Hacker News Reader

Comment by heinrichhartman | Hacker News Reader

I like the app, but I am a bit confused by the data usage.

* As a starter: The source code is only a JS snippet. No HTML in there.

* Right away I "fullstory.com" appear in the JS. So I have reason to believe that all user interactions (mouse, keyboard, etc.) are uploaded to fullstory.com. Not sure this is actually the case. Certainly not in favour of it.

* In the network tab, I see requests to heapanalytics.io.

Setting aside the question if such data use is necessary, appropriate, or done elsewhere. I wonder if this is actually legal. I certainly did not consciously agree to my data being collected in this way and shared with third parties.

When you scroll down, you eventually see a Privacy Policy and TOS links in grey:

> By using this site you agree to the [Terms and Conditions] and the [Privacy Policy].

- Is a text like this actually effective?

- Am I violating EU law, if I use the same patterns in my Apps? (I am EU based.)

View on HN

This actually sad. People here understand why people despise these schemes and tracking yet still do it and post it here. Can't even blame marketeers or manager pressure.

- Am I violating EU law, if I use the same patterns in my Apps? (I am EU based.)

Most certainly, yes.

Creator here - that's a fair point, disabled both. That's what I get for taking a lazy shortcut.

Won't put them back without adding consent.

There's also a first-party cookie called "visitor", though that will require a bit more work because there's actual functionality that depends on it.

IMO first party session cookies aren't too big of a concern for the HN crowd - Being a web dev myself I know it's essentially a requirement.

It's those analytic services that we despise.

You're allowed first-party cookies that are necessary for your website to work.

The whole cookie banner and permissions things is partly a smoke-screen by advertising agencies to hide the fact that you don't actually need up front consent for necessary cookies. :)

It's depressingly funny how carefully some of those banners are worded.

"Cookies are necessary to make this site work. Click here to enable cookies!" Fine, but those aren't the same cookies, and mysteriously the website works just fine for me even if I kill the third-party cookies.

IANAL, but AFAIK it is a common misconception that cookies are a problem. They don't.

Closer to the truth is that tracking is a problem.

So as long as you don't use any tracking, you don't have to care about privacy consents. But be aware that simple things like assets hosted on 3rd party servers (e.g. web fonts) can be used to track your users by your partners. Furthermore, everything related to ads or social media is most likely being used to track users.

So if you want to avoid any trouble, host everything yourself and don't include any tracking/ads/social media. However, most likely you will still be required to have a privacy policy on your page if you have EU users.

EDIT: Btw. when I say 'tracking', I mean web tracking like Google Analytics, not time tracking (might be ambiguous in this context).

A question, since I have the ear of an individual who chose to add tracking to their small website: what exactly do you hope to get from these trackers? Do you think there could be some critical piece of information which could be gleaned from these logs which could help?

I associate trackers with megacorps where they're essentially playing Telephone between management and the boots on the ground doing the work ("we need tracking!" "ok, next on the work checklist is tracking, and here's a service that says it does that...").

We make a large, enterprise-targeted app at my startup. Fullstory has accelerated our search for product-market fit by allowing us to make some significant discoveries in how users use our app.

We could have made all these discoveries by properly instrumenting our code with our own tracking framework. That said, Fullstory provided us a big bang for our buck in [time spent : value provided]; half-day implementation led to all the usage info we could need.

We've gone as far as creating a recurring "Game Tape Friday" meeting where the whole development team sits down and watches 5-10 user sessions together to record bugs and possible UX improvements.

We're not a small website so this anecdote may be of limited value to you, but I would personally give up syntax highlighting before I would give up Fullstory.

Fullstory basically lets me sit behind the shoulder of every user and e.g. watch them use the app in a way I didn't think of, or stumble over the features that I thought were obvious but turns out are very counter-intuitive.

It's totally a game changer for UX design.

Heap, Google Analytics, etc are actually not as useful; I find the app's DB and server logs provide more relevant data. So I don't think I'll add them back.

Yes, it's a violation of GDPR to tell people that they're consenting. You have to ask them, and they have to perform an "affirmative act" - even a pre-checked checkbox is a violation.

The main relevant sections are probably:

Article 7: https://gdpr-info.eu/art-7-gdpr/

Recital 32 (explains some of the valid/invalid methods): https://gdpr-info.eu/recitals/no-32/

Cookies are the E-Privacy Directive, but it uses the GDPR standard of consent. Important nuance.

Reply on news.ycombinator.com