5 ms·

Who needs analytics? I'm confused. When I worked at companies using google analytics, 99.9% of the time they could have gotten this data from server logs with

Who needs analytics? I'm confused. When I worked at companies using google analytics, 99.9% of the time they could have gotten this data from server logs with something like awstats or goaccess. To this day, I still don't get what's the point of embedding some javascript to do extra-requests or a tracking pixel, when the data was already given once.

switch007 3y ago
Marketing teams with large budgets. Not that they actually get questioned properly about actual stats, but they can confidently say they have GA set up and it’s showing some numbers, so just trust us. Google is “trusted”. Why would the person setting their budget put faith in some hand rolled/open source solution ?! /s
darkr 3y ago
It's a problem introduced at least in part by SPAs. When the application runs entirely in the client browser, save for a few API calls (that may be shared between multiple pages) it's difficult to tell which pages are actually being viewed, unless you have the client application report back to you (or to Google)
- capableweb 3y ago
  Easily addressable by including a header like x-from-page where you declare which "SPA route" the backend requests were made from.
jkukul 3y ago
With server side tracking you're not able to identify and properly track non-logged in users. GA (and other client-side tools) take care of this, via cookies. Additionally, a common argument is that the server side logs contain a lot of logs from bots/crawlers and GA (and alike) can filter them. The other side of the coin is that GA (and alike) are not able to track users with Adblockers. EDIT: not sure why I'm downvoted - the OP asked for some reasons why people use client side tracking and I listed them. I didn't say that I support these practices, but maybe I should have made that explicit to comply with the overall sentiment of this site.
- bombolo 3y ago
  They also ensure that you need the annoying popup to consent to tracking to comply to the law, rather than doing no tracking and not annoying your users.
- Arch-TK 3y ago
  You can set a tracking cookie when the user first accesses your website without needing them to log in.
- kalleboo 3y ago
  For the vast majority of sites I would bet using IP address alone would be enough to track enough users individually over their single sessions to be statistically useful. Does anyone have any experience? How bad does CG-NAT mess this up over a large enough cohort of users?
o_m 3y ago
I've worked at an web agency creating many websites for mid-sized companies (million of views each month). My conclusion is that it is about feelings. It feels good to know you have some data about your users, even if you in most cases are not going to look at it. If someone hire someone to look at it then the findings are not acted upon. The best way to get feedback is to talk to your users face to face, or do a questionnaire.
alkonaut 3y ago
The question I have isn't why you need analytics but why you'd ever need any PII in the data. I don't care whether Bob clicked the button I only care whether 1% or 50% of users click the button. Or if those who clicked button A are likely to click button B so they should be closer together. Analytics should be anonymous usage statistics not tracking individuals. We are clumping two things together where one is bad and the other is useful and mostly harmless to integrity.
- jahewson 3y ago
  That’s the idea but to know that an anonymous user who has clicked button A goes on to click button B requires you to track that user via some kind of random ID that uniquely identifies their browser/device. This new Swedish ruling says that ID is itself PI.
  - alkonaut 3y ago
    How does the ruling come to that conclusion? How does an ID that uniquely identifies a user but can't be used to trace back to a physical person be PII? Reading the linked rulings it seems like it's not the IP (even though it's only blanked at the last octet) but rather other cookie values, which may in turn be traceable to the user? Of course if a cookie value is sent and in some other system that same cookie value is stored next to a user's name, then that cookie value is definitely PII and can't be sent via GA, that much I understand. The key passage from the longest ruling (DI) seems to be Dessa identifierare har skapats med syftet att kunna särskilja individuella besökare, såsom klaganden. De unika identifierarna gör därmed besökarna på Webbplatsen identifierbara. Även om sådana unika identifierare (enligt punkt 1 ovan) i sig inte skulle anses göra enskilda identifierbara, måste det dock beaktas att dessa unika identifierare i det aktuella fallet kan kombineras med ytterligare element (enligt punkterna 2–4 ovan) samt att det är möjligt att dra slutsatser i förhållande till information (enligt punkterna 2–4 ovan) som medför att uppgifter utgör personuppgifter, oaktat om IP-adressen inte överförts i sin helhet Basically: the random ids aren't enough by themselves, nor is the IP, but the IDS together with partial IPs and something else is. I don't know what the bottom line is though. And that worries me a bit. Any analytics will be at risk of doing this. In my desktop app analytics we blank IPs etc, but just storing some hardware data (ram amount, cpu freq, windows version, screen resolution...) means that we eventually have enough entropy to say with certainty that each user we have has a unique set of parameters in the data we log. It's almost impossible to NOT fingerprint perfectly if you gather even just basic hardware and OS info, for example. But there is of course zero possibility that we could use the data backwards and say "ok which single physical person is it that has a 16 core machine and 16Gb ram" making it "not PII"? I think the key issue in these cases with GA is that it's more a chain leading to actual PII. E.g. the cookie value that GA has access to, can realistically be stored somewhere where there is also PII such as an email address. And that's enough to violate the GDPR.
bjornsing 3y ago
What makes you think it’s legal to use those log files for that purpose? ;)
romanovcode 3y ago
> Who needs analytics? I'm confused. SEO and Marketing Dept. of any company.
donatj 3y ago
Back in the day before responsive design, I loved having stats on things like screen resolution you couldn’t otherwise get from server logs. You also get stats on keywords driving traffic to individual pages.
bschwindHN 3y ago
It's just something data goblins like to collect and obsess over instead of making an actually good product.
henham 3y ago
The questions is not just if the raw data is available ( Google Analytics also has the data accessible in Google BigQuery) but if business stakeholders have the ability to easily access the data and drive decision making. You need an interface that visualizes the data and decentralizes access and analytics as much as possible. Since Google Analytics is free and more or less part of one of the biggest marketing stacks (Google Ads) you will find a lot of marketing stakeholders with at least some knowledge of the tool. But perhaps the landscape will change with the very rocky start of Google Analytics 4

switch007 3y ago

Marketing teams with large budgets. Not that they actually get questioned properly about actual stats, but they can confidently say they have GA set up and it’s showing some numbers, so just trust us. Google is “trusted”. Why would the person setting their budget put faith in some hand rolled/open source solution ?! /s

darkr 3y ago

It's a problem introduced at least in part by SPAs. When the application runs entirely in the client browser, save for a few API calls (that may be shared between multiple pages) it's difficult to tell which pages are actually being viewed, unless you have the client application report back to you (or to Google)

capableweb 3y ago
Easily addressable by including a header like x-from-page where you declare which "SPA route" the backend requests were made from.

jkukul 3y ago

With server side tracking you're not able to identify and properly track non-logged in users. GA (and other client-side tools) take care of this, via cookies. Additionally, a common argument is that the server side logs contain a lot of logs from bots/crawlers and GA (and alike) can filter them. The other side of the coin is that GA (and alike) are not able to track users with Adblockers. EDIT: not sure why I'm downvoted - the OP asked for some reasons why people use client side tracking and I listed them. I didn't say that I support these practices, but maybe I should have made that explicit to comply with the overall sentiment of this site.

bombolo 3y ago
They also ensure that you need the annoying popup to consent to tracking to comply to the law, rather than doing no tracking and not annoying your users.
Arch-TK 3y ago
You can set a tracking cookie when the user first accesses your website without needing them to log in.
kalleboo 3y ago
For the vast majority of sites I would bet using IP address alone would be enough to track enough users individually over their single sessions to be statistically useful. Does anyone have any experience? How bad does CG-NAT mess this up over a large enough cohort of users?

o_m 3y ago

I've worked at an web agency creating many websites for mid-sized companies (million of views each month). My conclusion is that it is about feelings. It feels good to know you have some data about your users, even if you in most cases are not going to look at it. If someone hire someone to look at it then the findings are not acted upon. The best way to get feedback is to talk to your users face to face, or do a questionnaire.

alkonaut 3y ago

The question I have isn't why you need analytics but why you'd ever need any PII in the data. I don't care whether Bob clicked the button I only care whether 1% or 50% of users click the button. Or if those who clicked button A are likely to click button B so they should be closer together. Analytics should be anonymous usage statistics not tracking individuals. We are clumping two things together where one is bad and the other is useful and mostly harmless to integrity.

jahewson 3y ago
That’s the idea but to know that an anonymous user who has clicked button A goes on to click button B requires you to track that user via some kind of random ID that uniquely identifies their browser/device. This new Swedish ruling says that ID is itself PI.
- alkonaut 3y ago
  How does the ruling come to that conclusion? How does an ID that uniquely identifies a user but can't be used to trace back to a physical person be PII? Reading the linked rulings it seems like it's not the IP (even though it's only blanked at the last octet) but rather other cookie values, which may in turn be traceable to the user? Of course if a cookie value is sent and in some other system that same cookie value is stored next to a user's name, then that cookie value is definitely PII and can't be sent via GA, that much I understand. The key passage from the longest ruling (DI) seems to be Dessa identifierare har skapats med syftet att kunna särskilja individuella besökare, såsom klaganden. De unika identifierarna gör därmed besökarna på Webbplatsen identifierbara. Även om sådana unika identifierare (enligt punkt 1 ovan) i sig inte skulle anses göra enskilda identifierbara, måste det dock beaktas att dessa unika identifierare i det aktuella fallet kan kombineras med ytterligare element (enligt punkterna 2–4 ovan) samt att det är möjligt att dra slutsatser i förhållande till information (enligt punkterna 2–4 ovan) som medför att uppgifter utgör personuppgifter, oaktat om IP-adressen inte överförts i sin helhet Basically: the random ids aren't enough by themselves, nor is the IP, but the IDS together with partial IPs and something else is. I don't know what the bottom line is though. And that worries me a bit. Any analytics will be at risk of doing this. In my desktop app analytics we blank IPs etc, but just storing some hardware data (ram amount, cpu freq, windows version, screen resolution...) means that we eventually have enough entropy to say with certainty that each user we have has a unique set of parameters in the data we log. It's almost impossible to NOT fingerprint perfectly if you gather even just basic hardware and OS info, for example. But there is of course zero possibility that we could use the data backwards and say "ok which single physical person is it that has a 16 core machine and 16Gb ram" making it "not PII"? I think the key issue in these cases with GA is that it's more a chain leading to actual PII. E.g. the cookie value that GA has access to, can realistically be stored somewhere where there is also PII such as an email address. And that's enough to violate the GDPR.

bjornsing 3y ago

What makes you think it’s legal to use those log files for that purpose? ;)

romanovcode 3y ago

> Who needs analytics? I'm confused. SEO and Marketing Dept. of any company.

donatj 3y ago

Back in the day before responsive design, I loved having stats on things like screen resolution you couldn’t otherwise get from server logs. You also get stats on keywords driving traffic to individual pages.

bschwindHN 3y ago

It's just something data goblins like to collect and obsess over instead of making an actually good product.

henham 3y ago

The questions is not just if the raw data is available ( Google Analytics also has the data accessible in Google BigQuery) but if business stakeholders have the ability to easily access the data and drive decision making. You need an interface that visualizes the data and decentralizes access and analytics as much as possible. Since Google Analytics is free and more or less part of one of the biggest marketing stacks (Google Ads) you will find a lot of marketing stakeholders with at least some knowledge of the tool. But perhaps the landscape will change with the very rocky start of Google Analytics 4