Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we built a GDPR-compliant website analytics platform without using cookies

usefathom.com

Post reply on HN
Print view View original

71–80 of 129 posts

Re: How we built a GDPR-compliant website analytics platform without using cookies

#71

Post by JackWritesCode »

tedivm wrote: post #68
JackWritesCode wrote: post #37

Earlier quoted context omitted.

I think the defensiveness comes when people put comments such as "I'm a little concerned by the lag in publishing this update". I've never spoken like this in my life to an OS contributor and I use open-source software every day. We're working hard to get the software OS but we were originally planning on keeping the codebases separate (since they were different languages). We only recently pivoted on this after spea…

I'm a big fan of fathom and have been using it for my personal sites for about six months now- I've completely ditched Google Analytics and other providers. When I heard that the new version wasn't going to be open source it was disappointing- both for the simple fact that I value open source, and also for how it wasn't really announced so much as heavily implied until I actually asked. Knowing that you've listened t…

You are the side of open-source that the world needs. We were going to keep the current repository as-is because it's written in Go, but we'll introduce a new one. Upon announcing that V2 was paid only, people were angry (understandably). We spoke with the community and the consensus was that everyone would prefer that we 'archive' V1 (Golang) and then open-source V2 moving forward. Sorry for the bad communication, it's been challenging with the move between languages!

Re: How we built a GDPR-compliant website analytics platform without using cookies

#72

Post by EGreg »

JackWritesCode wrote: post #50
EGreg wrote: post #45

I am not sure what exactly they did here. How do they persist the hash between requests? My guess is they use localStorage and sending the hash to their servers with each request. So we are talking about a mechanism that’s just like a cookie. As long as they don’t have any PII and can’t figure out who the user was, then I think the GDPR gives them an exception. But “without cookies” claim is dubious!

We have been GDPR compliant for many months but our aim here was to meet E-Privacy demands. We don't use localStorage... Read the blog post, we don't use cookies.

Oh, apologies, you are right! You don't use any kind of cookie mechanism. I just read it again:

  Random SHA256 String (daily regenerated)
  IP Address
  User Agent
  Site ID
  Day of the year
My only question is about this "Random SHA256 String", where is it stored between requests?

Re: How we built a GDPR-compliant website analytics platform without using cookies

#74

Post by tedivm »

JackWritesCode wrote: post #71
tedivm wrote: post #68

Earlier quoted context omitted.

I'm a big fan of fathom and have been using it for my personal sites for about six months now- I've completely ditched Google Analytics and other providers. When I heard that the new version wasn't going to be open source it was disappointing- both for the simple fact that I value open source, and also for how it wasn't really announced so much as heavily implied until I actually asked. Knowing that you've listened t…

You are the side of open-source that the world needs. We were going to keep the current repository as-is because it's written in Go, but we'll introduce a new one. Upon announcing that V2 was paid only, people were angry (understandably). We spoke with the community and the consensus was that everyone would prefer that we 'archive' V1 (Golang) and then open-source V2 moving forward. Sorry for the bad communication, i…

That makes a ton of sense- you'll be able to get a lot more community support from the PHP community than the Golang one, just do to nature of size (and the fact that PHP is still very much a web language, which targets your audience well). It's been a few years since I was really involved in that community, but I still maintain a few open source projects and keep up with the language- who knows, maybe I'll be able to throw some bug fixes your way.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#75

Post by orra »

lmkg wrote: post #9
pauljarvis wrote: post #2

We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room for improvement. Happy to hear thoughts in the comments.

Hi Paul, thanks for being open about this. I have a big, important question. ICO, the agency in charge of enforcing GDPR and related legislation in England, released guidance earlier this month on the topics of cookies. One of the most notable parts of this guidance is that "device fingerprinting" is treated the same as a cookie[1]. And also that website analytics requires consent to use cookies or similar technologi…

I think that's a fair question.

AFAICT, v1 of PECR awkwardly applies whenever the cookie is not functionally directly necessary for the service that the user is using. PECR applies even if, like here, the cookie is just for counting unique numbers of visitors, and is not used for fingerprinting individuals.

The draft v2 of PECR contains an exemption for first party analytics. I think this maybe strikes a nice balance: explicit consent would still be required for the more-harmful third party analytics.

Not sure when v2 of PECR will happen. It is years overdue. Perhaps it is a priority for the newly elected European Parliament and the new Commission?

Re: How we built a GDPR-compliant website analytics platform without using cookies

#76

Post by JackWritesCode »

EGreg wrote: post #72
JackWritesCode wrote: post #50

Earlier quoted context omitted.

We have been GDPR compliant for many months but our aim here was to meet E-Privacy demands. We don't use localStorage... Read the blog post, we don't use cookies.

Oh, apologies, you are right! You don't use any kind of cookie mechanism. I just read it again: Random SHA256 String (daily regenerated) IP Address User Agent Site ID Day of the year My only question is about this "Random SHA256 String", where is it stored between requests?

Redis Cache. It's a Fathom-wide random string that is used to prevent rainbow table attacks. The salt is refreshed at midnight every day.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#77

Post by EGreg »

JackWritesCode wrote: post #76
EGreg wrote: post #72

Earlier quoted context omitted.

Oh, apologies, you are right! You don't use any kind of cookie mechanism. I just read it again: Random SHA256 String (daily regenerated) IP Address User Agent Site ID Day of the year My only question is about this "Random SHA256 String", where is it stored between requests?

Redis Cache. It's a Fathom-wide random string that is used to prevent rainbow table attacks. The salt is refreshed at midnight every day.

Thanks, makes total sense.

So basically the only drawback I see is that all employees from behind one corporate NAT using same browser will count as one user.

But don’t see a way around that if you can only use IP and User Agent strings.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#78

Post by vonmoltke »

kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

> because you cannot identify an individual by IP either

Yes you can, particularly if you correlate across different websites.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#79

Post by Matticus_Rex »

kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

They don't have any PII and are therefore not subject to GDPR. They have data that, if it were not anonymized, would be PII, but it's anonymized and therefore isn't.

Re: How we built a GDPR-compliant website analytics platform without using cookies

#80

Post by JackWritesCode »

vonmoltke wrote: post #78
kitchenkarma wrote: post #53

This is very weak reasoning, because you cannot identify an individual by IP either. This project looks like trying to exploit loopholes. The idea behind GDPR is to make sure companies log only data they need. This project looks into logging the data but without expressing why this is even necessary. Therefore I don't think this is compliant with GDPR.

> because you cannot identify an individual by IP either Yes you can, particularly if you correlate across different websites.

I remember when I learned that IP was considered personal information, I was shocked. But I thought about it and it does make sense.
Post reply on HN