Hacker News Reader

Comment by deofoo | Hacker News Reader

For those who look for an alternative https://plausible.io is a great replacement.

A nice list of many more analytics solutions: https://european-alternatives.eu/category/web-analytics-serv...

Plausible is OK but needs work. For example it isn't even multi lingual.

Or if you're after free analytics, Cloudflare has something. Should be GDPR compliant since they don't use cookies or local storage.

GDPR has nothing to do with cookies or local storage. They are just mediums that are potentially impacted by GDPR.

GDPR simply makes collecting personal data without consent illegal. This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

Also, requiring it when it is not technically required for the product is illegal. So even throwing up a splash screen for EU visitors with a single "allow all" button would be illegal.

The GDPR is actually a quite well designed law for what it tries to do, its just that enforcement lags behind.

> This is why a lot of American centric sites block us from accessing them, they want your data, and they don't want to ask for it.

Or they just think that the costs to adapt their solution, or any law infringement implications don't worth the effort.

You say "or" but then just give examples of what I said.

> law infringement implications

They comes from using people data in ways that you have no asked permission for. They don't want to ask for it because it's quite hard to spin "we want to mine your data for a Cambridge Analytica style social manipulation".

Adaption isn't that difficult, the cost comes from people saying no. They don't want to give that option.

yes, well I dont assume bad intention from every single website there, for some just dont justify the costs and possible headaches.

> You say "or" but then just give examples of what I said. > law infringement implications

No, you mean law infringement implications, like they actually selling your data, I mean some law office, running behind companies not compliant and trying literally money extortion against them.

See: https://blog.cloudflare.com/privacy-first-web-analytics/

I generally found much less accurate as something like Plausible, it seems Cloudflare default analytics are more like where requesting are coming from.

Found it*

> Should be GDPR compliant since they don't use cookies or local storage.

That’s not how it works. If there’s personal data being transferred to the US, you are in violation according to the Schrems II ruling. If you only collect non-PII, you should be fine. Make sure though that your definition of PII matches the regulator‘s definition.

GDPR is not about cookies or local storage. It's about knowing users' personal data and doing things with it.

The only personal data that you can get from HTTP requests without doing tracking or fingerprinting is the IP address, which Cloudflare also isn't using.

If data about EU citizen goes outside EU, it is illegal.

Cloudflare is also questionable when it come to GDPR. Lots of folks conflate privacy and cookies with GDPR. Compliance is much more than that.

Cloudflare Web Analytics is extremely simplistic and does not allow for any persistent identification of users or storage of personal information. It uses HTTP Referrers to count visitors and that's it.

One could argue that since it's a US-based company it can't be Shrems II compliant, but you can make that argument about a lot of things.

As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data.

You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data.

As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA.

https://medium.com/@christhaefner/shopify-illegal-in-germany...

Great for plausible.io of course. But what is the difference for the end user?

- GDPR: hosted in EU vs US, so your data is traveling less far. The things the plausible can do with the data is more or less the same.

- No cookies: don't see the point of that tbh, they will probably perform even more invasive tricks like finger printing to replace the cookie requirement

Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor.

It’s like two dudes developing the solution and more importantly, charging you for it. If you don’t see the radical difference in incentive structures, then I don’t know what to tell you.

Sorry, had a bit of time left today. Its more like 7 dudes, and their whole proposition is underwhelming TBH. Mostly gratuite statements against the ruling order. Half their website is a rant against the 'capitalist' competition. And the whole Christmas tree of doing good is exposed. But nothing really sticks:

- Simple and easy: wait until the product matures

- Open source: but no foundational governance, like Apache for example.

- Promise never to sell to investors, but nothing is in place to actually prevent that from happening. Note this common practice via a social enterprise.

- 45 kg reduction of CO2 compared to Google per average website(!): clear violation of EU law (2006/114/EG) in my opinion.

- They suggest to proxy their service to circumvent consumers who actively block traffic to plausible. This is OK, because they are good.[0]

[0] https://plausible.io/docs/proxy/introduction

> they will probably perform even more invasive tricks like finger printing to replace the cookie requirement

It's clear you didn't even bother to look at plausibles data policy [1] before assuming what it does and doesn't collect. The TL;DR: it does not fingerprint, and it does not collect any identifiable information, be it about your device or your person.

> Bottom line, the website visitors data is still logged, stored and tracked - only now with a different actor.

Only basic device info is logged (not even IP addresses are stored). And it's very easy to self host so that different actor may be yourself.

[1]: https://plausible.io/data-policy#first-thing-first-what-we-c...

I indeed do not know Plausible and any of their motivations.

Google Analytics also does not provide PII to their end users per se. But I have seen many tools and solutions do just about anything to circumvent that. Merging analytics with transactional data and site logs. Adding company info to visitor data. There is an entire industry there.

So, an imaginable use case would be to self host it. Intercept to circumvent the limitation.

The reason why I am so cynical is not because of the motivations of Google Analytics or Plausible. It is what motivates the end users, the companies who are using these statistics.

I do know Plausible, and their motivation is to make a sustainable business providing basic web analytics, which is why they charge for their service and Google doesn't. The data they provide to the users of their service is like an order of magnitude less detailed than what Google provides.

I get the cynicism about the industry in general since Google led this merger between web analytics and advertising, but there are plenty of providers in the analytics space that aren't following that path.

Plausible can also be self-hosted, unlike GA.

But then you still do the same thing, but you host it yourself. Meaning: it is installed and left running for years without updates and monitoring. I then rather have Google handle things.

Reply on news.ycombinator.com