Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to track users for analytics in a privacy-first, cookie-less future

narrator.ai

Post reply on HN
Print view View original

11–20 of 53 posts

Re: How to track users for analytics in a privacy-first, cookie-less future

#11

Post by Y-bar »

cedricd wrote: post #7
Y-bar wrote: post #6

Earlier quoted context omitted.

Why do you talk about consent with regards to cookies only? GDPR deals with so much more with regards to tracking and identifiable information. For example this quote from the article: "Add a unique identifier to all urls on your site when you know who the user is." I don't see how our legal would allow us to do this with European customers without explicit opt-in consent since this kind of tracking and data processi…

The identifier on the urls isn't meant to identify the actual user I think. If you look at the examples given they're more like identifiers to something else -- an order id or subscription id. Wouldn't tracking something like an order (but not the user directly) be ok with GDPR?

They are using (in the example) an order number as a proxy to identify and track the actual user. From the article: "Simply look up the user from the identifier, note the anonymous id, and replace the anonymous id with a real user in the data."

At this point the tracking of the online identifier has certainly passed the threshold into tracking an individual for reasons not directly related to the service.

https://gdpr.eu/article-4-definitions/

"1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"

The order number in this case falls under "an identification number" and "an online identifier" at the very least.

"2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;"

What is happening is at the very least processing, recording, storing, dissemination, combination of that data.

Re: How to track users for analytics in a privacy-first, cookie-less future

#12

Post by vec »

> If you're unable to set a consistent cookie across your user's many sessions (especially for a high retention business like e-commerce), or your javascript conversion events (Google Tag Manager for example) are being blocked, your user's historical behavior will be extremely difficult to stitch together over time.

Yes, that is in fact the point.

Look, I know there are strong financial incentives to build individual user profiles and doing it this way may not violate the letter of the law, but it sure as hell violates the spirit. If we ask a user if they're willing to be tracked and they do everything in their power to tell us no then I'm not sure how comfortable we should be doing it anyway.

Re: How to track users for analytics in a privacy-first, cookie-less future

#13

Post by a13n »

I mean at the end of the day whether you store it in the cookie or the URL it’s still persistent key value storage for tracking purposes, so I don’t see why the EU’s stance would be any different. It’s effectively still a cookie.

Some activities and cookies are allowed by GDPR without requesting consent, and anonymous analytics (even google analytics) is included in this, so you don’t actually even need a cookie banner to do what you’re trying to do here...

I think from a legal standpoint this is no better than cookies, it doesn’t change whether you need consent or not.

Re: How to track users for analytics in a privacy-first, cookie-less future

#14

Post by cedricd »

vec wrote: post #12

> If you're unable to set a consistent cookie across your user's many sessions (especially for a high retention business like e-commerce), or your javascript conversion events (Google Tag Manager for example) are being blocked, your user's historical behavior will be extremely difficult to stitch together over time. Yes, that is in fact the point. Look, I know there are strong financial incentives to build individual…

Yeah, this advice looks targeted to companies that benefit hugely from targeting their users.

If I'm reading correctly it's basically saying 'once a user has identified themselves to you, then you can go back and figure out the steps they took before that'

As a person, if a company knows what I did right before I bought their product (say in that session) I think I'm ok with that. If they follow me onto other websites or other devices then that feels a lot more invasive.

Re: How to track users for analytics in a privacy-first, cookie-less future

#16

Post by mattjstar »

er4hn wrote: post #9

So the overall concept of "shove a tracker value into the URL and collate all interactions" makes sense - but how do you track if a user is sharing a URL? Let's say that I'm on a desktop browsing a shopping site. I'm on shopping.site/product/coolthing.html?tracker=12345. I share this with my friend on a mobile device because it looks like something of interest to them. Now how do you handle the other person having th…

This could in theory happen, but in my examples I'm adding the url right after someone converted -- paid for a subscription or completed an order. Those are unlikely to be shared with someone else (ideally). It's arguably more likely that the user will share it with themselves on another device, in which case the overall approach will work well.

I should also point out that the url tracker isn't meant to be persisted across page views. It's only done once at the moment that the user identifies themselves to your service.

Re: How to track users for analytics in a privacy-first, cookie-less future

#17

Post by er4hn »

mattjstar wrote: post #16
er4hn wrote: post #9

So the overall concept of "shove a tracker value into the URL and collate all interactions" makes sense - but how do you track if a user is sharing a URL? Let's say that I'm on a desktop browsing a shopping site. I'm on shopping.site/product/coolthing.html?tracker=12345. I share this with my friend on a mobile device because it looks like something of interest to them. Now how do you handle the other person having th…

This could in theory happen, but in my examples I'm adding the url right after someone converted -- paid for a subscription or completed an order. Those are unlikely to be shared with someone else (ideally). It's arguably more likely that the user will share it with themselves on another device, in which case the overall approach will work well. I should also point out that the url tracker isn't meant to be persisted…

Then I'm a little lost. I had thought a big part of this (your "Stitch anonymous data to users once they convert" picture and around it) was to be able to backtrack anonymous users once they identify themselves.

Even if they identify themselves via ordering something, is it an unusual workflow to share a link after? For example "I got this new coffee, I'm excited, here's the link to what I ordered my friend!"

Re: How to track users for analytics in a privacy-first, cookie-less future

#19

Post by mjevans »

korethr wrote: post #10

I'm mildly surprised cookie consent banners are only at 20%, given how often I come across banners who's only option is "Yes, I consent"

I block the entire element, and if moderate actions aren't enough will frequently just move on to other search results.
Post reply on HN