Hacker News Reader

Comment by wyager | Hacker News Reader

Can someone who works in commercial web dev explain how companies even end up with this much crap pulled into their websites?

View on HN

When you try to maximize ad revenue, you add multiple advertising SDKs to your website, each of which can often do live bidding with hundreds of ad/data brokers

You can usually check the ads.txt file on a website to see which companies are allowed to bid for ad space on there. For example, for dict.cc, the website in question:

https://dict.cc/ads.txt

The ones labelled "RESELLER" will probably share your data with even more ad companies.

How have I not heard about this. I am both impressed and horrified.

I am one of those.

It generally goes like this:

When we launch a site it is seldom more than perhaps Hotjar, Google Analytics, and two-three other services connected.

And then through the years product managers and other stakeholders gets sold on adding LinkedIn, Instagram, Meta, and so on. So we add those.

Next a specific service ”to better track the sales funnel from in-store salespeople to the web” gets added. Then another ”analyse the data quality versus bounce rate” tracker gets added. And so on.

Before long the developers have streamlined the process of adding new scripts/analytics/trackers that editors can add them on their own, and that is when the floodgates open.

two main sources

analytics: A/B testing, "if x does user click y"?, unique page visits, etc.

ads: integrating with an ad provider comes with hundreds of trackers, because they want to - know if you bought a product after clicking on an ad - show you targeted ads for shoes after you googled shoes - build a profile of you (age, gender, location, profession) to show relevant ads across different websites

Likely has little relationship to what is actually in the page. They had to do GDPR, didn't or couldn't spend a lot of time on it -- or had an especially conservative corporate counsel -- and ended up just getting a list of every company they've ever worked with, for any reason, "to be safe".

For most companies this can easily be thousands of partners, and going through that list and figuring out exactly who might get data in reality, through every possible permutation of workflow, is a horrendously expensive proposition.

You might be surprised how many well-meaning regulations leave even the best-intentioned implementers in an impossible situation.

> or had an especially conservative corporate counsel

And once again we shall see how being conservative sounds like it might save you money but costs you dearly in the long run.

Yeah, but again, see the other part of what I wrote -- doing it "right" can be insanely expensive, and so you get an incentive to be conservative.

I read what you wrote.

Ultimately that is what they are having to do though, it's just costing them twice as much by pretending that being conservative and not actually looking at the problem saved them.

Oh yeah, that combination of fear and lack of knowledge probably plays a big part. I was once involved with creating a privacy policy for a B2B(!) web application. What a farce. In the end, the process was cut short (counsel too expensive and not nearly familiar enough with tech). The resulting document was at least 50 % stuff the app simply does not do.

Advertisement.

Reply on news.ycombinator.com