5 ms·

For those who look for an alternative https://plausible.io https://plausible.io is a great replacement.

by deofoo 3y ago

Hamuko 3y ago
Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.
- rhn_mk1 3y ago
  GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.
  - Hamuko 3y ago
    The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.
- konha 3y ago
  > Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.
- jgrahamc 3y ago
  See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/
  - jacooper 3y ago
    I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.
    - jacooper 3y ago
      Found it*
- happymellon 3y ago
  GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR. GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.
  - pelasaco 3y ago
    > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.
    - happymellon 3y ago
      You say "or" but then just give examples of what I said. > law infringement implications They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation". Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.
      - pelasaco 3y ago
        yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches. > You say "or" but then just give examples of what I said. > law infringement implications No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.
  - SahAssar 3y ago
    > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal. The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.
- openplatypus 3y ago
  Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.
  - jhpacker 3y ago
    Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it. One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.
    - openplatypus 3y ago
      As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data. You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data. As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA. https://medium.com/@christhaefner/shopify-illegal-in-germany-4b7f61576aa3 https://medium.com/@christhaefner/shopify-illegal-in-germany...
- dolmen 3y ago
  If data about EU citizen goes outside EU, it is illegal.
sschueller 3y ago
Plausible is OK but needs work. For example it isn't even multi lingual.
j-a-a-p 3y ago
Great for plausible.io of course. But what is the difference for the end user? - GDPR: hosted in EU vs US, so your data is traveling less far. The things the plausible can do with the data is more or less the same. - No cookies: don't see the point of that tbh, they will probably perform even more invasive tricks like finger printing to replace the cookie requirement Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor.
- gog 3y ago
  Plausible can also be self-hosted, unlike GA.
  - j-a-a-p 3y ago
    But then you still do the same thing, but you host it yourself. Meaning: it is installed and left running for years without updates and monitoring. I then rather have Google handle things.
- LudvigHz 3y ago
  > they will probably perform even more invasive tricks like finger printing to replace the cookie requirement It's clear you didn't even bother to look at plausibles data policy [1] before assuming what it does and doesn't collect. The TL;DR: it does not fingerprint, and it does not collect any identifiable information, be it about your device or your person. > Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor. Only basic device info is logged (not even IP addresses are stored). And it's very easy to self host so that different actor may be yourself. [1]: https://plausible.io/data-policy#first-thing-first-what-we-collect-and-what-we-use-it-for https://plausible.io/data-policy#first-thing-first-what-we-c...
  - j-a-a-p 3y ago
    I indeed do not know Plausible and any of their motivations. Google Analytics also does not provide PII to their end users per se. But I have seen many tools and solutions do just about anything to circumvent that. Merging analytics with transactional data and site logs. Adding company info to visitor data. There is an entire industry there. So, an imaginable use case would be to self host it. Intercept to circumvent the limitation. The reason why I am so cynical is not because of the motivations of Google Analytics or Plausible. It is what motivates the end users, the companies who are using these statistics.
marvinblum 3y ago
A nice list of many more analytics solutions: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv...

For those who look for an alternative https://plausible.io https://plausible.io is a great replacement.

by deofoo 3y ago

For those who look for an alternative https://plausible.io https://plausible.io is a great replacement.

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

rhn_mk1 3y ago
GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.
- Hamuko 3y ago
  The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.
konha 3y ago
> Should be GDPR compliant since they don't use cookies or local storage. That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.
jgrahamc 3y ago
See: https://blog.cloudflare.com/privacy-first-web-analytics/ https://blog.cloudflare.com/privacy-first-web-analytics/
- jacooper 3y ago
  I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.
  - jacooper 3y ago
    Found it*
happymellon 3y ago
GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR. GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.
- pelasaco 3y ago
  > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.
  - happymellon 3y ago
    You say "or" but then just give examples of what I said. > law infringement implications They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation". Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.
    - pelasaco 3y ago
      yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches. > You say "or" but then just give examples of what I said. > law infringement implications No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.
- SahAssar 3y ago
  > This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it. Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal. The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.
openplatypus 3y ago
Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.
- jhpacker 3y ago
  Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it. One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.
  - openplatypus 3y ago
    As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data. You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data. As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA. https://medium.com/@christhaefner/shopify-illegal-in-germany-4b7f61576aa3 https://medium.com/@christhaefner/shopify-illegal-in-germany...
dolmen 3y ago
If data about EU citizen goes outside EU, it is illegal.

sschueller 3y ago

Plausible is OK but needs work. For example it isn't even multi lingual.

j-a-a-p 3y ago

Great for plausible.io of course. But what is the difference for the end user? - GDPR: hosted in EU vs US, so your data is traveling less far. The things the plausible can do with the data is more or less the same. - No cookies: don't see the point of that tbh, they will probably perform even more invasive tricks like finger printing to replace the cookie requirement Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor.

gog 3y ago
Plausible can also be self-hosted, unlike GA.
- j-a-a-p 3y ago
  But then you still do the same thing, but you host it yourself. Meaning: it is installed and left running for years without updates and monitoring. I then rather have Google handle things.
LudvigHz 3y ago
> they will probably perform even more invasive tricks like finger printing to replace the cookie requirement It's clear you didn't even bother to look at plausibles data policy [1] before assuming what it does and doesn't collect. The TL;DR: it does not fingerprint, and it does not collect any identifiable information, be it about your device or your person. > Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor. Only basic device info is logged (not even IP addresses are stored). And it's very easy to self host so that different actor may be yourself. [1]: https://plausible.io/data-policy#first-thing-first-what-we-collect-and-what-we-use-it-for https://plausible.io/data-policy#first-thing-first-what-we-c...
- j-a-a-p 3y ago
  I indeed do not know Plausible and any of their motivations. Google Analytics also does not provide PII to their end users per se. But I have seen many tools and solutions do just about anything to circumvent that. Merging analytics with transactional data and site logs. Adding company info to visitor data. There is an entire industry there. So, an imaginable use case would be to self host it. Intercept to circumvent the limitation. The reason why I am so cynical is not because of the motivations of Google Analytics or Plausible. It is what motivates the end users, the companies who are using these statistics.

marvinblum 3y ago

A nice list of many more analytics solutions: https://european-alternatives.eu/category/web-analytics-services https://european-alternatives.eu/category/web-analytics-serv...