5 ms·

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our f

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only. This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed. Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-analytics-by-default/ https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

dchest 2mo ago
> measure and improve your website speed inserts 31KB JavaScript into tiny HTML pages.
tredre3 2mo ago
If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?
- tacitusarc 2mo ago
  I have broadly good feelings about Cloudflare but this warrants a response.
  - hecturchi 2mo ago
    Because if something is free, you are the product.
  - anon7000 2mo ago
    Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.
    - cryptonym 2mo ago
      Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.
      - Kevcmk 2mo ago
        Shill
        cryptonym 2mo ago
        I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way. When it's free you know you are being used, collecting data is the game.
      - whilenot-dev 2mo ago
        > this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.
        cryptonym 2mo ago
        You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.
        whilenot-dev 2mo ago
        Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
- socalgal2 2mo ago
  Just guessing. * Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me * Paid customers are usually business that have different needs, on average, than free customers
  - jnovek 2mo ago
    > Seems reasonable to me Only if they make it clear what they’re taking in return. It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.
oefrha 2mo ago
Wow, this is ridiculous. Sites that have been running on Cloudflare for a decade+ silently got the treatment. Why the hell was there never a big banner telling me about this? I frequently log into the console. I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, among other things. If I haven't given a damn about "powerful, in-depth monitoring solution that helps you debug and optimize applications" in over a decade, I certainly won't suddenly be "excited" about it when you sneakily inject it.
- deleted 2mo ago
  [deleted]
- justsomehnguy 2mo ago
  You can contract your comment to "I'm the product" and nothing would actually change.
- mlrtime 2mo ago
  You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.
  - oefrha 2mo ago
    > they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.
    - _joel 2mo ago
      If you're running infrastructure you care about, you really need to own the responsibility of keeping up to date with what you're supporting. Free or not.
    - bunbun69 2mo ago
deaux 2mo ago
> It is on by default for free sites fr the reasons we wrote about in the blog post below. Nowhere in the blog post does it give the reasons why it's A. on by default for free sites B. off by default for paid sites.
Puts 2mo ago
What an amazing display of double speak. The only thing I didn't get is how is the DOW doing? Btw I remember another time you tried to manipulate the DOM of peoples websites. It lead to Cloudbleed.
schubidubiduba 2mo ago
Not sure what is more appalling. Silently injecting javascript tracking, or writing a marketing-speech response like this without any substance at all
- Scaled 2mo ago
  While bad, this is far from the first problematic cloudflare behavior. They host a lot of sites with illegal content and refuse to action abuse reports. I support legal free speech, but any business who knowingly serves blatant pirate websites really shouldn't be trusted to behave ethically.
sunaookami 2mo ago
Is this even GDPR-compliant?
- hinata08 2mo ago
  > Rather than count unique IP addresses (requiring storing state about each visitor), we simply count page views that originate from a distinct referral or navigation event, avoiding the need to store information that might be considered personal data. They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default. You do your opinion
  - sunaookami 2mo ago
    Just saw that in the dashboard: "Enable globally", "Exclude EU". Kinda funny (in a bad way)
  - Mystery-Machine 2mo ago
    > they exclude EU visitors GDPR is applicable on EU citizens, disregarding where they browse from. So either they have to track whether you're an EU citizen/EU visitor or they track EU visitors when browsing from outside of EU. This makes it not GDPR compliant. The main issue is that your privacy policy is most likely not mentioning this third-party tracking because you were not even aware of it. Who is going to be responsible? Who is going to be fined for not mentioning this tracking in _your_ privacy policy? You. (Your company)
jwr 2mo ago
> "gives site owners actionable performance data they would not otherwise have" As I understand, the next step will be to inject ads, to give CloudFlare actionable monetization strategies they would not otherwise have.
stagas 2mo ago
That’s cool, make sure I see it however on the onboarding screens. Big green switches (Proxy, Web Analytics) that I have to scroll through to get to the Ok so I can turn them off there.
boesboes 2mo ago
Fucking ass hats. I'm impressed how quickly cloudflare went from nice to evil cunts.
swordsith 2mo ago
Yeah not telling people you're doing the equivalent of css on their website is diabolical dude. You should be ashamed.

dchest 2mo ago

> measure and improve your website speed inserts 31KB JavaScript into tiny HTML pages.

tredre3 2mo ago

If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?

tacitusarc 2mo ago
I have broadly good feelings about Cloudflare but this warrants a response.
- hecturchi 2mo ago
  Because if something is free, you are the product.
- anon7000 2mo ago
  Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.
  - cryptonym 2mo ago
    Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.
    - Kevcmk 2mo ago
      Shill
      - cryptonym 2mo ago
        I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way. When it's free you know you are being used, collecting data is the game.
    - whilenot-dev 2mo ago
      > this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.
      - cryptonym 2mo ago
        You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.
        whilenot-dev 2mo ago
        Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.
socalgal2 2mo ago
Just guessing. * Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me * Paid customers are usually business that have different needs, on average, than free customers
- jnovek 2mo ago
  > Seems reasonable to me Only if they make it clear what they’re taking in return. It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.

oefrha 2mo ago

Wow, this is ridiculous. Sites that have been running on Cloudflare for a decade+ silently got the treatment. Why the hell was there never a big banner telling me about this? I frequently log into the console. I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, among other things. If I haven't given a damn about "powerful, in-depth monitoring solution that helps you debug and optimize applications" in over a decade, I certainly won't suddenly be "excited" about it when you sneakily inject it.

deleted 2mo ago
[deleted]
justsomehnguy 2mo ago
You can contract your comment to "I'm the product" and nothing would actually change.
mlrtime 2mo ago
You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.
- oefrha 2mo ago
  > they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.
  - _joel 2mo ago
    If you're running infrastructure you care about, you really need to own the responsibility of keeping up to date with what you're supporting. Free or not.
  - bunbun69 2mo ago

deaux 2mo ago

> It is on by default for free sites fr the reasons we wrote about in the blog post below. Nowhere in the blog post does it give the reasons why it's A. on by default for free sites B. off by default for paid sites.

Puts 2mo ago

What an amazing display of double speak. The only thing I didn't get is how is the DOW doing? Btw I remember another time you tried to manipulate the DOM of peoples websites. It lead to Cloudbleed.

schubidubiduba 2mo ago

Not sure what is more appalling. Silently injecting javascript tracking, or writing a marketing-speech response like this without any substance at all

Scaled 2mo ago
While bad, this is far from the first problematic cloudflare behavior. They host a lot of sites with illegal content and refuse to action abuse reports. I support legal free speech, but any business who knowingly serves blatant pirate websites really shouldn't be trusted to behave ethically.

sunaookami 2mo ago

Is this even GDPR-compliant?

hinata08 2mo ago
> Rather than count unique IP addresses (requiring storing state about each visitor), we simply count page views that originate from a distinct referral or navigation event, avoiding the need to store information that might be considered personal data. They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default. You do your opinion
- sunaookami 2mo ago
  Just saw that in the dashboard: "Enable globally", "Exclude EU". Kinda funny (in a bad way)
- Mystery-Machine 2mo ago
  > they exclude EU visitors GDPR is applicable on EU citizens, disregarding where they browse from. So either they have to track whether you're an EU citizen/EU visitor or they track EU visitors when browsing from outside of EU. This makes it not GDPR compliant. The main issue is that your privacy policy is most likely not mentioning this third-party tracking because you were not even aware of it. Who is going to be responsible? Who is going to be fined for not mentioning this tracking in _your_ privacy policy? You. (Your company)

jwr 2mo ago

> "gives site owners actionable performance data they would not otherwise have" As I understand, the next step will be to inject ads, to give CloudFlare actionable monetization strategies they would not otherwise have.

stagas 2mo ago

That’s cool, make sure I see it however on the onboarding screens. Big green switches (Proxy, Web Analytics) that I have to scroll through to get to the Ok so I can turn them off there.

boesboes 2mo ago

Fucking ass hats. I'm impressed how quickly cloudflare went from nice to evil cunts.

swordsith 2mo ago

Yeah not telling people you're doing the equivalent of css on their website is diabolical dude. You should be ashamed.