Hacker News Reader

Comment by gnicholas | Hacker News Reader

Appreciate the feedback! Regarding analytics, I think this is some A/B testing, which I don't think is even active in the current version (though still in the sources).

More importantly, we don't tie GA or any other usage analytics to individual users. We basically just use it to see where the extension is used and where people are blacklisting sites. We use this data to make the extension run better on more sites. We don't monetize user data in any way. You're right that we should make this point more salient. In our Privacy Policy, we do describe how to opt out by blocking GA, but we should put this somewhere more prominent.

Thanks for the feedback!

View on HN

> we don't tie GA or any other usage analytics to individual users

You may not identify individual users but Google probably do...

> we should put this somewhere more prominent

You should make it opt in by default. Or stop doing it!

> You should make it opt in by default. Or stop doing it!

What? Can you post some examples of sites that already do this? Everybody has analytics on their landing pages, and I don't think I've ever personally seen an opt-in.

What you can find are thousands of examples of site policy pages that say something like: "by choosing to visit our site, you are sharing information with us that we log for the purposes of improving our customer experience. By using our service, you agree to this logging. If you don't want to be logged, then please don't use our service."

IANAL, but have worked on GDPR a fair bit.

Google Analytics is already GDPR compliant, as long as:

* you are not pushing any unencrypted customer data to them in the clear

* you're careful regards who has access to your Google Analytics data

You can (and most businesses will) argue that you need to know how your website is used. It's a completely standard practice that doesn't put user privacy at risk. Moreover, Google has already offered an opt-out to Google Analytics globally, and you would be covered by that. As such, you don't need them to opt-in.

This isn't about law it is about ethics.

I wouldn't like it if someone followed me around meatspace with a clipboard all day. I don't like it online either.

That's not the best analogy - it's more like someone has two chairs in their waiting room and they note which chair is more popular among people waiting, so they can replace the worse chair with a copy of the better one.

Except that this business saves money by allowing a representative of a third party to take the notes. The third party then notes down who sits in the chairs, follows them into the appointment and follows their client to the next business and do the same there.

We're totally open to making this opt-in. I'm curious how we should gather usage data, which some of our nonprofit funders require us to report for their impact questionnaire. How can we know how much the tools are being used if it's opt-in? Or are there other systems (other than Google) that raise fewer concerns?

I really appreciate all the candid advice in this thread and hope that we — and others in similar situations — can use it to improve our products.

A few other meandering thoughts, you'll need to be the one to figure out what makes sense.

- You're already not getting data from people with ad-blockers, consider also respecting Do Not Track[0] - Be transparent about what you track and how it's used - The data collected from opt-in users might end up being enough to build convincing enough reports for impact questionnaires? - Your privacy policy seems confused: "We think the best way to ensure that your personal information stays safe is to never collect any in the first place" then "we only use Google Analytics, which gathers information about our site users and generates aggregate reports to help us figure out who is using our site and extensions, and in what ways"

[0]: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...

Reply on news.ycombinator.com