Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we built a GDPR-compliant website analytics platform without using cookies

usefathom.com

Post reply on HN
Print view View original

61–70 of 129 posts

Re: How we built a GDPR-compliant website analytics platform without using cookies

#61

Post by ares2012 »

This is a common solution to the problem of PII, but without any information on returning users I would argue that it's value as an analytics platform is limited. Few are the tools where you can grow the business without knowing the difference between a first-time and return user which is the reason cookies were invented in the first place.

However, since such businesses already need to collect personal info as part of your account creation it shouldn't be hard to build analytics on top of that existing PII. If they are already collecting PII it doesn't seem to save much to have their analytics tool avoid it?

Re: How we built a GDPR-compliant website analytics platform without using cookies

#62

Post by JackWritesCode »

ares2012 wrote: post #61

This is a common solution to the problem of PII, but without any information on returning users I would argue that it's value as an analytics platform is limited. Few are the tools where you can grow the business without knowing the difference between a first-time and return user which is the reason cookies were invented in the first place. However, since such businesses already need to collect personal info as part…

Fathom Analytics is intentionally limited, and the limitations you point out are 100% intentional. There are many businesses who can't use our product, but millions that can :)

Re: How we built a GDPR-compliant website analytics platform without using cookies

#63

Post by kitchenkarma »

JackWritesCode wrote: post #55
kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

GDPR is for protection of personal data and we store no personal data. Please take a read of this: https://usefathom.com/data/

I don't believe you have understanding what personal data and GDPR is. You are capturing user behaviour and that is very personal regardless if it is "anonymised" or not - and that is without clear need for doing that. That is pretty much against GDPR.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#64

Post by JackWritesCode »

kitchenkarma wrote: post #63
JackWritesCode wrote: post #55

Earlier quoted context omitted.

GDPR is for protection of personal data and we store no personal data. Please take a read of this: https://usefathom.com/data/

I don't believe you have understanding what personal data and GDPR is. You are capturing user behaviour and that is very personal regardless if it is "anonymised" or not - and that is without clear need for doing that. That is pretty much against GDPR.

You come across as somewhat hostile but I'm going to assume good intent on your part, so thank you for the challenges on our stance.

So if you take a look at Recital 26 (https://gdpr-info.eu/recitals/no-26/):

> To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.

> To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

> The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

> This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

So the piece about the principles of data protection not applying to personal data rendered anonymous is crucial. We believe that GDPR does not apply to us because of that. But even if GDPR did apply to us (we'll assume it does, that's always the best way to be), then our legal basis is that there's legitimate interest. As a website owner, it is in your legitimate business interest to understand how your website is performing - e.g. the most popular pages, the pages where people linger for longer, the pages where people bounce.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#65

Post by nullstyle »

scarejunba wrote: post #52
JackWritesCode wrote: post #37

Earlier quoted context omitted.

I think the defensiveness comes when people put comments such as "I'm a little concerned by the lag in publishing this update". I've never spoken like this in my life to an OS contributor and I use open-source software every day. We're working hard to get the software OS but we were originally planning on keeping the codebases separate (since they were different languages). We only recently pivoted on this after spea…

You know, I do wonder why people talk like that these days. I cannot recall a time when it was acceptable and I certainly wouldn't do it myself. But these snide comments are so common on OSS thèse days.

https://www.youtube.com/watch?v=nUBtKNzoKZ4

Re: How we built a GDPR-compliant website analytics platform without using cookies

#66

Post by atonse »

pauljarvis wrote: post #2

We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room for improvement. Happy to hear thoughts in the comments.

I trust that there's enough questions and scrutiny about your anonymization, so I don't have any questions about that. Mine is more about implementation.

If I want to integrate this with a single page app (like Ember or React), are there enough API hooks on how I can track click events and page load events, etc in the JS? We threw together Google Analytics for our launch just so we would have SOME data, but we want to move away from it ASAP for privacy reasons.

Anymore about how it would compare to something like Piwik? (the product we're looking at).

Re: How we built a GDPR-compliant website analytics platform without using cookies

#67

Post by atonse »

JackWritesCode wrote: post #44
sjogress wrote: post #31

Earlier quoted context omitted.

Out of curiosity, which language did you choose to write the new code base?

We are writing Version 2 in PHP 7.3 with Laravel. We're pleased with it's performance (our hosted solution operates at large scale using Laravel) and it's our favourite language to work with. We'll be building the frontend in EmberJS and it will be incredibly fast.

Awesome that you're using Ember! I'm hoping that (from my earlier question) I'll be easily able to track of page load/unload events using route transitions if I'm using this product.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#68

Post by tedivm »

JackWritesCode wrote: post #37
joekrill wrote: post #24

Earlier quoted context omitted.

There's certainly nothing wrong with that. But this sounds a little defensive. And if you're going to promote the "Community Edition"/open-source nature of the codebase, this should probably be made more clear to your users/contributors. (Maybe it is made clear and I'm just not seeing it, though - this is my first time hearing about this product).

I think the defensiveness comes when people put comments such as "I'm a little concerned by the lag in publishing this update". I've never spoken like this in my life to an OS contributor and I use open-source software every day. We're working hard to get the software OS but we were originally planning on keeping the codebases separate (since they were different languages). We only recently pivoted on this after spea…

I'm a big fan of fathom and have been using it for my personal sites for about six months now- I've completely ditched Google Analytics and other providers.

When I heard that the new version wasn't going to be open source it was disappointing- both for the simple fact that I value open source, and also for how it wasn't really announced so much as heavily implied until I actually asked. Knowing that you've listened to the community and are going to open source the new version as well is a huge relief for me, and will definitely result in me promoting your product again.

I would say from a communication standpoint things could have been clearer, and I'm sure you'll work on that. From a timeline standpoint I think it would be nice if the open source and hosted versions eventually were released together, but with a full rewrite I also understand that you probably want to clean it up and make sure it's in good shape before doing so. That being said if you want some help with alpha testing the open source version I'd be happy to assist, and I'm sure others would as well.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#69

Post by munchbunny »

JackWritesCode wrote: post #46
munchbunny wrote: post #41

Earlier quoted context omitted.

> Does this meet the requirements for a site to avoid notifying users under the GDPR? I have no idea. Not necessarily. It's a bit complex, but the fact that Fathom ingests personal data at all likely means that they must still be disclosed by whoever is using Fathom's code. On the other hand, if Fathom were able to push data ingestion into the first party's infrastructure so that only aggregated data hits Fathom's ow…

What do you think about Recital 26? For GDPR, our stance can be found here: https://usefathom.com/data/

I am neither a lawyer nor a DPO, I just worked on GDPR compliance in the past, so take what I say with a grain of salt.

I went and reread parts of GDPR, and I think you are right, though not because of Article 26. I think it's pretty clear that after your ingestion the data has been in good faith anonymized to the degree that it is no longer personal, and therefore your analytics code should be exempt from consent rules.

The interesting question to me is whether a controller deciding to put your pixel on a page for analytics purposes counts as you processing on the controller's behalf to an extent requiring consent. I don't see any clause specifically regarding third party access to personal data (as opposed to third parties processing personal data), so I agree with your stance that it's most likely fine.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#70

Post by JackWritesCode »

atonse wrote: post #66
pauljarvis wrote: post #2

We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room for improvement. Happy to hear thoughts in the comments.

I trust that there's enough questions and scrutiny about your anonymization, so I don't have any questions about that. Mine is more about implementation. If I want to integrate this with a single page app (like Ember or React), are there enough API hooks on how I can track click events and page load events, etc in the JS? We threw together Google Analytics for our launch just so we would have SOME data, but we want t…

We <3 EmberJS. Fathom's Dashboard is built using it. You'd want to built it into the Router and call fathom('trackPageview') to log it :)
Post reply on HN