Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Umami: Self-hosted open-source alternative to Google Analytics

umami.is

Post reply on HN
Print view View original

161–170 of 235 posts

Re: Umami: Self-hosted open-source alternative to Google Analytics

#161

Post by ZephyrBlu »

justinclift wrote: post #99
vs4vijay wrote: post #23

Looks neat! will explore. Also, I did research on alternatives to GA few days back, might be helpful of someone: https://github.com/Open-Web-Analytics/Open-Web-Analytics https://matomo.org/ https://github.com/matomo-org/matomo https://github.com/usefathom/fathom https://www.goatcounter.com/ https://plausible.io/ https://github.com/PostHog/posthog https://www.usertrack.net/

> https://github.com/usefathom/fathom Be careful of this one. It started out as OSS, but switched to proprietary once they'd achieved traction.

Did they have a reason for changing from OSS to free/pro?

Re: Umami: Self-hosted open-source alternative to Google Analytics

#162

Post by mcao »

madeofpalk wrote: post #156
mcao wrote: post #108

Earlier quoted context omitted.

I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR. I am using the same techniques as Fathom Analytics, Plausible.io and other products. Everything is hashed into a unique session id and none of the actual data like user agent or IP address is actually stored. It is the same data that is found in server log files. In the strictest interpretation of GDPR, I don't think any analytics…

> I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR If you don't feel fit to judge whether something breaches GDPR, then maybe you shouldn't say "so it is GDPR and CCPA compliant".

Fair point. I was simply following the "common practice" from other products making these claims, which is to not store personal user data and only generate an anonymous ids.

Maybe that's not fully compliant, I don't know, so I went ahead and removed any mention of GDPR from the website. It's not really my goal anyways. I'm just trying to release free software while they are charging money and making these claims.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#163

Post by divbzero »

malisper wrote: post #103

One of the claims of Umami is that it's GDPR compliant: > Umami does not collect any personally identifiable information so it is GDPR and CCPA compliant. No cookie notices are needed because Umami does not use cookies. From auditing the source code, this doesn't seem to be the case. First, it claims it doesn't use cookies, but it clearly uses localStorage to store a "sessionKey"[0]. The other claim, that Umami is GD…

Would randomly generating the session key instead of hashing client IP and other properties satisfy GDPR’s requirement of no PII?

The definition in GDPR Art. 4 reads: [1]

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

[1]: https://gdpr-info.eu/art-4-gdpr/

My intuition is that a randomly generated session key could not be tied back to the identity of a natural person, as long as client IP, user agent, etc., are also excluded from the analytics data.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#164

Post by Aeolun »

slykar wrote: post #158
mcao wrote: post #108

Earlier quoted context omitted.

I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR. I am using the same techniques as Fathom Analytics, Plausible.io and other products. Everything is hashed into a unique session id and none of the actual data like user agent or IP address is actually stored. It is the same data that is found in server log files. In the strictest interpretation of GDPR, I don't think any analytics…

I've listened to a podcast interview with a lawyer specializing in EU privacy laws and he said that it does not matter if the personal data is hashed or encrypted. It's still personal data. This was about data stored in a database tough, but browser local storage is a database. This was mentioned when the guest spoke about right to be forgotten. The law is really weird, because you need to delete user's data from you…

> it does not matter if the personal data is hashed or encrypted

That sounds odd. If there is no way to go back from the hash to the data it is no different from a random string of letters and numbers.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#165

Post by Aeolun »

mcao wrote: post #162
madeofpalk wrote: post #156

Earlier quoted context omitted.

> I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR If you don't feel fit to judge whether something breaches GDPR, then maybe you shouldn't say "so it is GDPR and CCPA compliant".

Fair point. I was simply following the "common practice" from other products making these claims, which is to not store personal user data and only generate an anonymous ids. Maybe that's not fully compliant, I don't know, so I went ahead and removed any mention of GDPR from the website. It's not really my goal anyways. I'm just trying to release free software while they are charging money and making these claims.

Thank you for removing GDPR mentions, but mostly for building this in the first place!

It looks really nice.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#166

Post by mxuribe »

dylan604 wrote: post #154
mxuribe wrote: post #138

Earlier quoted context omitted.

Quite intriguing! I have no experience pitching to investors or advertisers, (but i do have web analytics exp.) and never would have thought that this would even be a question! Curious, is this something that you encountered, or is this hypothetical?

I had heard in the past that if your numbers were not GA, then they did not put much weight into them. Since you can grant access to other people directly into GA, they can validate the data. Using awstats or other metrics were deemed less trustworthy since they required someone gathering the data (which allows for potential manipulation). Before the days of 3rd party advertising, people tried to sell local ads just…

I didn't know that. Unfortunately I can see the rationale in that...which saddens me.

I appreciate your teaching me something I didn't know. But now I feel worse for us "little blogs". (Not your fault of course.)

Re: Umami: Self-hosted open-source alternative to Google Analytics

#167

Post by madeofpalk »

mcao wrote: post #162
madeofpalk wrote: post #156

Earlier quoted context omitted.

> I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR If you don't feel fit to judge whether something breaches GDPR, then maybe you shouldn't say "so it is GDPR and CCPA compliant".

Fair point. I was simply following the "common practice" from other products making these claims, which is to not store personal user data and only generate an anonymous ids. Maybe that's not fully compliant, I don't know, so I went ahead and removed any mention of GDPR from the website. It's not really my goal anyways. I'm just trying to release free software while they are charging money and making these claims.

Fair point also! Great job on the product, and congrats on shipping. I immediately spotted Inter :)

Re: Umami: Self-hosted open-source alternative to Google Analytics

#168

Post by danielheath »

mcao wrote: post #145
malisper wrote: post #122

Earlier quoted context omitted.

Both Fathom and plausible generate a unique salt every day. By getting rid of the old salts, they've anonymized any data older than a day. From [0]: > We do not attempt to generate a device-persistent identifier because they are considered personal data under GDPR. > Instead, we generate a daily changing identifier using the visitor’s IP address and User Agent. To anonymize these datapoints, we run them through a has…

I will probably implement the daily salt and remove the localStorage code as well just to be safe. But again, I'm not a lawyer here, where do you draw the line? Why not hourly salts? 5 minute salts? What is considered a reasonable effort? At some point you're storing data that can identify a user for the purpose of analytics. Still, I'm going try to lean to the safer side as best I can.

GDPR gives you 30 days to comply with deletion requests; that’s a good starting point to ensure you don’t keep PII past the regulated cutoff.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#169

Post by chmod775 »

mcao wrote: post #108
malisper wrote: post #103

One of the claims of Umami is that it's GDPR compliant: > Umami does not collect any personally identifiable information so it is GDPR and CCPA compliant. No cookie notices are needed because Umami does not use cookies. From auditing the source code, this doesn't seem to be the case. First, it claims it doesn't use cookies, but it clearly uses localStorage to store a "sessionKey"[0]. The other claim, that Umami is GD…

I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR. I am using the same techniques as Fathom Analytics, Plausible.io and other products. Everything is hashed into a unique session id and none of the actual data like user agent or IP address is actually stored. It is the same data that is found in server log files. In the strictest interpretation of GDPR, I don't think any analytics…

An IP address is considered personally identifiable information in at least Germany. If you're storing that you'll already have to think about the GDPR.

This is just another misguided attempt to adhere to the letter of the law while going against its spirit. Is is misguided because it's based on a wrong understand of what the letter of the law actually is. You see this a lot with adtech and analytics companies who try to skirt regulations through elaborate mechanisms but ultimately in vain.

Re: Umami: Self-hosted open-source alternative to Google Analytics

#170

Post by CydeWeys »

chmod775 wrote: post #169
mcao wrote: post #108

Earlier quoted context omitted.

I am not a lawyer so I cannot say for sure what constitutes PII and what breaches GDPR. I am using the same techniques as Fathom Analytics, Plausible.io and other products. Everything is hashed into a unique session id and none of the actual data like user agent or IP address is actually stored. It is the same data that is found in server log files. In the strictest interpretation of GDPR, I don't think any analytics…

An IP address is considered personally identifiable information in at least Germany. If you're storing that you'll already have to think about the GDPR. This is just another misguided attempt to adhere to the letter of the law while going against its spirit. Is is misguided because it's based on a wrong understand of what the letter of the law actually is. You see this a lot with adtech and analytics companies who tr…

It's considered PII in the United States as well. PII is a very easy standard to meet.
Post reply on HN