Hacker News Reader

Comment by a_c | Hacker News Reader

Would love to hear HN's opinion on tracking. I was of the camp that all tracking is bad and should be banned. But one day I re-realized, website owner, having access to the server (e.g. nginx), can always track their visitor if they wish to. So maybe the problem is third party tracking instead of tracking? What do you feel if a website doesn't use any 3rd party tracking, but analyse visitor usage pattern using nginx/cloudwatch/any sort of logging provided by the tools essential in running the services?

View on HN

You were right initially. First-party or third-party is not a useful distinction from a privacy point of view.

If you want analytics, anonymize first and then use whatever tracking you want. But first price that your anonymizing is really effective, even if they results in less precise tracking.

> First-party or third-party is not a useful distinction from a privacy point of view

It is a huge difference. There's one thing to have your data stored on a server that only one person has access to, and they are obliged to respect strict privacy laws and a completely different thing to have your data sent and shared to hundreds of companies that can use that information for various marketing or analysis purposes.

Late reply.

I really disagree. Whether the cookie shows under a dns name or another means next to nothing as to who is doing the tracking. If I'm not mistaken, Google Analytics is now pushing to have all cookies served by a front domain, hiding from the user who the third parties are. I may be wrong on this, have not done my research yet.

I agree with you, but my comment was not regarding the DNS, but the legal entity having access to your data.

There's one thing to send your data to Google and accept for it to be processed by them and all their partners and another thing to send your data only to the company that owns the website that you are currently visiting and only allowing them to internally use this data, without it being sent or processed by any 3rd parties (as strictly specified and regulated by the privacy laws).

To make it clearer: If the company knowingly breaks privacy laws by secretively sharing data with 3rd parties and using domain cloaking/redirecting to hide this fact, that's a different issue.

I think it's a huge difference between:

A. I track visitor stats and usage details and send all the details to Google and their partners (which enables them to create a profile of the visitor across the web, have in-depth stats about your website's traffic, traffic sources, sales, visitors demographic, use the data to target specific or groups of visitors or share it with your competitors or other companies for marketing purposes).

and

B. I track visitor stats and usage details, store them locally and use them to improve my website.

That's why GDPR complying webservers either disable logs or keep them on a rotating 30 day basis (a real legitimate interest to have insight into potential DDoS attacks).

Now you can take a guess how many actually do either of those two things... I would not even put it at above 1%.

Reply on news.ycombinator.com