Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

I am wondering when Google will get around to providing better "out of the box" support for GPDR. I should be able to get UI to let users opt out, and see/delete data, as easy as installing GA in the first place.

Most of my projects are non-commercial, but they still usually have GA, GA tends to be the only thing I have that requires GPDR attention, that I'm aware of anyway.

View on HN

Why add GA then? It's user hostile and there are better and more compliant ways to track basic analytics.

I believe that simply disabling IP address collection is enough to be GDPR compliant with Google Analytics: https://developers.google.com/analytics/devguides/collection...

Some people think so, it is not entirely clear. Perhaps it has to get more clear that it's not for Google to do anything about it though, if that's their theory.

https://adzerk.com/blog/gdpr-google-analytics/

The challenge with GA today is that the default code that Google gives you includes Tag Manager, and they encourage you to include DoubleClick as well (can't remember if that is in the default).

If you go out of your way, you can implement GA, by itself, the "old way"--which is GDPR compliant out of the box. It's Tag Manager and DoubleClick that are not.

I always find GA docs/instructions confusing, but when I try to see what current GA instructions tell you about how to include GA in a page, I get this:

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=[ID]"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());

      gtag('config', '[ID]');
    </script>

Is that the "old way" or the "new way"? Maybe it's an even newer way, which is essentially similar to the old way?

That’s the new way, including the illegal Tag Manager.

The old way would load the JS from https://ssl.google-analytics.com/ga.js instead, and set different options.

What about Tag Manager violates GPDR in special ways GA does not?

That's the new way, which comes with Tag Manager, which is a technically a separate product at Google.

Here is how to implement Google Analytics by itself:

https://developers.google.com/analytics/devguides/collection...

No it's not.

I can't talk for other countries, but for France, the local DPA explicitely said so[0]!

Loose translation: "The analytics tool do not fit within the consent exemption when their provider reuse data for their own profit. That includes most big analytics service available (see for exemple Google Analytics confidentiality policy)"

[0]https://github.com/LINCnil/Guide-RGPD-du-developpeur/blob/ma...

Reply on news.ycombinator.com