I see so many websites – even club websites or private blogs – that have a cookie consent banner, but which wouldn't actually need one if they'd just turn off Google Analytics. I just don't get it.
Tories need this because of two reasons:
1. Brexit is hurting the UK economy
2. They need to distract from the Partygate scandals[0]
As for Google Analytics... I've talked with multiple clients who have wanted to improve site performance on their stores. The first thing I usually point out is the multiple overlapping analytics packages downloading multi-megabyte JavaScript files. Those are, of course, absolutely untouchable for whatever reason, and we just have to work around the most obvious performance flaws in their site.
The reasons why someone might tank their site performance with a bunch of conflicting ad trackers is not just because "data is valuable". We're conditioned to think of ad tracking as solely interest targeting[1] and remarketing[2], but a huge part of it is also just attribution. Advertising is paid for on a per-click or per-conversion basis, and nobody trusts nobody in this industry, so everything needs to be tracked or the people buying ads get gamed out of their money by the people they buy ads from.[3] So even if you just want to buy ads, you often also need to have tracking on your website purely so that the ad network can either protect you from click fraud, or if you're paying per conversion, actually track how much you owe them.
[0] For those who are not in the UK, like me: The scandal is the fact that the PM and his staff were running a bunch of illegal parties while the whole country was on COVID lockdowns.
[1] When ad networks track your interests to serve more relevant ads. As the ad buyer you can purchase ads based on these specific interest categories; i.e. "I want this ad to be served to 40-year-old men with an interest in cars"
[2] When ad networks track your history to serve ads based on what sites you've visited recently. This is actually a different thing from interest-related ads; it's more like "I want this ad to be served to anyone who has just gone car shopping".
[3] This is also why on-domain advertising will never be a thing outside of the big social media networks.
Thanks. I think this is severely understated. Ad people managed to force the debate to "customized ads" vs "privacy", saying that websites could make money exclusively with customized ads. We've seen here on HN a lot of examples of people realizing that was bullshit (I would guess there are some cases where customized ads can be beneficial, but overall they seem little).
Apple showed how to make attribution privacy-friendly (I have no idea whether there implementation works and scale), yet debates still manage to ignore that totally.
That being said, solving attribution doesn't actually... solve attribution problem. The reason being for the case where I search Nokia D3500 on Amazon, then I go on random website, which will show me ads for Nokia D3500 on Amazon, and I click on this ad to buy what I already planned to buy. In that case, the random website will get money, with current unprivate ads, while they won't with the private one. I didn't change my consumption based on that ad, so the ad has literally 0 value, "private-friendly ad" properly reflects that, however the migration from not private to private ad will reduce the revenue for websites (even though this didn't have any impact on my purchasing behavior).
Edit: It does solve attribution for "proper meaningful" ads: If I'm reading camera reviews on some websites, and they have affiliated links for those reviews, then they'll rightfully get money for it, whcih is good!
Actually, most are probably not even correctly following the law since the cookies will probably be set before the popup is accepted. For most, people just assume they need a cookie banner. I'm pretty sure I've seen cookie banners on sites that had no cookies.
There have been non-binding votes to split it up. And they can tell them to split up or be banned from operating within the EU.
I want to know how many people visited my website. So does every website. It's something that websites need to know. We use Analytics to handle that for us, and because of this silly EU rule we're all technically breaking the law by not bothering every single visitor with annoying popups.
Now there are in fact bad companies collecting data on individual people, correlating it between sites on the backend, and using it for nefarious purposes. Those are presumably the reason these stupid laws were passed in the first place, and it would be nice if they actually did need to show a button for you to click.
But since the law says that everybody needs to show that button or lose the ability to know how many people saw their site, you never know whether you're getting the button for an evil site or just one of the millions of other sites you visit every day.
I don't blame the evil companies even a little bit for this mess. It's the people who passed these terribly thought out laws. They'll keep passing more of them until we stop letting them.
That's because it is the most evil one of all.
Just because you're only using it for one piece of info doesn't mean you aren't violating your users' privacy by handing over a complete record of every site they visit to a company that uses it exclusively for evil.
You can do that easily without third-party tracking cookies.
I am assuming you need to do client side tracking for static pages though or you need to self host your static page.
(Disclosure: I used to work on ads at Google)
You're talking about the https://developers.google.com/analytics/devguides/collection... section, right? That's only for sites that are already using third-party cookies for advertising, has to be specifically enabled, and doesn't seem very applicable to our "know how many people visited my website" discussion? But my comment above was too broad, and I've edited it to point here.
> moving from third-party to first-party
GA, back to the Urchin days, has always been built around first-party cookies though.
If you do it right, a high proportion of your site visits leave no trace in your logs that they were ever there.
But Google Analytics is a 30 second setup, whereas setting up a log analyzer (or even getting logging going in the first place) is a much bigger hassle. Some of my stuff is on wacky Cloud Function hosting that I wouldn't have the first idea of how to go about logging.
Thus, nearly 100% of us just use Analytics. If they had an "evil" checkbox that I could uncheck to stop it doing whatever you're worried it will do, then I'd happily do so.
Frankly, I'm not sure what GA could do that would bother anybody. All it does is tell me how many people saw what page and how long they stayed there. It certainly can't tell me anything about you personally.
I don't have time to screw around with figuring out what uses third-party cookies, what uses browser fingerprinting, what correlates information across sites, and/or what tracks what how in general, nor to check all the time to see if any of that has changed. I'm just gonna block all of it, because it's not worth the investment of my time to make such distinctions. The most I could get out of it would be slower page loads.
Actually, I'm not even bothering to make THAT decision. My ad blocker blocks GA by default, and I'm not going to worry my pretty little head about unblocking anything unless something breaks.
It puts tracking cookies on your visitors which means you need a cookie banner.
And of course it invades the privacy of your users and slows down your site.
Apart from being a... very interesting take, how do propose to do this?
Not sure where you got this from. But GDPR absolutely does not require this.
I see so many websites – even club websites or private blogs – that have a cookie consent banner, but which wouldn't actually need one if they'd just turn off Google Analytics. I just don't get it.
He asked why we don't turn off GA. I explained.
Ultimately, some of these alternatives that avoid the cookie law are simply finding tech work arounds. I have no doubt in my mind that the gov would find a way to require popups for those services if they were more prevalent.
Isn't one of the incentives for Analytics, that by knowing your audience Google will be able to suggest your site to their search engine users?
I've heard more than once something in the lines of "we can't disable analytics as we'd lose traffic".
I've been in SEO for a while and there are a lot of myths but I've never heard anything quite this wrong before.
Besides, GA data is easily faked. I can give a site a low bounce rate or make it look like people spend a long time on a page. Google can't trust their own Analytics data because of this since it is client provided.
Sounds like a myth non-SEO people believe because, again, I've never even heard this before. And SEOs believe a lot of myths but this one is just too stupid
I mean, the burden is on both sides here but one has "been in SEO for a while".
People will do an update on their site, which includes removing GA, then blame GA exclusively for tanking their rankings. All of which is probably coincidental to an algorithm change that was going to de-rank them anyways
Urban legend clearly benefiting Google.
Also, my understanding is Google pretends like they don't really look at your traffic data and use that for search.
Each passing day the govnement becomes more and more deceptive
The cookie-blocking features in modern browsers (except Chrome, probably, haha) effectively make tracking opt-in anyway, don't they? The cookie pop-ups are pretty redundant today.
Not to suggest that this makes all the down sides of Brexit worthwhile, but it does make me happy that this can now be addressed. Cookie popups seriously harm the usability of the web and have been one of the most highly visible and ill-conceived pieces of EU legislation.
If you're using a menstruating-cycle app, GPDR will protect you against the app owner publicizing your name that you're pregnant, and thus protect you against anti-abortion mobs, if you wish to abort. A cookie banner wouldn't do that. Because GPDR is NOT about the cookies.
If we were to speak exclusively about tracking (which is, again, a very very small part of GPDR), even simply dismissing as a browser-side "feature" is yet another brainwashing win from anti-GPDR marketing. The number of ways to track people in a browser is infinite. From canvas rendering, to DRM, from cache leakage to window size. Hell, even the GPDR banners explicitly say so! Most GPDR banners now contains an option to allow site owner to fingerprint your browser to track you.
Considering the way we went with browsers (was it right adding so many features? I don't know. But the effects are there), we CAN NOT put this on browsers, it is technically impossible. If Google wants to prove the world that it is possible, fine, I'll grab popcorn. But at the moment they are not even trying.
So no, history has proven again and again that those privacy issues can not be handled technically. Only through regulation can privacy be preserved.
Absolutely. I'm not arguing against GDPR, which includes many important rights and protections that don't have much to do with cookies. I'm arguing against intrusive and pointless cookie pop-ups.
Browsers are generally only working on stopping cross-site tracking, but cookie banners are needed even for first-party cookies (ex: local telemetry, shopping carts).
See this earlier discussion: https://news.ycombinator.com/item?id=29530890
Mechanically if you add something into a physical shopping cart it will remain there forever until you take it out. But legally the pdf has the claim "a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours" [1] and to me that means indefinitely or a few hours.
[1]: https://ec.europa.eu/justice/article-29/documentation/opinio...
And every browser offers a private browsing mode which is more or less the same effect.