Cloudflare’s privacy crusade continues with a challenge to Google Analytics

Even though this offering from Cloudflare is something from another 3rd party, I'm going to watch it to see how it pans out. However, it would be even more impressive if they offered a 1st party version. The JS runs on the same domain, it points to a database you control, and only your org has access to the data.

The only way it adds privacy is by being more limited in some forms of tracking, but in the wider big data collection, tracking people across domains, etc, they really don't have much of an argument. Especially when they are working to control such a big % of internet traffic. It's still all going to a centralized DB where correlations can be done.

In many ways they could already vacuum up this information whether you enabled analytics or not.

Just because they claim not to be doing it, doesn't mean its fundamentally privacy oriented.

You can, for example, disable its tracking cookie, anonymize IPs, make it deactivate when seeing DNT requests, and it would still work fine. Session tracking would be much less accurate of course, but you didn't use that anyway, and even if you did, be grateful that tracking is still possible.

Matomo is cheap to self-host and easy to maintain, via its Dockery setup.

Cloudflare entering this space is cool, as it would save people from self-hosting stuff, further bringing cost down. But they are still a third-party that you, and your visitors, will have to trust.

Did you know that Cloudflare sets a tracking cookie in every response, on every website, with no way to turn it off?

After seeing that cookie, with no clear explanation to how it is used, my trust in them was shaken. Now they are getting into analytics, so I guess I now know why it's there.

And therefore my worry as a user. You can block requests to Google Analytics, but blocking requests to Cloudflare essentially means blocking the Internet. Checkmate content blockers ;-)

[0] https://support.cloudflare.com/hc/en-us/articles/200170156-U...

When I reached out to Cloudflare on this 3 and a half years ago, asking if they could at least inject a header like X-CF-SSL: Flexible or something to indicate to the end-user that their connection was in fact not secure. Extension developers could then use this header to inform the user that this was happening. I was told that they would "pass it along", but of course nothing has changed.

CloudFlare will give you a privately signed, 15 year certificate to use to secure communication between Cloudflare and your origin in the event you can't get a publicly signed certificate, so there's really no excuse to continue to allow this terrible feature.