Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Companies must stop using Google Analytics

imy.se

Post reply on HN
Print view View original

231–240 of 672 posts

Re: Companies must stop using Google Analytics

#231

Post by 3np »

mattmcknight wrote: post #172
3np wrote: post #46

Earlier quoted context omitted.

No need for travels - all you need is to use a VPN/proxy/tor. IP geolocation is not a reliable proxy for physical location (let alone residency - while citizenship doesn't enter the equation at all). I don't find it problematic that the law recognizes this.

Yet IP address is the "personal data" they are claiming falls under the law. It's somehow both personal and useless at identification.

Not so strange at all. The IP address _can_ be used to identify you (together with other data-points), which brings it into PII territory. That it can not be used to reliably determine your physical location is besides the point.

Consider an online store shipping physical goods. It asks you for a shipping address. This shipping address is PII and must be treated as such. The facts that you may reside elsewhere and that multiple other people may be residing on that address are both irrelevant to the GDPR.

https://www.fieldfisher.com/en/services/privacy-security-and...

https://commission.europa.eu/law/law-topic/data-protection/r...

Re: Companies must stop using Google Analytics

#232

Post by jbrooksuk »

Yes, you should absolutely not be using Google Analytics. They don't need more data, your users don't want to see cookie banners and most of you really don't need 99% of the data that you can filter through...

I can't recommend Fathom (https://usefathom.com) enough. They have a huge focus on privacy-first tracking. You don't need to show a cookie banner and you can still track events etc.

If you want $10 credit for signing up, use https://usefathom.com/james but otherwise, https://usefathom.com

Seriously, Google Analytics sucks. Use anything other than that.

Re: Companies must stop using Google Analytics

#233

Post by Jgrubb »

belorn wrote: post #99
dijit wrote: post #34

My sister-in-law (girlfriends brothers girlfriend, not that it matters) recently studied for a data analytics certification. Actually several. The entire course (located on here: https://medieinstitutet.se ) is based on Google Analytics. Now her entire value is tied to the use of Google Analytics, she will almost certainly fight very hard to ensure that these skills remain relevant, nobody would want to retrain for 6…

Naively I would assume that the purpose of a data analyst is about presenting the relevant information to a company. How that data is collected, stored, processed and indexed is the role of system administrators, web developers and database designers. It seems very inappropriate to allow a data collecting tool to dictate what information is relevant for a specific company.

Once upon a time I might have agreed with this take, but having years worth of battle scars on me now - the interface that any company’s data presents about its operations is entirely coupled to the implementation of how it’s collected and the assumptions with which the system generating it is built. This is a good thing, because there is very little new under the sun, especially in business.

However, most young businesses will waste tons of time and money reinventing the wheel of these systems and trying to customize them to their business’ unique needs, but the much more effective path is to really (re)think through your business process and figure out how to align it with the grain of the tool instead. This option is only obvious to those with experience in failing to execute on the former option, unfortunately.

To your point, an effective analyst doesn’t just present data, they have to understand the entire world around that data - tooling, people, processes.

Re: Companies must stop using Google Analytics

#234

Post by jhpacker »

j-a-a-p wrote: post #96
LudvigHz wrote: post #62

Earlier quoted context omitted.

> they will probably perform even more invasive tricks like finger printing to replace the cookie requirement It's clear you didn't even bother to look at plausibles data policy [1] before assuming what it does and doesn't collect. The TL;DR: it does not fingerprint, and it does not collect any identifiable information, be it about your device or your person. > Bottom line, the website visitors data is still logged,…

I indeed do not know Plausible and any of their motivations. Google Analytics also does not provide PII to their end users per se. But I have seen many tools and solutions do just about anything to circumvent that. Merging analytics with transactional data and site logs. Adding company info to visitor data. There is an entire industry there. So, an imaginable use case would be to self host it. Intercept to circumvent…

I do know Plausible, and their motivation is to make a sustainable business providing basic web analytics, which is why they charge for their service and Google doesn't. The data they provide to the users of their service is like an order of magnitude less detailed than what Google provides.

I get the cynicism about the industry in general since Google led this merger between web analytics and advertising, but there are plenty of providers in the analytics space that aren't following that path.

Re: Companies must stop using Google Analytics

#235

Post by worksonmine »

sweetjuly wrote: post #224
worksonmine wrote: post #145

Earlier quoted context omitted.

That's why you use a salt, which is what I assume is meant by "non-reversibly".

Salts provide resistance against bulk bruteforce by making it so that you can't identify which hashes are the same plaintext without actually computing all of them. The issue is still that there are not that many IPv4 addresses and so even with very heavy algorithms it would be trivial to break.

But there are infinite numbers of salts. Please explain how this could be brute-forced as long as the salt is used correctly? What am I missing?

Re: Companies must stop using Google Analytics

#236

Post by DrScientist »

sccxy wrote: post #219
MrVandemar wrote: post #168

Earlier quoted context omitted.

Then they will learn an important lesson.

What is the lesson here?

The business lesson is if you are entirely dependent on somebody else you are not in a good position. Especially if your interests aren't aligned.

When people are banned, it's the platform deciding the reputational risk of association isn't worth the money you bring in. Given reputation impacts can be huge - it's hard to see how you'd ever be the right side of that equation.

Even worse, the platform may decide it's not even economic to make sure each banning is fair....

Ultimately I suspect the only way to rebalance the balance of power is to use collective power.

So having large number of friends on the platform that will campaign on your behalf, taking out insurance ( another pooled method ), or even having formal Unions.

In essence that puts some of the economic cost of getting the decisions right onto the platform users ( as the friends/union does the work, and makes the case ). Pooled insurance has a similar economic basis ( platform users bear the cost of the insurance ).

Re: Companies must stop using Google Analytics

#238

Post by alxmng »

beefield wrote: post #95

So, a dumb question. What's the easiest way to run privacy friendly analytics on static github pages? "Privacy friendly" as in unambiguously no need for cookie/gdpr permission popups. "Analytics" can be as simple as page loads per day count. Anything beyond that is a bonus.

Put it behind CloudFlare free plan. You’ll get total uniques for the domain. No hosting or JS required.

Re: Companies must stop using Google Analytics

#239

Post by openplatypus »

jhpacker wrote: post #227
openplatypus wrote: post #157

Earlier quoted context omitted.

Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.

Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it. One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.

As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data.

You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data.

As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA.

https://medium.com/@christhaefner/shopify-illegal-in-germany...

Re: Companies must stop using Google Analytics

#240

Post by bshacklett »

scarface_74 wrote: post #207
mschuster91 wrote: post #98

Earlier quoted context omitted.

> That said; we also have "Cloud Engineer" as a job title, so I'm not sure we will learn this lesson. As long as you don't depend too much on highly vendor-specific stuff, most of the stuff a "cloud engineer" uses day-to-day is just the same fundamentally - EC2/Azure VM/GCE, ECS/Azure Container Apps/Cloud Run, Security Group/Azure Network Security Group/Google Firewall, whatever. Different names, same or very similar…

I can tell you thats not the case…

I’m curious what you’re working with that is significantly different from one CSP to the next. I put most of my effort into AWS, but when I get staffed on a Google Cloud project, there isn’t much that I can’t figure out pretty quickly, especially with IaC managing everything. As long as the CSP has good docs, I find it relatively easy to move from one to the next.

There are certainly some cases where that breaks down, but it’s usually in specialized areas that I’d have to do some upskilling on in my preferred cloud anyway.

The benefit of the cloud is its service and resource (i.e. building block) oriented nature. There’s a level of transparency to cloud-based services that just didn’t really exist before.

Post reply on HN