Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Companies must stop using Google Analytics

imy.se

Post reply on HN
Print view View original

241–250 of 672 posts

Re: Companies must stop using Google Analytics

#241

Post by jonasb »

TekMol wrote: post #92

One could still use Google Analytics by proxying the tracking events. Afaik only the IP is considered private data. So one could mask or (non-reversibly) hash the IP, remove anything else which might be considered private data and then send the event to Google. A simple PHP script with a few lines of code could do that. But Google lost me by: A) Making it impossible to convert your old data into the new Analytics ver…

Hashing the IP is not enough by IMY's decisions, none of the companies are allowed to use GA going forward.

CDON used GA's IP anonymization through truncation, it was not deemed enough. [1] The IP itself becomes is not personal data after truncation but it's unclear if the truncation happens before it leaves the country. And combined with the other personal data (e.g. cookies), it is considered personal data. [2]

Coop proxied all calls to GA and use the same generic IP address for all users. [3] They don't get a fine but have to stop using GA.

[1] "1.3.15 Effektiviteten hos vidtagna skyddsåtgärder av Google och CDON" https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

[2] "2.2.2 Integritetsskyddsmyndighetens bedömning" https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

[3] "1.3.14.2 Coops implementering av server side container" https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

Re: Companies must stop using Google Analytics

#242

Post by laichzeit0 »

ra wrote: post #36
ehnto wrote: post #20

Earlier quoted context omitted.

Matomo is a good self hosted analytics option.

As is snowplow https://github.com/snowplow/snowplow-javascript-tracker

Deploying the Snowplow backend is non-trivial (to put it mildly) and extremely expensive if you don't want to host it yourself.

Re: Companies must stop using Google Analytics

#243

Post by nologic01 »

oneeyedpigeon wrote: post #77
appleflaxen wrote: post #5

I am so grateful for the progressive policies in Europe that help the entire globe.

Me, too! Although I suspect you're an American and are being sarcastic...

There are millions of people in this industry that feel moral choices should not stand in the way of lining their pockets... Ridiculing the laws of countries and people that happen to have some traces of a moral compass shows that basically people have every reason to be suspicious.

Re: Companies must stop using Google Analytics

#244

Post by TheCapn »

ori_prior wrote: post #133
dragonwriter wrote: post #102

Earlier quoted context omitted.

> Your average car repair guy will often be forced to specialize in one brand of car. Not because of skill issues, but maybe forced because they work for a dealership that sells a particular make exclusively or, less often, a specialty shop; most “car repair guys” outside of those environments have to be generalists. > Your home appliance guy will preferrably sell and repair one brand of washing machine, dryer, dishw…

> Not because of skill issues, but maybe forced because they work for a dealership that sells a particular make exclusively or, less often, a specialty shop; most “car repair guys” outside of those environments have to be generalists. Yes, I'd expect any car guy to be able to change your tires. Or change your oil. But even resetting the oil-change alarm or tire-pressure sensor can be a hurdle here: Manufacturers also…

Perhaps you're using a broad/generic example to try and make the point but I'll say this:

If a seasoned mechanic is unable to figure out how to reset the Maintenance Reminder or look up how to sync Tire Pressure sensors, run away.

In the same way that one can use knowledge of one programming language as a means to leapfrog into other languages, other skilled trades are similar. Perhaps there's something that could be said about an ICE mechanic trying to dabble on Electric but that's not the point you're making. So yeah. I know you're trying to make a point about lock in, but when I think of people I want to hire for tasks who might say "Oh, sorry, you have a Volkswagen and I only know how to work on GMC" I wouldn't take my GMC to them either. It shows a fundamental lack of skill in that they don't understand the broader concepts and their universal applications. If I, a programmer, can figure out my Volkswagen, my GMC, my Mazda, my Nissan, certainly a mechanic can. If my appliance repair specialist can only do Whirlpool when I ask for help on a Bosch that's red flags.

One might specialize. Sure. But to refuse? Weird. But I fear I might be getting lost in the weeds here because its all about the approach. "Sorry, too busy to take on work on things that aren't my specialty": yep, understood. "Sorry, I don't know I only know " bad.

Re: Companies must stop using Google Analytics

#245

Post by jonasb »

jhpacker wrote: post #220
suddenclarity wrote: post #24

This case is about the old Analytics that was replaced with Google Analytics 4 in 2020. So they must stop using a version that Google definitely killed July 1 this year. There are arguments that GA4 would fail the same requirements. Denmark hold that view but it hasn't been tried. Their argument is that a EU-citizen that goes to Asia and visits a site there, will have his information sent to US servers and not EU ser…

My opinion is that this applies to GA4 as well. The decisions don't explicitly mention a version, they say these particular sites: "...shall cease to use the version of the Google Analytics tool used on 14 August 2020". They don't say if that's UA or GA4. The original complaints from NOYB refer to UA, but the issues cited in this decision would apply to GA4 as well. So when the DPA says "Companies must stop using Goo…

I guess they can't ban a product for all eternity. In the decision [1] they are a bit more specific:

"This shall be done in particular by ceasing to use that version of the tool Google Analytics as used on August 14, 2020, if not sufficient protective measures have been taken."

[1] https://www.imy.se/globalassets/dokument/beslut/2023/beslut-...

Re: Companies must stop using Google Analytics

#246

Post by jhpacker »

TekMol wrote: post #92

One could still use Google Analytics by proxying the tracking events. Afaik only the IP is considered private data. So one could mask or (non-reversibly) hash the IP, remove anything else which might be considered private data and then send the event to Google. A simple PHP script with a few lines of code could do that. But Google lost me by: A) Making it impossible to convert your old data into the new Analytics ver…

One of the sites (coop.se) in this decision did use a server-side GTM container to mask the IP before it was sent to Google, but they were still told to stop using GA, but they weren't fined. The DPA said that the _gads, _ga, and _gid cookies were enough to be identifiable. I don't follow the logic there, but that rules out using a proxy for compliance (at least done as coop did it).

Re: Companies must stop using Google Analytics

#247

Post by ericpauley »

worksonmine wrote: post #235
sweetjuly wrote: post #224

Earlier quoted context omitted.

Salts provide resistance against bulk bruteforce by making it so that you can't identify which hashes are the same plaintext without actually computing all of them. The issue is still that there are not that many IPv4 addresses and so even with very heavy algorithms it would be trivial to break.

But there are infinite numbers of salts. Please explain how this could be brute-forced as long as the salt is used correctly? What am I missing?

No matter what strategy you use to hash IPs, if you can correlate to an IP you can find the original IP by just trying all options. It doesn’t matter what you do because 4B unique possibilities is just too low to prevent brute forcing while maintaining utility.

If you use a random salt, then you need to store it or else the stored value has no utility. However you implement retrieval of that salt it can just be brute forced.

Re: Companies must stop using Google Analytics

#250

Post by lettergram »

dijit wrote: post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

Not really important to the rest of your comment, BUT — Sister-in-law means they have to be a “sister in the law”, a girlfriend has no legal basis in fact.

All that said, there are other analytics systems out there mixpanel, amplitude, roll your own, etc. they might not be quite as full-featured but 95% if the value comes from a few features everyone has

Post reply on HN