Comment by AndrewStephens | Hacker News Reader

Comment by AndrewStephens | Hacker News Reader

Parent Full thread

In my opinion, the whole idea of a third-party analytics system as they are currently implemented is incompatible with the idea of privacy. As soon as more than one site uses the same analytics system, then the company running the analytics system has aggregate data that the user did not consent to.

As a site owner, it is disingenuous showing your users a banner that says "This site uses cookies to allow us to maintain state" while leaving out the part about "This site uses google analytics which allows Google to track you across sites and build nearly complete picture of every page you browse".

The smaller hosted analytics systems claim to be more privacy oriented but I don't trust them either. Even with the best of intentions, sooner-or-later they will be sold or pivot. The data is just too valuable.

I know that some sites live and die by close reading of analytics but most sites don't need anything as elaborate. I implemented a very simple page counter than I host myself but that is just for vanity. Most sites don't even need that.

I can only speak to Fathom (since that's my product), but we have no personal data to sell if we sold our product. We collect nothing about website visitors other than a tick in the aggregate data. So if we sold our business, there's zero personal information from website visitors on any of our customers dashboards that could be used against them.

Thats a great attitude but even assuming that I trust you (I mean, I am sure you are a great guy and all, but I don't know you), that is what you deliberately store and allow customers to access. Your log files contain IP addresses and agent strings, enough information to identify people with fairly high accuracy. What do you do with them?

> other than a tick in the aggregate data

What sorts of data items do you collect, though?

Our source code is open-source, you can view it here: https://github.com/usefathom/fathom

That's another way we're transparent. Anyone who knows code can see exactly how we collect data and what data we collect.

It's great but code on a GitHub repo doesn't mean that's whats running in production.

Note I'm not saying you are doing anything nefarious but that the source code been available isn't sufficient alone.

> Anyone who knows code can see exactly how we collect data and what data we collect.

What about people who don't know code?

Google Analytics uses first-party cookies and can be configured to not share data with other Google services. IIRC, that's even the default setting. That's nowhere near allowing Google to track you across sites. Google's advertising cookies track you across sites, though.

Reply on news.ycombinator.com