Hacker News Reader

Comment by gbalduzzi | Hacker News Reader

I don't know about Umami, Plausible describes how they solved this here: https://plausible.io/data-policy, under the section "How we count unique users without cookies"

TL;DR: They derive an identifier from IP address and User Agent using an hash, allowing them to have a tracking identifier without storing Personal identifiers (the IP address)

View on HN

This seems like a worse approach to me than a cookie.

My IP and UA don’t change, pretty much ever.

I can delete a cookie anytime I want.

They salt the values and compute id = hash(daily_salt + IP + UA). Then they remove those every 24 hours. I think it sounds like a perfectly reasonable solution.

If they remove those every 24 hours, then doesn’t that mean if I made two visits, separated by more than 24 hrs, it would count as 2 unique visits rather than 1?

Yes. I am still not aware how to track returning visitors if while still staying within some privacy framework. Unfortunately on HN the default answer is to say not to track at all.

You mean fortunately? Because that's the only correct answer.

Creating a fingerprint like that will become a personal identifier under the various privacy rules

I was under the impression that this is the exact kind of thing that violates the GDPR. That is.. processing an identifier (IP address) to do something more (track user actions across multiple requests) than what is required (route traffic to the server).

Reply on news.ycombinator.com