Google Analytics Opt-Out Browser Add-On

tools.google.com

That doesn't do what you think it does. It only excludes your data from being included in Google Analytics reports that website owners "end users" see. All your data still goes to "the borg" as if nothing has really changed.

You need to block the domain completely using a privacy tool plug-in for your browser.

Source?

According to Google:

> This add-on instructs the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) running on websites to prohibit their information from being used by Google Analytics. Using the Google Analytics opt-out plug-in will not prevent site owners from using other tools to measure site analytics.

https://support.google.com/analytics/answer/181881?hl=en

I've heard that the reason it sets a variable rather than blocking the script is to avoid breaking websites that do custom tracking.

I believe the key phrase is "being used by". If they weren't reporting it, they could use the stronger "being reported to Google Analytics". Or "being collected by".

Also note that by singling out Google Analytics, it's possible that the data might be collected and used by other Google tools, just not GA. Depends on how much mental gymnastics they are willing to do.

Of course, the best thing would be someone just looking at the actual javascript and seeing what it does.

I'm pointing out that "Google" and "Google Analytics" are separate and that when your data is collected "Google" gets it, processes it and then pushes the refined data to "Google Analytics". The raw data is used in the "internal API" (Which is different than the public APIs that you are familiar with). Both your source and OPs are referring to "Google Analytics" (which is the public part that webmasters see).

This appears to be pure unfounded speculation. Can you provide anything to back this up in any regard?

It's not speculation. Are you asking for more of a deeper explanation of how the internal API works, or do you want to see published papers/links about it? Google doesn't publicly document the "Google Analytics Internal API".

Please provide some evidence of this claim as it relates to this extension:

> when your data is collected "Google" gets it, processes it and then pushes the refined data to "Google Analytics".

You are asking for a publicly available document showing the architecture of Google + Analytics + Doubleclick + Adwords... I can't get that, but other than doing experiments; you could do what I did when I first found out which is go ask someone who works on the internal API. (That's what I did)

I run a custom DNS server with the domains blacklisted on there so any device on my home network is covered.

My set up is dnsmasq, which can issue DNS rules based upon the servers /etc/hosts file, and then Someone Who Cares hosts file[1] which has trackers and many other unwanted web nasties added to the loopback address.

And as its just hosts files, the thing is trivial to fully automate so once a week I pull the latest list of banned domains.

There are also other services like Someone Who Cares, some tailored more specifically towards Windows and some tailored more specifically to blocking ads, or malware, etc.

[1] http://someonewhocares.org/hosts/

Good options for real privacy:

Privacy Badger from EFF The extension is designed to automatically protect your privacy from third party trackers that load invisibly when you browse the web. We send the Do Not Track header with each request, and our extension evaluates the likelihood that you are still being tracked. If the algorithm deems the likelihood is too high, we automatically block your request from being sent to the domain. Chrome: https://chrome.google.com/webstore/detail/privacy-badger/pke... Firefox: https://addons.mozilla.org/nl/firefox/addon/privacy-badger-f...

Ghostery from Ghostery, Inc Block over 2300 request from Advertising, Analytics, Beacons, Privacy and Widgets lists. Quick, easy to use and configure. There business model isn't all that great, it's selling data to advertisers if you want to optin for that. Chrome: https://chrome.google.com/webstore/detail/ghostery/mlomiejdf... Firefox: https://addons.mozilla.org/nl/firefox/addon/ghostery/?src=se...

There are others but they all have a downside. AdBlock (Plus) but has terrible business model which let advertisers buy back adds, uBlock (Origin) super quick AdBlock fork but with terrible interface and Disconnect which also has a terrible interface.

It takes a bit of learning upfront, but uBlock's Advanced User interface[0] is actually quite good if you're looking for NoScript-style site-by-site configuration. It's certainly not going to work for all users, but it's worth a look if you can grok the interface.

[0] https://github.com/gorhill/uBlock/wiki/Advanced-user-feature...

> AdBlock (Plus) but has terrible business model which let advertisers buy back adds

How is that terrible? (this is not their business model in reality) Do you not agree that by using these features you deprive sites of revenue? Adblock believe that unintrusive ads should be permitted to allow free sites to remain free.

This is a perfectly reasonable position to take and it is unfair of you to attack them.

Adblock is unfair because the "unintrusive ads" aren't that - they are just "companies who have paid more to have their ads shown - ads". I would say that's both unfair and terrible because a) it disavantages smaller players in the ad market (decrease in choice is bad). b) Who determines which ads are "unintrusive"? - that's a qualitative property. But then again it has become a product that does not do that - it's not actually blocking ads now.

> a) it disavantages smaller players in the ad market

How?

> b) Who determines which ads are "unintrusive"?

Adblock

Adblock was recently sold to an undisclosed buyer[1]. They told users of the switch the same day they started the "Acceptable Ads" program. I don't want someone I don't know controlling which ads bypass my ad blocker..

[1] http://www.businessinsider.com/adblock-gets-sold-acceptable-...

> I don't want someone I don't know controlling which ads bypass my ad blocker..

Then I think your only option to remain logically consistent is to not install any ad blocker.

I think there is a big difference here between distinguishing "is this an ad? y/n" vs "is this an allowed ad? y/n"

Because what people want from an ad-blocker is an affirmation of their logical consistency, and not "blocked ads". Uh huh.

To be precise, you don't want someone whose interests oppose your own controlling the ads. I don't use ABP, but paid "acceptable" ads make them a straightforward protection racket, beholden to advertisers who can pay. Google and the other big players can buy them off for pocket change, so they're useless.

> Google and the other big players can buy them off for pocket change, so they're useless.

Why do people post this nonsense. Their use is to block intrusive ads. They are very clear about it and every argument against this has been incredibly misleading.

Whether payment is required or not isn't even clear, because it is mentioned only as a potential.

Like many others, I use an ad blocker at least as much to protect privacy as to reduce annoyances and malware. ABP's criteria for "acceptable" say nothing about tracking, so while they're a step in the right direction, they're mostly irrelevant to me.

The obvious conflict of interest from making payments even optional for advertisers makes them clearly untrustworthy.

Answer to "How": (Copied from another comment of mine) a) The smaller company would have lower margins because they invest much more in superior materials, QA, R&D, etc. Where the larger company has an advantage because they invest more of their margin on ads

Regarding Adblock: b) I posted another comment elsewhere about how choosing which ads are "acceptable" or not presents challenges. There is a lack of objectivity. It should be a choice between ads or no ads.

It's terrible in the same way that selling vegetarian food which allows "unobtrusive meats" in the ingredients if a farm pays them enough money, would be terrible.

If Adblock Plus believes that sites should be able to make money from advertising, they shouldn't make an Adblock product. It's a total conflict of interest.

It's like a bank vault company allowing selected criminals through the vault doors because they believe the poorest in society have a moral right to take from the rich if their situation is bad enough, as defined by the vault company.

It's sleazy.

I'm using RequestPolicy. No downsides I'm aware of?

> uBlock (Origin) super quick AdBlock fork

uBlock Origin was written from scratch, it's not a fork of AdBlock.

> with terrible interface

I disagree. Out of the box, the UI is mostly a big button to toggle it on/off on a per-site basis, suitable for all users.

Advanced users can have access to a point-and-click firewall (including with per-site rules), I can't think of anyway to make it simpler, and this is a feature that most other "blockers" do not even have.

The opt-out doesn't really do anything: http://www.unrest.ca/google-analytics-opt-out-not-really

Yes - good resource. All of Google's TOS/Privacy-Polcies are so full of vague and misleading legal speak (on purpose of course), I'm not surprised that OP was tricked.

>>I'm not surprised that OP was tricked

Actually, I wasn't. I know what to expect from Google, but I am not a developer and wanted to see the response from professionals about this plugin.

> All of Google's TOS/Privacy-Polcies are so full of vague and misleading legal speak

Please provide 3 misleading examples.

Everything is debatable of course, but pretty much on page 1 of Google's privacy page, I see:

We collect information to provide better services to all of our users – from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful

I object to "ads you'll find most useful" being ok under the category "provide better services to our users". If you accept the premise that better ads are useful, then pretty much everything Google does is for your own good.

This is not misleading in any way, your only disagreement with it is on principle.

Even given that, I must say, the idea that better ads are not useful is probably fallacious

What are better ads? Are they ads that really connect with you? Do they change your behavior in some significant way? What makes ads better for the consumer? What makes ads better for the marketer? My answer is that what's good for the marketer is not good for the consumer. Google is optimizing for the marketer (getting better ROI). As long as consumers are told the ads are "unintrusive" they must be good too right? When marketers have a really strong ROI, they can get their ads out there and influence customer behavior. That type of influence is not good - and does not make it better for consumers.

They explicitly state 'more useful'. That is the metric they are using, better ads are ads which are more useful.

For example. Until a day or two I did not know the 'MX Master' mouse existed. An advert for this would have been useful.

Useful and obtrusive are not mutually exclusive. Is it useful to have only large companies with large ad budgets peddle a slight iteration to their product line as "the next best thing", while smaller companies with a really great (superior) product don't get the exposure. The smaller company would have lower margins because they invest much more in superior materials, QA, R&D, etc. Where the larger company has an advantage because they invest more of their margin on ads. Note: I have an "MX Performance" and I would not recommend that line of mice no matter what the ads originally said.

Are you looking for examples of entire policies or do you mean misleading sentences? Are you not sure why I find them misleading (based on OPs example, et. al.), or do you disagree and find them to not be misleading?

Either / or. Google's policies are written in plain english and are extremely straightforward.

The reason I ask is that it sounded like an unfounded criticism made up by someone without adequate research.

chestnut-tree, earlier in this thread wrote up some great examples.

No unfounded criticism here; lots of research in this area. I'm not sure why you feel it sounded that way.

"Please provide 3 misleading examples."

Google's privacy policy is not misleading but they omit some of the most important information you would expect to find in a privacy policy.

When you sign up for a Google account you give Google your name, date-of-birth (DOB), location and mobile phone number. This is some of your most private and personal details. If you're signed in to your Google account while you browse the web or use your Android phone (or you use the track-everything-you-do Chrome OS), then Google records your browing habits and activity against your account. In many cases, that also gives Google some very private and personal information about you. It's no exageration to say that they know more about your online habits than you know yourself.

Given that, Google omits in their privacy policy:

- how long they keep your activity data before it is erased. Is it 6 months? 12 months? Forever?

- whether they disassociate your identity from your browsing behaviour or web activity when they look at it (i.e is the data anonymised before Google's staff view it?)

- related to the above: who sees your data inside Google? Their Privacy Policy simply states "We restrict access to personal information to Google employees, contractors and agents who need to know that information in order to process it for us and who are subject to strict contractual confidentiality obligations." This is too vague in my opinion particularly when you consider the gargantuan volumes of data Google collects about you.

Let me put it another way: if I asked you for your name, DOB, mobile number and location and then recorded your online activity against that information, wouldn't you expect me to tell you who sees your data, whether that data is anonymised and how long I keep that data about you?

> When you sign up for a Google account you give Google your name, date-of-birth (DOB), location and mobile phone number. This is some of your most private and personal details

> Information you give us. For example, many of our services require you to sign up for a Google Account. When you do, we’ll ask for personal information, like your name, email address, telephone number or credit card to store with your account

They include that.

> Google records your browing habits and activity against your account

Also clearly explained in the Chrome privacy policy:

> If you sign in to Chrome browser, Chrome OS or an Android device that includes Chrome as a pre-installed application with your Google Account, this will enable the synchronisation feature. Google will store certain information, such as history, bookmarked URLs as well as an image and a sample of text from the bookmarked page, passwords and other settings, on Google's servers in association with your Google Account

> - how long they keep your activity data before it is erased. Is it 6 months? 12 months? Forever?

I agree this would be nice to have more details on but they do detail some of the complexities involved and refer you to specific services pages for more information.

> whether they disassociate your identity from your browsing behaviour or web activity when they look at it

This appears to be really part of your next question:

> related to the above: who sees your data inside Google? ... This is too vague in my opinion

Can you give me an example of a way this could be made less vague in an acceptable fashion? I'm struggling to think of a way they could give me relevant information.

> Let me put it another way: if I asked you for your name, DOB, mobile number and location and then recorded your online activity against that information, wouldn't you expect me to tell you who sees your data, whether that data is anonymised and how long I keep that data about you?

Personally I'd make the decision ahead of time. I do appreciate your point, but only a portion of your post is valid as they are quite clear on a couple of the points.

There's a large difference (imo) between 'misleading' and 'not thorough enough'.

A couple concepts here: Associating data with your account: This is misleading, because the bulk of information about you isn't associated with your account. Rather, it's stored in other silos associated with a non-account identifier (consider this a way to make it easy to serve more targeted ads to people who don't even have a google account). This non-account identified data can be enriched by account data (when there are co-occurrences of account activity along with non-account identifiers).

The policy is vague and misleading because they should write: "We go to great efforts to track everything we possibly can about people's behavior on the web. We've configured algorithms to connect all the dots and make information about you (found in Service A, Service B, ...) useful. So useful that we can determine enough about you to tailor your online experience in order to influence your decisions when it comes to purchases, brand recognition, political leaning, etc." And follow it up with: "We do this even when the influence we have over you may harm your best interests, for the purpose improving ROI for advertisers" (Obviously this line is not conducive to the policy itself, but rather a blunt explanation of the effect of it which people are categorically unaware of)

The policies don't even explain that there is a difference between people seeing your data, and algorithms acting on your data. (Algorithms acting on your data are much more effective than when people do so. But that explanation in this case is lacking - it makes it seems like it's not all connected together, but in reality it is because of how databases work, and how disparate data sets can unique identify a person with enough data)

Thanks. That article was posted in 2010; does anyone know if it's still accurate?

Yes, it still works that way. (Downloads both the JavaScript file and the pixel)

The article completely disagrees with you. Why did you post an article that doesn't say what you claim?

OPs linked article reinforces his point. The opt-out doesn't work- because they are not opting out and data is still being sent. (nevermind how that flag is set and Google is learning more about you despite your traffic no showing in webmaster reports)

That is completely false. That is not what the linked article says.

edit: Two years ago the parent poster said this:

> Full disclosure: I've been working in analytics since 1999 and founded a web analytics business

And is currently posting what appear to be completely made up claims to this thread. No conflict of interest has been declared here.

From OPs article: > the google analytics blocker does not stop your browser talking to google-analytics.com. Period.

That excerpt explains that it's not actually stopping any data from being sent. Thus it's not actually opting out of sending data.

Thanks for researching my comment history and establishing me as an authority. Not sure why you are saying that my insight is a conflict of interest here. I'm not promoting any products.

The website clearly states it does stop data being sent:

> Whats missing? Well, the original referrer. My google search. Well, it does appear that installing the GA.js blocker stops that info from going to google directly, however.

> Not sure why you are saying that my insight is a conflict of interest here

You are making false claims about a competitor without revealing that they are indeed a competitor nor that you have a long standing grudge against them.

That data is being sent on the original load of the Javascript file. Please refer to this section of the article: "To summarize: When google opt-out is enabled. Google still collects." (you will see a list of all the data including the original referrer)

The part that you are quoting is for a different product by Google. "googleadservices.com"

>"You are making false claims about a competitor without revealing that they are indeed a competitor nor that you have a long standing grudge against them."

I am not making false claims. Please hold the heavy handedness until we have reached an understanding.

This opt-out works for me (add to hosts file):

  127.0.0.1 www.google-analytics.com 
  127.0.0.1 google-analytics.com 
  127.0.0.1 ssl.google-analytics.com

What about the doubleclick domains and adwords domains which feed the same data into the same system too? And what about when they launch a new domain? (Would be difficult to keep up with those changes)

Use own root and cache DNS instead of HOSTS. Then use wildcards, e.g.,

  *.doubleclick.net

Tool to automate that: https://github.com/jakeogh/dnsmasq-blacklist

The question is: what is listening on 127.0.0.1?

For example, do you have an httpd listening on 127.0.0.1? Do you bind any other daemons to 127.0.0.1 or the broadcast address?

If you operate your own root you can reassign the authoritative nameservers for doubleclick.net to nameservers you control. You may or may not choose to return "A" records.

Hopefully nothing is on 127.0.0.1:80/443, that way webkit gets a RST back, which I assume is faster (and less error prone) than serving a dummy page. I'll add a note to the README.

Edit: Added a --dest-ip option

"...serving a dummy page."

It could also be less than a page. It could be a dummy resource. For example, in the case of an ad server and a smartphone app that has some screen space reserved for ads. You might want your own resource to appear in that space instead.

Another example is reverse engineering API's and protocols for popular web services, social media, storage, etc. In that case you might want a "dummy server" that serves certain responses.

Interesting. Does --dest-ip[1] solve this?

[1] https://github.com/jakeogh/dnsmasq-blacklist/commit/554e20a3...

I just use NoScript.

Be careful because the Google Analytics code (newest version includes a noscript section that loads an iframe within it) - No script will not block that.

So, uBlock then. Set 3rd-party, 3rd-party frames, and 3rd-party images to default-deny. As above, you can effectively block GA even if the noscript loads an iframe if you can block that iframe.

Or, if you are a serious, no-nonsense paranoiac uBlock even allows you to block 1st-party and inline scripts.

The world is your oyster. Block with reckless abandon! Watch the world burn! (mostly kidding with that last one)

Yes, UBO+NoScript has made browsing much more pleasant.

> Be careful because the Google Analytics code (newest version includes a noscript section that loads an iframe within it)

No it doesn't[1]? What are you referring to?

[1] https://developers.google.com/analytics/devguides/collection...

The tag manager does. The code you are linking to is a developer reference for the raw tracking code.

The tag manager has a "noscript" tag that points to an iframe with the domain googletagmanager.com

What about RequestPolicy?

Opt out? This should be the default.

In an ideal situation, Google tells the user that in order to provide optimized recommendation services, the user must enable certain options. These options could include the reporting of browsing behavior to Google. They could also include storing X bytes of information on Google servers for at most Y days, where X and Y can be chosen by the user.

"Don't let the fox guard the henhouse."

(unless the "fox" is Firefox, and even then you should be using 3rd party privacy extensions like Privacy Badger or Ghostery)

What's the advantage of this over blocking tracking stuff with adblock? Or other extensions like disconnect.me?

I doubt there is any (for the user). While there are many benefits to keep using an ad blocker.

This news concerns me a bit, as a project manager for a SaaS web app that uses GA to generate user activity reports for data around things like "# of users who clicked on link X" or "users who completed a survey". I'm not a dev, and we hire an outside web dev company to build the web app and reporting dashboard.

Can someone more knowledgeable than me indicate if a user with this add-on enabled will be throwing up zeros on our analytics when they use the software as a logged in user? I know Ghostery blocks GA, but it's niche enough that I don't worry about a critical mass of our target demographic using it. But this seems like an official Google add-on, which makes it much higher profile to average users.

It makes it so no data generated by a user ever reaches Google Analytics's server, so: yes, they will be zeroes, except if you use other tools to account for them.

This is false. The data goes to google's servers, it is just not reported to the webmaster.

Upon reading the article, you seem to be correct.

Your report will have 0s for those users. Ideally your SaaS web app should use another tool for tracking analytics data instead. Google is a bad choice because you are basically tagging all your customers as "Dear marketers, please advertise to these people because they are interested in product X". Say hello to even more churn. (And not to mention more competitive ad-buyers when it comes to user acquisition)

Consumers concerns relating to Google analytics are valid, but the companies/sites hosting them are harmed significantly worse.

"For Internet Explorer, 3rd-party cookies must be enabled." Sounds like it activates a bunch of other stuff that the kind of person who would want to "opt out" would never want.

I find this to be more of a PR stunt that says "Google tries to care about privacy..."

With every change they make to Google search, they put more value on a site's user experience. Now they take away data that is used to improve user experience... smh

If GA users are abiding by their terms and not collecting private info, why is this necessary? Punish all b/c we don't feel like investigating who is actually wronfully collecting private info?

But if it was a PR stunt wouldn't it have more design to it? It looks like some kind of legal compliance thing, not something they want to get any attention.

Could be both. I looks like it was just made a long time ago with older design standards. It is commonly used in discussion & feature comparison to make people think that they can opt out. Even implying that webmasters have some control over their data (which they don't have)

It's more than a PR stunt - it's actually misleading people into thinking that there are tools which can reduce or block the data that is sent to google - when in fact this tool doesn't do that at all. This tool only stops the data from being added into the reports that the webmaster sees.

More irony: is that private browsing without cookies will disable this feature all together. I know right?

The biggest loser in this whole thing is the startup/webmaster who has google installed on their site.

"The requested URL /intl/en/analytics/learn/privacy.html was not found on this server. That’s all we know."

I still hate this 404 message.

Edit: maybe I didn't make it clear enough that that was what I saw after clicking on "Learn more about Google Analytics Privacy »".

Are you on a non US or non English "IP"? Google does this stupid geoip work then 404s pages for other regions. For instance, their solar rooftop calculator thing just 404d in IPs they think are in Central America. It's a dumb and weird way of handling things, though no doubt someone got a raise for that feature.

Yes, I'm in Bahrain! Thanks for the explanation.

Actually, I'm in the US and I also get this 404. It's been a while since this add-on has been made, so that the link is broken isn't too surprising.

I've had pretty good luck with: https://addons.mozilla.org/en-US/firefox/addon/gdc/

This may seem like a silly question, but why would someone want to do that? Google Analytics is basically anonymous traffic and demographic data for web site users. Why does anyone care?

Here's a A summary of some of my previous comments on this: The bulk of information about you isn't associated with your account. (or in some personal way) Rather, it's stored in other silos associated with a non-account identifier (consider this a way to make it easy to serve more targeted ads to people who don't even have a google account). This non-account identified data can be enriched by account data (when there are co-occurrences of account activity along with non-account identifiers).

There are great efforts made to track everything we possibly can about people's behavior on the web. Algorithms connect all the dots and make information about you (found in Service A, Service B, ...) useful. So useful that we can determine enough about you to tailor your online experience in order to influence your decisions when it comes to purchases, brand recognition, political leaning, etc. This is done even when the influence we have over you may harm your best interests, for the purpose improving ROI for advertisers.

So the idea of "anonymous" data really isn't that, and the real issue is how that data is used against you. This is true both for an end user, as well as a company using google analytics on their site (losing customers, classifying their marketing sources for advertisers on doubleclick, etc.)

"Don't be evil," Google.

Reply on news.ycombinator.com