3y ago
This yet another ruling after Austria, Finland, France, Denmark and Italy https://wideangle.co/blog/is-google-analytics-illegal-under-gdpr https://wideangle.co/blog/is-google-analytics-illegal-under-... The writing was on the wall for years now. Some DPAs like CNIL fire warning shots first, giving 4 months to comply. Then the fines keep rolling.
openplatypus 3y ago
If you need a powerhouse like Google Analytics and are not afraid of complex UI, go with Matomo. Even better if you self-host and have people to support it. If want something lighter that is just a turn key solution but lets you grow (collecting more data for users who gave you consent, or being super strict about privacy without consent) then go with Wide Angle Analytics (our product). The time when GA was the only option is long gone.
nologic01 3y ago
When I visit a company site and it uses google analytics I know they are either: lazy, ignorant or hostile towards their (potential) clients. This set of possibilities spans all cases and none is actually a positive signal. Companies (and any entity that has an online presence for that matter) are entitled to know what people are doing in their platform and use any appropriate tool for that purpose. They are not entitled to share that with anyone without the explicit warning and approval of their users. The Web as a digital predation ground where the amoral fleece the ignorami must stop. While (commercial) life is not exactly an ethical showcase, the digital version as it has come to evolve is particularly out of kilt with common norms.
- mritchie712 3y ago
  How many do you really think are hostile? Your average person at your average company will one day think, "how are people finding out about us?". They do a Google search for how to answer this question for their company and find Google Analytics. This is certainly not hostile. May be slightly ignorant, but can you blame them?
  - nologic01 3y ago
    For sure i have come across websites where my eyes rolled ("common guys, i know you are better than this"). But the web has not been transformed from a web of users to a web of data mined "product" without very conscious moral choices by many commercial actors.
- dolmen 3y ago
  Government web sites also use Google Analytics. Which means we are tracked much beyond our shopping profile.
- henham 3y ago
  "They are not entitled to share that with anyone without the explicit warning and approval of their users." So using the by law (GDPR) required consent management (cookie banner) where the user has the chance to opt out of any tracking would make them not "lazy, ignorant or hostile" anymore? I think users should have tight control over their own data and what they share but being against all 3rd party ad or analytics vendors would be against digital user acquisition for 99% of websites out there.
phantomathkg 3y ago
Not saying it is morally correct to use Google Analytics. But I still find it amusing the Nordic countries see it is OK for everyone to know everyone's else salary while it is not OK for Google to know your IP. https://www.dailyscandinavian.com/income-tax-transparency-norway-sweden/ https://www.dailyscandinavian.com/income-tax-transparency-no...
- dangus 3y ago
  I wouldn’t call this amusing at all. That’s consistent with a commitment to protection of the common citizen. Salary transparency benefits the worker. If I know my colleague doing the same work makes more money than me, that gives me leverage to request and receive a raise. If I know the CEO of my company makes 1000x my salary, that gives the workers collective bargaining leverage. The only people who benefit from keeping their income private are the wealthy.
shadowgovt 3y ago
Interesting. I thought Google had built the tooling needed to keep European data in EU servers ages ago for compliance on this topic. Maybe I'm thinking of just Google Cloud?
larata_media 3y ago
While I appreciate the push for privacy and anti-tracking, ultimately the tools to prevent tracking are in the hands of users and organizations. The concept that countries have jurisdiction or even exist within the confines of the web is a laughably antiquated idea projecting itself into a realm where it doesn’t belong. Google and all of the usual suspects will continue to collect information about the public in all of the ways that they want, while the naive public believes in some false notion that their leaders are protecting them from the big bad wolf. If you don’t want to be tracked, the only person who can prevent that is you. Government agencies are the keystone cops or this is world. All they’re doing is a Chinese fire drill.
earthboundkid 3y ago
Good news then, Google has deliberately and bizarrely broken its API, so thousands or possibly millions of legacy sites will never correctly report their analytics again.
gmsiperx 3y ago
That's why we built Usermaven.com, a privacy-friendly website and product analytics tool. Our website analytics module is simple and gets the job done in one single easy-to-use dashboard. However, if you want to dig deep, you can use funnels, journeys and other features to get more insights out of our analytics. Usermaven collects all client-side events automatically so it makes it really easy for marketing teams to get insights without involding devs. We also offer simple ready-made reports for SaaS businesses to get product insights.
- cuu508 3y ago
  > For purposes of data protection laws, Userrmaven Inc., a company duly incorporated and organized under the laws of the United States of America, having its registered address at 2055 Limestone Road STE, 200-C, Wilmington, Delaware 19808, is the “data controller” > To integrate your website or SaaS app with Usermaven, you'll need to add a simple tracking script into the Header (<head></head>) section of your website. Make sure this snippet is present on every page that you want to track. (The tracking script's URL is https://t.usermaven.com/lib.js https://t.usermaven.com/lib.js) So similar issues as with Google Analytics – site visitor's data is being shared with an US company.
- SahAssar 3y ago
  Do you have any info page for how you implement stuff like funnels, journeys, etc. without storing any PII? Also this paragraph from your GDPR page had me scratching my head a bit: > Usermaven agrees to abide by the standard contractual clauses where data is transferred from the EU to the US. Is that written before Schrems II?
jacobyoder 3y ago
Had an engagement with a client a few years ago and GA came up. Folks on our side tried to avoid Google where possible, and I'd suggested some alternatives. Matomo, Fathom(IIRC) or others - multiple folks on the team had experience with these alternatives, but the client was insistent on GA. "This is the industry standard - look at all the billion dollar companies running GA - this is what we should use". I pointed out those comparison companies also had dozens of engineers per project; we had 3 part time people. The argument kept coming down to "GA is the standard; GA is what people know". Which is... true, if not somewhat circular. My other suggestion was try multiple; run GA and Matomo together, for example, for a bit. Or GA on just the public marketing site, and something else on the internal application. Nope, because they wanted to track every single ad spend all the way through to registered user usage of the internal business application. Knowing that the $70 you spent in Tacoma geo lead to 3 users registering then knowing that those 3 people routinely used a budgeting tool more than the $90 spent on 8 people who registered from Toronto... apparently those sorts of analytics might be needed in the future, so we have to have this. Instead of "let's just install both for a few weeks and try them", this became "let's 'investigate' multiple options and write reports about the pros and cons of each". Nuts. My larger concern was that, for testing/dev purposes, we'd not have as easy a time of 'resetting' an analytics DB that was not under our control (resetting or maybe creating new/unlimited sandboxes for each test run). I didn't find any way in GA (or really any hosted solution) to handle testing well. But maybe that's not a big concern among 'enterprise' analytics users?
jbrooksuk 3y ago
Yes, you should absolutely not be using Google Analytics. They don't need more data, your users don't want to see cookie banners and most of you really don't need 99% of the data that you can filter through... I can't recommend Fathom (https://usefathom.com https://usefathom.com) enough. They have a huge focus on privacy-first tracking. You don't need to show a cookie banner and you can still track events etc. If you want $10 credit for signing up, use https://usefathom.com/james https://usefathom.com/james but otherwise, https://usefathom.com https://usefathom.com Seriously, Google Analytics sucks. Use anything other than that.
jhpacker 3y ago
Those looking for alternatives can take a look at my book which evaluates 15 different options: https://gaalternatives.guide https://gaalternatives.guide I also have a google sheet listing the basics of each of those tools: https://gaalternatives.guide/sheet https://gaalternatives.guide/sheet
tgtweak 3y ago
Luckily for them, google has basically forced everyone to stop using analytics as of July this year (I don't consider ga4 to be a replacement).
- simonsarris 3y ago
  It is deeply bizarre how much worse GA4 is as a product. I don't understand it.
  - cm2012 3y ago
    It's much worse to comply with onerous EU regulations. They make it painstakingly useless.
    - dolmen 3y ago
      And, as a EU citizen, that's a good thing.
stavros 3y ago
I'd like to note here that NOYB seems to be doing great work, and is one of the very few institutions I donate to. I think they're worth a donation: https://noyb.eu/en/donations-other-support-options https://noyb.eu/en/donations-other-support-options
dbg31415 3y ago
It used to be that Google needed GA to see how users used a site. But I think they just track at the Chrome-level now. So using GA is really just a way for you to see what Google sees about your site. Blocking GA use... I don't think it really hurts Google any more. I think they get all they need -- more than they ever got through GA -- through trackers in Chrome.
al_be_back 3y ago
google or other providers could mitigate this by Allowing the Analytics subscriber to configure which fields to "exclude" or "include" when logging requests. Regulators are only going to get tougher with service providers, it's wise to prepare.
cm2012 3y ago
Just another thing that's going to leave the EU in the stone age, falling further and further behind the USA economically. 15 years ago, US and EU GDP per capita were about the same. Now the USA is 50% higher. Even West Virginia is richer per person than France.
- suction 3y ago
  [dead]
- no_time 3y ago
  If that "stone age" means I'm less likely tracked and logged by a US megacorp to whom I never inteded to share information like what buying and what my medical problems are, GOOD. I hope all Alphabet IP ranges get blackholed on the ISP level if they continue to perpetuate this hellscape we call targeted advertising.
  - cm2012 3y ago
    Kneecapping tech for amorphous "privacy" concerns is very much a valid choice. I'd bet on the countries that don't make that trade off.
    - no_time 3y ago
      If the subject of your bet is "Whichever system can extract the most amount of wealth in the most efficent manner from it's people at the cost of their wellbeing" then you are correct.
tony_fr 3y ago
Well, it was only a mouse and cat game here.(with local exemption for France for example that provide an exit pass but render the tools without much interest after) The focus on Google Analytics is really funny because plenty other company use similar tech to track users (pardot pixel, hubspot etc...) And both parent company are us bases so similar 'transfer to us' is being made with much more PII than google analytics. (Noyb is probably coming to you as well as Facebook).
olliej 3y ago
Ok, what is it that google/Facebook analytics is providing people that has them so obsessed with harming their users privacy and slowing their page loads? I really don't get it: you don't need to sell out your users to google, Facebook, etc to get page view counts, time page loads, get browser statistics, etc. What is it that site developers actually think they're getting out of abusing their users?
blueferret 3y ago
Seems like we have a lot of good GA alternatives on here already. Thought I'd add one: goatcounter.com Not mine, and I only just started using it. But it's easy to implement, and shows "just enough" analytics data for me. Nice simple option.
system2 3y ago
Currently using self hosted Motamo Analytics. Very easy to use and intuitive.
face789 3y ago
[dead]
face789 3y ago
[dead]
right32 3y ago
[dead]
binnaclegrade 3y ago
[dead]
onlypositive 3y ago
I think companies should stop using fixed navigation banners but we can't all get what we want now can we? Like holy crap, I agree with you but your website is unreadable with that may as well be a banner ad of a navigation bar that keeps popping in and out of existence every time I scroll down.
shantnutiwari 3y ago
Could Google outsmart them by hosting some of the data in EU, but still keeping spying on customers?
straymedal 3y ago
[dead]
straymedal 3y ago
[dead]
calvin982 3y ago
[dead]
calvin982 3y ago
[dead]
slack92 3y ago
[dead]
slack92 3y ago
[dead]
harry829 3y ago
[dead]
harry829 3y ago
[dead]
potter092 3y ago
[dead]
potter092 3y ago
[dead]
bulk91 3y ago
[dead]
bulk91 3y ago
[dead]
soninlaw01 3y ago
[dead]
soninlaw01 3y ago
[dead]
kitty234 3y ago
[dead]
kitty234 3y ago
[dead]
tyson32 3y ago
[dead]
tyson32 3y ago
[dead]
cat982 3y ago
[dead]
cat982 3y ago
[dead]
cripto34 3y ago
[dead]
cripto34 3y ago
[dead]
henry02 3y ago
[dead]
henry02 3y ago
[dead]
chok823 3y ago
[dead]
chok823 3y ago
[dead]
dear923 3y ago
[dead]
dear923 3y ago
[dead]
tom323 3y ago
[dead]
tom323 3y ago
[dead]
jerry2398 3y ago
[dead]
jerry2398 3y ago
[dead]
happy23 3y ago
[dead]
happy23 3y ago
[dead]
right32 3y ago
[dead]
sad9034 3y ago
[dead]
sad9034 3y ago
[dead]
help9873 3y ago
[dead]
help9873 3y ago
[dead]
share342 3y ago
[dead]
share342 3y ago
[dead]
manyyears23 3y ago
[dead]
manyyears23 3y ago
[dead]
old322 3y ago
[dead]
old322 3y ago
[dead]
today9872 3y ago
[dead]
today9872 3y ago
[dead]
day92 3y ago
[dead]
day92 3y ago
[dead]
valentina902 3y ago
[dead]
valentina902 3y ago
[dead]
cosmonaut034 3y ago
[dead]
cosmonaut034 3y ago
[dead]
bye892 3y ago
[dead]
bye892 3y ago
[dead]
pink8091 3y ago
[dead]
pink8091 3y ago
[dead]
red92 3y ago
[dead]
red92 3y ago
[dead]
black92 3y ago
[dead]
black92 3y ago
[dead]
white91 3y ago
[dead]
white91 3y ago
[dead]
green23 3y ago
[dead]
green23 3y ago
[dead]
people243 3y ago
[dead]
people243 3y ago
[dead]
dad82 3y ago
[dead]
dad82 3y ago
[dead]
mom82 3y ago
[dead]
mom82 3y ago
[dead]
momy02 3y ago
[dead]
momy02 3y ago
[dead]
crazy823 3y ago
[dead]
crazy823 3y ago
[dead]
place821 3y ago
[dead]
place821 3y ago
[dead]
henry903 3y ago
[dead]
henry903 3y ago
[dead]
day821 3y ago
[dead]
brother82 3y ago
[dead]
brother82 3y ago
[dead]
thomas7812 3y ago
[dead]
thomas7812 3y ago
[dead]
father93 3y ago
[dead]
father93 3y ago
[dead]
day821 3y ago
[dead]
classmate82 3y ago
[dead]
classmate82 3y ago
[dead]
throughchanging 3y ago
[dead]
dark232 3y ago
[dead]
dark232 3y ago
[dead]
alex82 3y ago
[dead]
alex82 3y ago
[dead]
friend22 3y ago
[dead]
friend22 3y ago
[dead]
night32 3y ago
[dead]
night32 3y ago
[dead]
funny921 3y ago
[dead]
funny921 3y ago
[dead]
throughchanging 3y ago
[dead]
binnaclegrade 3y ago
[dead]
creepydancer 3y ago
[dead]
creepydancer 3y ago
[dead]
failbank 3y ago
[dead]
failbank 3y ago
[dead]
singhas 3y ago
[dead]
singhas 3y ago
[dead]
sproutscentral 3y ago
[dead]
sproutscentral 3y ago
[dead]
tritebiohazard 3y ago
[dead]
tritebiohazard 3y ago
[dead]
elevator1 3y ago
[dead]
elevator1 3y ago
[dead]
tablewomanly 3y ago
[dead]
adultfungus 3y ago
[dead]
adultfungus 3y ago
[dead]
doppingwindlass 3y ago
[dead]
doppingwindlass 3y ago
[dead]
tablewomanly 3y ago
[dead]
mouthguard 3y ago
[dead]
mouthguard 3y ago
[dead]
accurate12 3y ago
[dead]
accurate12 3y ago
[dead]
hootzebra 3y ago
[dead]
hootzebra 3y ago
[dead]
worried46 3y ago
[dead]
worried46 3y ago
[dead]
partyflotilla 3y ago
[dead]
partyflotilla 3y ago
[dead]
socketestimate 3y ago
[dead]
socketestimate 3y ago
[dead]
ebaycheck 3y ago
[dead]
ebaycheck 3y ago
[dead]
priestlifestyle 3y ago
[dead]
priestlifestyle 3y ago
[dead]
toyotaraccoon 3y ago
[dead]
toyotaraccoon 3y ago
[dead]
deardvd 3y ago
[dead]
deardvd 3y ago
[dead]
perceivestark 3y ago
[dead]
perceivestark 3y ago
[dead]
sprite343 3y ago
[dead]
sprite343 3y ago
[dead]
drillcringle 3y ago
[dead]
drillcringle 3y ago
[dead]
reallynatural 3y ago
[dead]
reallynatural 3y ago
[dead]
hugtinkle 3y ago
[dead]
hugtinkle 3y ago
[dead]
oilsweet 3y ago
[dead]
oilsweet 3y ago
[dead]
occipital46 3y ago
[dead]
occipital46 3y ago
[dead]
welloffaffair 3y ago
[dead]
welloffaffair 3y ago
[dead]
simplicity34 3y ago
[dead]
simplicity34 3y ago
[dead]
likeable53 3y ago
[dead]
likeable53 3y ago
[dead]
noneadventure 3y ago
[dead]
noneadventure 3y ago
[dead]
nagplatform 3y ago
[dead]
nagplatform 3y ago
[dead]
scarfhockey 3y ago
[dead]
scarfhockey 3y ago
[dead]
exactlyponie 3y ago
[dead]
exactlyponie 3y ago
[dead]
original453 3y ago
[dead]
original453 3y ago
[dead]
quirkyfalse 3y ago
[dead]
quirkyfalse 3y ago
[dead]
second435 3y ago
[dead]
second435 3y ago
[dead]
salesunbonnet 3y ago
[dead]
salesunbonnet 3y ago
[dead]
tearful34 3y ago
[dead]
tearful34 3y ago
[dead]
thrusheentry 3y ago
[dead]
thrusheentry 3y ago
[dead]
fiery675 3y ago
[dead]
fiery675 3y ago
[dead]
staleleotard 3y ago
[dead]
staleleotard 3y ago
[dead]
wrenfreeboard 3y ago
[dead]
wrenfreeboard 3y ago
[dead]
motorcycle3 3y ago
[dead]
motorcycle3 3y ago
[dead]
momentous13 3y ago
[dead]
momentous13 3y ago
[dead]
caughtenemy 3y ago
[dead]
caughtenemy 3y ago
[dead]
podmazipan 3y ago
[dead]
skatingcrackle 3y ago
[dead]
skatingcrackle 3y ago
[dead]
podmazipan 3y ago
[dead]

646 points by pseudotrash 3y ago

This has also happened in Denmark.

I wonder if this also will apply to Google's ad related spyware? Going after just Analytics seems like quite a small step.

Puts 3y ago
This authority does not go after anybody. They got a complaint by NOYB regarding these specific companies and therefore was forced to investigate specifically them.

Pannoniae 3y ago

Analytics right now is basically "you won't get any useful information for your website because we value users' privacy, don't worry we see all of the data anyway" Remember, you aren't the customer if you embed Google Analytics, Google is. edit: if you want analytics, honestly just roll your own... you can't trust advertising companies with your users' data

Cthulhu_ 3y ago
"Roll your own" is hubris, unless you have the time, energy, inclination, theoretical knowledge, etc; I wouldn't try and solve solved problems if you can help it. But, host your own is definitely recommended IMO; a lot of the GDPR issues are resolved if you just host your own, because no data is shared to a 3rd party. Then you only need to worry about getting some approval and data retention. I'm sure data retention is a non-issue if you process raw analytics data (that can be traced back to a user) into generalized statistics, too.
- gsatic 3y ago
  > unless you have the time, energy, inclination, theoretical knowledge Why does anyone need all that?
  - vntok 3y ago
    Because setting up useful analytics for almost any definition of "useful" is not a trivial "I could do this in a WE" project.
    - Pannoniae 3y ago
      The better question is.... what analytics do you actually need? I don't think cross-page tracking of the user is something most websites need... Useful information is more like, what users clicked, what platform did they use, how much time they spent on the website and things like that. Those aren't that hard to just track yourself.
      - quickthrower2 3y ago
        I reckon server render based analytics (as opposed to cookies and pixels etc. on 3rd party domains) will be better because it wont be blocked by ad blockers. If the page got rendered and sent, well I know about it unless you blocked the site entirely.
- Pannoniae 3y ago
  I'm much more productive since I realised I don't have to use "standard" tools. It saves me so much time. With that being said, I don't make everything myself, but just the thought that I'm not obliged to use the best-practice standard solution to the problem is liberating to me and it makes me so much more productive in actually doing stuff.
  - victorNicollet 3y ago
    Besides, even if you use the standard tool today, five years from now this will be "the tool that was standard five years ago" unless you actively migrate every so often. There are a few domains where the standard tools remain the same for a long while (Google Analytics being one), but often the standard tooling shifts more frequently than that.
ehnto 3y ago
Matomo is a good self hosted analytics option.
- ra 3y ago
  As is snowplow https://github.com/snowplow/snowplow-javascript-tracker https://github.com/snowplow/snowplow-javascript-tracker
  - laichzeit0 3y ago
    Deploying the Snowplow backend is non-trivial (to put it mildly) and extremely expensive if you don't want to host it yourself.
    - shermozle 3y ago
      €0.02/day and easy enough for anyone with basic cloud skills: https://www.dumky.net/posts/own-your-web-analytics-pipeline-for-0.02-per-day-snowplow-terraform-dbt-bigquery-and-docker/ https://www.dumky.net/posts/own-your-web-analytics-pipeline-... (With caveats: This is a toy pipeline. More work required to make it robust and probably not a great option for any site with reasonable traffic. But easy to get started and play.)
- sschueller 3y ago
  I am a bit concerned about how Matomo deals with security. All their PHP code is located in the public folder and they use nginx[1] rules to block access to scripts that are dangerous. [1] https://github.com/matomo-org/matomo-nginx/blob/master/sites-available/matomo.conf#L36 https://github.com/matomo-org/matomo-nginx/blob/master/sites...
- jacooper 3y ago
  Plausible is a better alternative.
- nerdbert 3y ago
  We found it to be nothing but trouble. Disappearing data, database servers bogging down under what should be trivial load because of inefficient SQL design, painful upgrade process, etc.
EGreg 3y ago
This is true not just for analytics but pretty much all features. Imagine you are a great speaker and instructor and have an audience. Right now you GIFT it to YouTube, Twitter, etc. and they monetize it for you, give you a tiny percentage, and even constantly direct your audience to competitors and other distractions. In fact YouTube even sells an option to advertise your videos on your competitor’s videos! I say — opt out. Run your own everything! Your own community software (instead of Discord). Your own videoconferencing, livestreaming, chats, presentations, gated content, accept payments with crypto in addition to PaymentRequest. It’s hard to build an open-source alternative that is good enough (no, Mastodon and Bluesky aren’t — yet). Which is why (shameless plug warning) I spent 12 years and $1 million dollars with my team to build it. https://github.com/Qbix/Platform https://github.com/Qbix/Platform Use it — as 1 of hundreds of features, you can have your own analytics on your own database on your own community site. The other features are here: https://qbix.com/features.pdf https://qbix.com/features.pdf PS: Don’t get me wrong. Keep using YouTube to host your content, etc. But relegate it to hosting short form teasers and highlights and testimonials all of which link to your site. People can discover you on the big sites but if they are serious about your long-form content and community they should buy a membership on YOUR site and have a direct relationship — then deplatforming or coersion will be the last of your worries.
- kristiandupont 3y ago
  All the videos on qbix.com itself seem to be hosted on youtube? Also, the features pdf lists "nodejs" and "php" as features.. I don't mean to be snarky here, but I am simply not sure what this product is?
  - EGreg 3y ago
    Watch the videos for a start
    - nottorp 3y ago
      Who has time to watch videos without a high level overview? :)
bennyp101 3y ago
That's essentially what I did, don't need to know the browser or device or where they are from (the product is UK only, so it's largely irrelevant) - so as I control the server side, just log page visits and certain CTA's, and can see a rough journey of where people have been and if they placed an order or not. That's far more useful than hoping that people have JS enabled or tracking stuff blocked. (I.e. Can see that they visited an order page, then back to FAQ's, then clicked on a "whats is x" link - so should probably update the content on the order page to explain what X is) Obviously it depends on what data you actually need, but that gets me most of the way there without gathering a load of data that isn't needed
jhpacker 3y ago
Most alternatives are not made by advertising companies, but they also frequently aren't free... Rolling your own from the ground up is not necessary or typically advisable when there are so many good options, including many self-hosted and open source options if you're wanting that level of control. I usually describe the cost of GA as "subsidized by your customers' data".

appleflaxen 3y ago

I am so grateful for the progressive policies in Europe that help the entire globe.

oneeyedpigeon 3y ago
Me, too! Although I suspect you're an American and are being sarcastic...
- nologic01 3y ago
  There are millions of people in this industry that feel moral choices should not stand in the way of lining their pockets... Ridiculing the laws of countries and people that happen to have some traces of a moral compass shows that basically people have every reason to be suspicious.
- appleflaxen 3y ago
  I am completely sincere.
pelasaco 3y ago
Missing a /s ?
- appleflaxen 3y ago
  No. I wish the US had stronger antitrust enforcement .
moduspol 3y ago
Yes. Every time I see a cookie consent dialog, I do a quick "thumbs up" to our pals in Europe.
- gkbrk 3y ago
  And you don't consider that the website puts up a consent dialog because they want to (ab)use your personal data? No need to put a consent dialog if you are not stalking people.

AbhiAmbad 3y ago

why? then what are the alternatives of google analytics. Google is big guient that are collecting all world data. alternative platforms are doing the same. We are not secure anywhere i think. Privacy is already brocken, no options.

Nextgrid 3y ago
> then what are the alternatives Don't stalk people is the alternative.
- AbhiAmbad 3y ago
  I am not stalking anything. I am asking not suggesting anything. Just read the comment first and react on that. No manners
perlgeek 3y ago
> Privacy is already brocken, no options. And thus you question every attempt to fix it?
- AbhiAmbad 3y ago
  Yes, We need anaytics for our website. even for ranking on search engine. There is no other option. GA, GTM, GSC are the top tools we have to use. If you are a business website owner
  - input_sh 3y ago
    Spin up your own analytics from logs and voila!
  - cuu508 3y ago
    There are plenty of business websites that rank on search engines and don't use GA.
poniko 3y ago
Because of the law in US that the governments have right to all data stored on any server that a US company or its subsidiaritets own. That clash with the EU GDPR law and the fact that Sweden categorize IP-adress as a Privacy data point. I.e they can switch to a European vendor that do tracking and analytics.

nubinetwork 3y ago

https://news.ycombinator.com/item?id=36575305 https://news.ycombinator.com/item?id=36575305 among others

esalman 3y ago

Unrelated: I used ChatGPT to generate remark.js presentation HTML code from some content. It did generate the code, but it inserted a GA snippet along with a random GA account code at the bottom of the code. I did not even catch it immediately (laziness, totally my fault), but noticed it a couple of days later when I was modifying the presentation.

weird-eye-issue 3y ago
[flagged]
- Pannoniae 3y ago
  If the world operated on a "who cares" basis, nothing interesting would ever happen.
janus24 3y ago
> totally my fault IMHO, it's not totally your fault; private information shouldn't be shared with others. It's your responsibility to verify what ChatGPT is writing before you use it; it's OpenAI's responsibility to not share private information.
- oefrha 3y ago
  Google Analytics tracking ID is public information.
- thumbuddy 3y ago
  Just like how google wasn't going to train ML models on your private possibly confidential information...
- thissitesucks0 3y ago
  [flagged]
- weird-eye-issue 3y ago
  Here you are making assumptions this was somebody's valid GA ID and not dummy data...

alkonaut 3y ago

Good. I hope the same authority does a round of fines for companies using noncompliant tracking opt out UX too. A nice chunk of total revenue as a fine without prior warning for anyone showing the "Accept all/Show purposes" question would be delicious.

cuu508 3y ago
To get the process started for a specific company, submit a complaint to the supervisory authority of the country the company is based in. Contacts: https://edpb.europa.eu/about-edpb/about-edpb/members_en https://edpb.europa.eu/about-edpb/about-edpb/members_en As an example, the article mentions these specific audits were triggered by complaints by NOYB.

deofoo 3y ago

For those who look for an alternative https://plausible.io https://plausible.io is a great replacement.

Hamuko 3y ago
Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.
- rhn_mk1 3y ago
  GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.
  - Hamuko 3y ago
    The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.
- konha 3y ago
  > Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.
- jgrahamc 3y ago
  See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/
  - jacooper 3y ago
    I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.

perlgeek 3y ago

I had expected such orders after GDPR went into effect. I guess I was young and naive back then...

yxhuvud 3y ago
Government is a lot of things, but seldom fast.

weird-eye-issue 3y ago

I only use GA because our ad provider, Mediavine, requires it

Cthulhu_ 3y ago
That's cool and all, but in the end, you are the end-responsible for it; you can't hide behind your ad provider if the GDPR police comes after you.
- weird-eye-issue 3y ago
  I don't care about GDPR
  - jkaplowitz 3y ago
    This entire thread is discussing a data protection authority’s decision which was based on the GDPR. It wasn’t a blog post arguing against GA due to concerns about Google or similar. If GDPR is irrelevant to whatever you’re trying to say, I think you’re in the wrong thread.
    - weird-eye-issue 3y ago
      I wasn't "trying to say" anything beyond why a lot of websites are forced into sticking with GA. In the content business industry you have to have GA to work with ad providers or if you want to ever sell your site it is a very important part of the due diligence You can argue with that all you want but its just the reality of the industry And am I saying it is an excuse or anything? No, I'm just stating how things are Sad I have to put so many disclaimers in such a simple comment but people like to read into things that aren't there or jump to conclusions.

mediascreen 3y ago

The heading seems very strong considering this is a governmental agency and since they audited a "version of Google Analytics from 14th of August 2020" and presumably not GA4 that works differently.

mediascreen 3y ago
Rereading it now seems like "companies" in the heading only refers to the three fined companies and that the decision may be applicable to other companies.

suddenclarity 3y ago

This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 this year. There are arguments that GA4 would fail the same requirements. Denmark hold that view but it hasn't been tried. Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. I find this argument objectively absurd considering how internet works but it possible that's how the law works. We wouldn't know before it has been tried though and I'd be sceptical about anyone claiming to know the result.

yunohn 3y ago
> Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU servers. Agreed, this is absolutely ridiculous. And I say this as an EU resident! I’d rather NOT have websites start checking residency/citizenship to decide my data ownership.
- eek2121 3y ago
  They already do.
  - yunohn 3y ago
    I’ve literally never had to provide such proof, and I would say I use the internet quite a bit. Any example websites?
supriyo-biswas 3y ago
The result is the balkanization of the internet, although most folks in the EU want that for nationalistic reasons and to prop up their own industries, under a thin veneer of opposing US imperialism (but being unable to do anything with respect to the things which actually threaten the EU, such as an over dependence on Russia.)
- foepys 3y ago

j-a-a-p 3y ago

> According to the data protection regulation, GDPR, personal data may be transferred to third countries, i.e. countries outside the EU/EEA, if the European Commission has decided that the country in question has an adequate level of protection for personal data that corresponds to that within the EU/EEA. However, the CJEU ruled through the Schrems II ruling that the United States could not be considered to have such an adequate level of protection at the time of the ruling. - European Court of Justice (CJEU) I always thought that by asking for permission in the privacy statement, and in the cookie banner analytics cookies are also explicit usually, it would be OK. But indeed, even if you refuse the analytics cookies (I do that automatically, who doesn't?), that still does not stop the website from transferring PII to google analytics. I am assuming that here, not a user of analytics, but i suppose it will still work without cookies, maybe just a little less accurate.

magriz 3y ago
Thing is, the IP address is also considered personal information (since it can be combined with other data to identify a person), and it is getting transferred with every request. The CJEU ruling about the US is mainly due to the fact that US service providers have to hand over all data if US government agencies request it.
- j-a-a-p 3y ago
  Yes - it is more or less the same. In the EU they have to provide the data to the local authorities as well. Using any analytics, hosted in US, in the EU or hosting it myself, will involve moving and storing PII. To be clear, I agree we should keep PII in EU. But I doubt that an EU solution will improve anything for the end user.

Gordonjcp 3y ago

I put Google Analytics on my forum because I thought that maybe having it would help it be found in Google Search. Google Lighthouse immediately started pissing and bitching about slow page load times because it had to wait for Google Analytics to load. My site still does not really show up much in Google Search. I binned Google Analytics because it basically did fuck all of any use. I don't have one of those fucking idiotic cookie popups, because it doesn't need one, no-one needs one, and they're entirely meaningless noise.

dijit 3y ago

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se https://medieinstitutet.se) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6-12mo on new analytics systems (or, god forbid, not be an analyst at all!). I think we don't really assess the amount of lock-in we allow when we learn something that supposedly makes our lives simpler. Google Analytics was sold as a solution to you making your own analytics, because that's hard! and the cost is that google gets your information too- which most webmasters don't care about individually. However now we're in a situation where at least a few thousand people depend on this precise tool existing, and will be economically useless if it is banned. Personally I find this astonishingly foolish of the people who train exclusively on these tools instead of first principles and primitives. That said; we also have "Cloud Engineer" as a job title, so I'm not sure we will learn this lesson.

znpy 3y ago
what you wrote is mostly true but also partially incorrect: many competencies are transferrable. there are privacy-compliant products in that sense, unless you've been literally told "click here and click there" you should be able to employ old concepts with new tools.
- vladvasiliu 3y ago
  Given GP's paragraph: > Personally I find this astonishingly foolish of the people who train exclusively on these tools instead of first principles and primitives. I wouldn't be surprised for this to be a "click here and click here" kind of training. I've seen a painful amount of those. And then, when the inevitable "new and improved ui" comes along, these people are lost and require a new training.
  - bdcravens 3y ago
    These are essentially "IT Factory Workers". To be honest, I think there's value in that, with the same economics of "traditional" factory workers.

acatton 3y ago

Who needs analytics? I'm confused. When I worked at companies using google analytics, 99.9% of the time they could have gotten this data from server logs with something like awstats or goaccess. To this day, I still don't get what's the point of embedding some javascript to do extra-requests or a tracking pixel, when the data was already given once.

switch007 3y ago
Marketing teams with large budgets. Not that they actually get questioned properly about actual stats, but they can confidently say they have GA set up and it’s showing some numbers, so just trust us. Google is “trusted”. Why would the person setting their budget put faith in some hand rolled/open source solution ?! /s
darkr 3y ago
It's a problem introduced at least in part by SPAs. When the application runs entirely in the client browser, save for a few API calls (that may be shared between multiple pages) it's difficult to tell which pages are actually being viewed, unless you have the client application report back to you (or to Google)
- capableweb 3y ago
  Easily addressable by including a header like x-from-page where you declare which "SPA route" the backend requests were made from.
jkukul 3y ago
With server side tracking you're not able to identify and properly track non-logged in users. GA (and other client-side tools) take care of this, via cookies. Additionally, a common argument is that the server side logs contain a lot of logs from bots/crawlers and GA (and alike) can filter them. The other side of the coin is that GA (and alike) are not able to track users with Adblockers. EDIT: not sure why I'm downvoted - the OP asked for some reasons why people use client side tracking and I listed them. I didn't say that I support these practices, but maybe I should have made that explicit to comply with the overall sentiment of this site.

hamasho 3y ago

I've finally come to the conclusion that user tracking is generally a poor practices and should be regulated. As a web developer, I didn't see it as a big problem. We always do it to maximize ad revenue, find out where users leave to increase conversion rate, and simply to improve UX. But even when the intent is to improve UX, tracking is inappripriate. Imagine if a robot vacuum recorded videos of your home and uploaded them so that bunch of ML engineers can see and use it to improve the algorithm. Or the videos of your car's camera (both of inside and outside). I mean, I'm not surprised if this is already happening, but it's a disturbing thought and should be regulated. We can certainly develop functional services without tracking users.

oneeyedpigeon 3y ago
Advertising is the big gotcha here. What I think we need is for more and more companies to own their advertising rather than farming it out to third parties. We'd get better advertising AND it would be less intrusive.
- robertlagrant 3y ago
  It just scales better to have web intern paste in a GA code snippet into their website and that's that - you get revenue and web analytics all in one. If you have to set up your own server (or at least your own subdomain that points to a GA server IP) then it's more likely to go wrong. I'm sure it'll happen, though.
thumbuddy 3y ago
It's almost certainly happening.
sethammons 3y ago
> Imagine if a robot vacuum recorded videos of your home and uploaded them so that bunch of ML engineers can see and use it to improve the algorithm. https://www.technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/ https://www.technologyreview.com/2022/12/19/1065306/roomba-i... Yup, happing. Recent news on a lady whose vacuum took a pic of her on the toilet being leaked.

pSYoniK 3y ago

What I am curios about is how much people actually use ALL the analytics information provided by a lot of these tools. I know Matomo and other such open source/self-hostable solutions, but how much info do you really use? I think for most use cases users would want to know if their content is consumed/read. Maybe how long someone spends on it and where they came from. For this sort of stuff you can write a small script to parse your logs. I did something along these lines to parse Caddy logs to get some idea of how many people visit a link. That's really all I needed and the great part is that I run it whenever I want an update, so it's not consuming resources constantly. The logs are cleared and the output is saved before logs are cleared so I know Article 1 had 39 views (or less!) and Article 2 had 5 views and so on... So I think we're overdoing it and we would benefit from taking a few minutes before going down the rabbit hole of analyzing EVERYTHING.

oneeyedpigeon 3y ago
> For this sort of stuff you can write a small script to parse your logs. IFF you have access to your logs.
- sethammons 3y ago
  Why would you not have access to your logs? Not having access to logs doesn't even make sense to me. We honor hippa and gdpr and we can access logs. Beyond that, I am a proponent of structured logging and log aggregators that can help you see trends and analyze the logs, like Splunk or, to a lessor extent, DataDog.
- pSYoniK 3y ago
  So you can setup GA but you can't check your web server logs?
  - oneeyedpigeon 3y ago
    That covers everything hosted on GitHub Pages, as one example.
Pannoniae 3y ago

Garvi 3y ago

Every time a client makes me implement google analytics or facebook pixel code I die a little inside. And even though some actually use google ads, they have zero benefit from using analytics. I know, because I'm the one adjusting their campaigns. It's just another thing everyone does and one would be stupid not to, right, right? The lemming mentality always makes me sad because so many bad things in our society are a result of it. And every time someone says that rolling your own is a waste of time,.. I roll everything my own, including CMS / SPA frameworks, because it's a giant waste of time to do otherwise in the long run. The only time I waste regarding rolling on my own is when tobacco is involved.

dieulot 3y ago
Could you link to a site where you’ve rolled your own SPA? Or ideally the source code. I’d like to take a look as not many people do that, even less do so with enough attention to detail not to cause UX regressions (not that third-party solutions are brilliant either).
- Garvi 3y ago
  I'm an enjoyer of anonymity online and would rather not doxx myself. However if you have a specific question, I'd be happy to answer. I use js/jq for the front-end and php for the backend. Once you have your own CMS, turning it into a SPA means turning your index.php into a index.html that is php free and relies on ajax calls to change the content. So at minimum you need a mainbody.php and a head.php that accept inputs. After that it's just onclick actions on buttons that trigger the ajax function changeMainbody(targetPage). Or changeHead() after a user loggs in. On the phone app side you use the regular WebView, to avoid any cross-origin blocks and problems. Alternatively you can run it locally and pass the cookies as inputs - depending on the app needs. Should be safe using https, right? I fully expect to be scolded by someone with 20years more experience, but I guess that's how you learn. Of course there's more to it, depending on the app needs. In my case it also auto refreshes the contents on a js timer. What UX regressions did you have in mind as troubling? Things like resetting one's password if forgotten? Well all those things need to be turned into their own ajax calls and php scripts as well and sometimes reworked to fit mobile users needs. For resetting passwords specifically I just copied what Twitch.com does.

TekMol 3y ago

One could still use Google Analytics by proxying the tracking events. Afaik only the IP is considered private data. So one could mask or (non-reversibly) hash the IP, remove anything else which might be considered private data and then send the event to Google. A simple PHP script with a few lines of code could do that. But Google lost me by: A) Making it impossible to convert your old data into the new Analytics version B) Abandoning the API which allowed you to code your own reports. Over the years, I wrote a ton of code that talks to the API. This is all worthless now. I recently switched to self-hosted Matomo. At first I did not think much about it, but now after I got used to it, I have to say it is much better than GA. The interface is so much nicer and snappier. And more logical. Apart from that, I like that it is open source. If there ever is a point in the road where the makers of Matomo decide on a non-compatible fork, I'm sure the community will write a converter that converts the old data into the new format. And after using it for a while, it hit me: You can write your own reporting tools by just querying the MariaDB database! Using SQL is so much better than it was to fight the insanely complex and unintuitive Google Analytics API. If I really wanted to still use Google Analytics, I would just write a converter, which pumps all the Matomo events into Google Analytics. That would be a GDPR-compliant way to use Google's tools. But I don't. I'm done with Google Analytics forever. Matomo is the promised land for me.

bunnyfoofoo 3y ago
You can’t hash an ipv4 address. It’s trivial to brute force all possibilities given the limited problem space.
- leononame 3y ago
  But you could use a salt, right?
  - Qwertious 3y ago
    A salt will render rainbow tables useless, but AIUI will not prevent brute-forcing after the fact. IPv4 has ~4 billion addresses, which would be too expensive for data analytics but could be brute-forced if someone really wants this one piece of data in particular.

beefield 3y ago

So, a dumb question. What's the easiest way to run privacy friendly analytics on static github pages? "Privacy friendly" as in unambiguously no need for cookie/gdpr permission popups. "Analytics" can be as simple as page loads per day count. Anything beyond that is a bonus.

marvinblum 3y ago
I guess you can use any JS snippet integration available. There are plenty of alternatives: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv... I'm the co-founder of Pirsch (pirsch.io), so if you have any questions regarding analytics (any, not just ours), let me know. For our solution I can assure you that it's GDPR compliant and doesn't require a cookie consent banner.
- beefield 3y ago
  Are those typically blocked by adblockers?
  - marvinblum 3y ago
    Yes, all of them. For a non-blockable approach you can use a proxy on your own domain or by using a server-side integration. https://docs.pirsch.io/get-started/proxy https://docs.pirsch.io/get-started/proxy
alxmng 3y ago
Put it behind CloudFlare free plan. You’ll get total uniques for the domain. No hosting or JS required.

bborud 3y ago

What analytics solutions are there that you can host yourself?

jkukul 3y ago
I tried the self-hosted version of Matomo [1][2] a few years back but I remember it was a bit underwhelming for the effort required to set it up. [1] https://matomo.org https://matomo.org [2] https://github.com/matomo-org https://github.com/matomo-org

amelius 3y ago

I'm afraid this is not going to help much. Instead, we should have a law against a panopticon. I wonder how fast we'd have such a law if Google were a Chinese company ... Perhaps the way to get rid of Google Analytics is thus to start a Chinese company and make everybody use their analytics tool.

dathinab 3y ago

Nothing surprising, this was kinda clear already not too long after the regulation was passed and since then quite a lot of curt decisions which bordered that topic have painted a very clear picture of "it's not really compatible with the law/regulation but you might get away with it anyway". Also given some scamy things google was found to be doing in their ad business and personal experiences people I know had when running different statistics and ad providers along side of google and noticing gross divergence I _personally_ really wouldn't trust google analytics or ads at all if I where a business.

draw_down 3y ago

[dead]

selfhoster69 3y ago

As long as it is via domains I am able to block, it is fine.

phartenfeller 3y ago

I am using a self-hosted Plausible [1] instance, which is GDPR-compliant out of the box with no cookies required. I am super happy with it. The only downside is that you need to run Postgres and Clickhouse which is overkill for my small sites (an option that only uses SQLite would be great). I don't want to track my users. I just want to see which pages get traffic. Sometimes I am also curious about where visitors come from (by country) and what devices they are using. In a newer update, they allow region tracking based on cities. I think this is too much information. I did not enable this and hope they won't add other more intrusive features. [1] https://plausible.io/ https://plausible.io/

berkes 3y ago
I'm using the hosted version of plausible. After I hit the FP of HN two times in a month, their billing warned me of overusage. One email, In which I explained the situation from me, and I got a very friendly email back, from a human, in which they allowed me to stay on my small plan despite the overuse.

openplatypus 3y ago

This yet another ruling after Austria, Finland, France, Denmark and Italy https://wideangle.co/blog/is-google-analytics-illegal-under-gdpr https://wideangle.co/blog/is-google-analytics-illegal-under-... The writing was on the wall for years now. Some DPAs like CNIL fire warning shots first, giving 4 months to comply. Then the fines keep rolling.

openplatypus 3y ago

If you need a powerhouse like Google Analytics and are not afraid of complex UI, go with Matomo. Even better if you self-host and have people to support it. If want something lighter that is just a turn key solution but lets you grow (collecting more data for users who gave you consent, or being super strict about privacy without consent) then go with Wide Angle Analytics (our product). The time when GA was the only option is long gone.

nologic01 3y ago

When I visit a company site and it uses google analytics I know they are either: lazy, ignorant or hostile towards their (potential) clients. This set of possibilities spans all cases and none is actually a positive signal. Companies (and any entity that has an online presence for that matter) are entitled to know what people are doing in their platform and use any appropriate tool for that purpose. They are not entitled to share that with anyone without the explicit warning and approval of their users. The Web as a digital predation ground where the amoral fleece the ignorami must stop. While (commercial) life is not exactly an ethical showcase, the digital version as it has come to evolve is particularly out of kilt with common norms.

mritchie712 3y ago
How many do you really think are hostile? Your average person at your average company will one day think, "how are people finding out about us?". They do a Google search for how to answer this question for their company and find Google Analytics. This is certainly not hostile. May be slightly ignorant, but can you blame them?
- nologic01 3y ago
  For sure i have come across websites where my eyes rolled ("common guys, i know you are better than this"). But the web has not been transformed from a web of users to a web of data mined "product" without very conscious moral choices by many commercial actors.
dolmen 3y ago
Government web sites also use Google Analytics. Which means we are tracked much beyond our shopping profile.
henham 3y ago
"They are not entitled to share that with anyone without the explicit warning and approval of their users." So using the by law (GDPR) required consent management (cookie banner) where the user has the chance to opt out of any tracking would make them not "lazy, ignorant or hostile" anymore? I think users should have tight control over their own data and what they share but being against all 3rd party ad or analytics vendors would be against digital user acquisition for 99% of websites out there.

phantomathkg 3y ago

Not saying it is morally correct to use Google Analytics. But I still find it amusing the Nordic countries see it is OK for everyone to know everyone's else salary while it is not OK for Google to know your IP. https://www.dailyscandinavian.com/income-tax-transparency-norway-sweden/ https://www.dailyscandinavian.com/income-tax-transparency-no...

dangus 3y ago
I wouldn’t call this amusing at all. That’s consistent with a commitment to protection of the common citizen. Salary transparency benefits the worker. If I know my colleague doing the same work makes more money than me, that gives me leverage to request and receive a raise. If I know the CEO of my company makes 1000x my salary, that gives the workers collective bargaining leverage. The only people who benefit from keeping their income private are the wealthy.

shadowgovt 3y ago

Interesting. I thought Google had built the tooling needed to keep European data in EU servers ages ago for compliance on this topic. Maybe I'm thinking of just Google Cloud?

larata_media 3y ago

While I appreciate the push for privacy and anti-tracking, ultimately the tools to prevent tracking are in the hands of users and organizations. The concept that countries have jurisdiction or even exist within the confines of the web is a laughably antiquated idea projecting itself into a realm where it doesn’t belong. Google and all of the usual suspects will continue to collect information about the public in all of the ways that they want, while the naive public believes in some false notion that their leaders are protecting them from the big bad wolf. If you don’t want to be tracked, the only person who can prevent that is you. Government agencies are the keystone cops or this is world. All they’re doing is a Chinese fire drill.

earthboundkid 3y ago

Good news then, Google has deliberately and bizarrely broken its API, so thousands or possibly millions of legacy sites will never correctly report their analytics again.

gmsiperx 3y ago

That's why we built Usermaven.com, a privacy-friendly website and product analytics tool. Our website analytics module is simple and gets the job done in one single easy-to-use dashboard. However, if you want to dig deep, you can use funnels, journeys and other features to get more insights out of our analytics. Usermaven collects all client-side events automatically so it makes it really easy for marketing teams to get insights without involding devs. We also offer simple ready-made reports for SaaS businesses to get product insights.

cuu508 3y ago
> For purposes of data protection laws, Userrmaven Inc., a company duly incorporated and organized under the laws of the United States of America, having its registered address at 2055 Limestone Road STE, 200-C, Wilmington, Delaware 19808, is the “data controller” > To integrate your website or SaaS app with Usermaven, you'll need to add a simple tracking script into the Header (<head></head>) section of your website. Make sure this snippet is present on every page that you want to track. (The tracking script's URL is https://t.usermaven.com/lib.js https://t.usermaven.com/lib.js) So similar issues as with Google Analytics – site visitor's data is being shared with an US company.
SahAssar 3y ago
Do you have any info page for how you implement stuff like funnels, journeys, etc. without storing any PII? Also this paragraph from your GDPR page had me scratching my head a bit: > Usermaven agrees to abide by the standard contractual clauses where data is transferred from the EU to the US. Is that written before Schrems II?

jacobyoder 3y ago

Had an engagement with a client a few years ago and GA came up. Folks on our side tried to avoid Google where possible, and I'd suggested some alternatives. Matomo, Fathom(IIRC) or others - multiple folks on the team had experience with these alternatives, but the client was insistent on GA. "This is the industry standard - look at all the billion dollar companies running GA - this is what we should use". I pointed out those comparison companies also had dozens of engineers per project; we had 3 part time people. The argument kept coming down to "GA is the standard; GA is what people know". Which is... true, if not somewhat circular. My other suggestion was try multiple; run GA and Matomo together, for example, for a bit. Or GA on just the public marketing site, and something else on the internal application. Nope, because they wanted to track every single ad spend all the way through to registered user usage of the internal business application. Knowing that the $70 you spent in Tacoma geo lead to 3 users registering then knowing that those 3 people routinely used a budgeting tool more than the $90 spent on 8 people who registered from Toronto... apparently those sorts of analytics might be needed in the future, so we have to have this. Instead of "let's just install both for a few weeks and try them", this became "let's 'investigate' multiple options and write reports about the pros and cons of each". Nuts. My larger concern was that, for testing/dev purposes, we'd not have as easy a time of 'resetting' an analytics DB that was not under our control (resetting or maybe creating new/unlimited sandboxes for each test run). I didn't find any way in GA (or really any hosted solution) to handle testing well. But maybe that's not a big concern among 'enterprise' analytics users?

jbrooksuk 3y ago

Yes, you should absolutely not be using Google Analytics. They don't need more data, your users don't want to see cookie banners and most of you really don't need 99% of the data that you can filter through... I can't recommend Fathom (https://usefathom.com https://usefathom.com) enough. They have a huge focus on privacy-first tracking. You don't need to show a cookie banner and you can still track events etc. If you want $10 credit for signing up, use https://usefathom.com/james https://usefathom.com/james but otherwise, https://usefathom.com https://usefathom.com Seriously, Google Analytics sucks. Use anything other than that.

jhpacker 3y ago

Those looking for alternatives can take a look at my book which evaluates 15 different options: https://gaalternatives.guide https://gaalternatives.guide I also have a google sheet listing the basics of each of those tools: https://gaalternatives.guide/sheet https://gaalternatives.guide/sheet

tgtweak 3y ago

Luckily for them, google has basically forced everyone to stop using analytics as of July this year (I don't consider ga4 to be a replacement).

simonsarris 3y ago
It is deeply bizarre how much worse GA4 is as a product. I don't understand it.
- cm2012 3y ago
  It's much worse to comply with onerous EU regulations. They make it painstakingly useless.
  - dolmen 3y ago
    And, as a EU citizen, that's a good thing.

stavros 3y ago

I'd like to note here that NOYB seems to be doing great work, and is one of the very few institutions I donate to. I think they're worth a donation: https://noyb.eu/en/donations-other-support-options https://noyb.eu/en/donations-other-support-options

dbg31415 3y ago

It used to be that Google needed GA to see how users used a site. But I think they just track at the Chrome-level now. So using GA is really just a way for you to see what Google sees about your site. Blocking GA use... I don't think it really hurts Google any more. I think they get all they need -- more than they ever got through GA -- through trackers in Chrome.

al_be_back 3y ago

google or other providers could mitigate this by Allowing the Analytics subscriber to configure which fields to "exclude" or "include" when logging requests. Regulators are only going to get tougher with service providers, it's wise to prepare.

cm2012 3y ago

Just another thing that's going to leave the EU in the stone age, falling further and further behind the USA economically. 15 years ago, US and EU GDP per capita were about the same. Now the USA is 50% higher. Even West Virginia is richer per person than France.

suction 3y ago
[dead]
no_time 3y ago
If that "stone age" means I'm less likely tracked and logged by a US megacorp to whom I never inteded to share information like what buying and what my medical problems are, GOOD. I hope all Alphabet IP ranges get blackholed on the ISP level if they continue to perpetuate this hellscape we call targeted advertising.
- cm2012 3y ago
  Kneecapping tech for amorphous "privacy" concerns is very much a valid choice. I'd bet on the countries that don't make that trade off.
  - no_time 3y ago
    If the subject of your bet is "Whichever system can extract the most amount of wealth in the most efficent manner from it's people at the cost of their wellbeing" then you are correct.

tony_fr 3y ago

Well, it was only a mouse and cat game here.(with local exemption for France for example that provide an exit pass but render the tools without much interest after) The focus on Google Analytics is really funny because plenty other company use similar tech to track users (pardot pixel, hubspot etc...) And both parent company are us bases so similar 'transfer to us' is being made with much more PII than google analytics. (Noyb is probably coming to you as well as Facebook).

olliej 3y ago

Ok, what is it that google/Facebook analytics is providing people that has them so obsessed with harming their users privacy and slowing their page loads? I really don't get it: you don't need to sell out your users to google, Facebook, etc to get page view counts, time page loads, get browser statistics, etc. What is it that site developers actually think they're getting out of abusing their users?

blueferret 3y ago

Seems like we have a lot of good GA alternatives on here already. Thought I'd add one: goatcounter.com Not mine, and I only just started using it. But it's easy to implement, and shows "just enough" analytics data for me. Nice simple option.

system2 3y ago

Currently using self hosted Motamo Analytics. Very easy to use and intuitive.

face789 3y ago

[dead]

face789 3y ago

[dead]

right32 3y ago

[dead]

binnaclegrade 3y ago

[dead]

onlypositive 3y ago

I think companies should stop using fixed navigation banners but we can't all get what we want now can we? Like holy crap, I agree with you but your website is unreadable with that may as well be a banner ad of a navigation bar that keeps popping in and out of existence every time I scroll down.

shantnutiwari 3y ago

Could Google outsmart them by hosting some of the data in EU, but still keeping spying on customers?

straymedal 3y ago

[dead]

straymedal 3y ago

[dead]

calvin982 3y ago

[dead]

calvin982 3y ago

[dead]

slack92 3y ago

[dead]