I don't care about one web site doing their analytics. It becomes a problem when one analytics company is building a profile across many sites.

Unfortunately, Cloudflare is in a position to do just that, just like major analytics providers.

Cloudflare doesn't make their money by selling user data to advertisers - I'll start worrying when they do, or Google starts doing this.

I mean, it's pretty clear they're gonna be able to do this very easily once cf analytics becomes widely adopted.

Maybe not yet, but the simple fact, that there even is a Cloudflare "analytics", hints at a direction, in which this will probably develop. Some people inside Cloudflare will think "If only we could sell our analytics data, we could profit more!" and then they might just do that. The temptation is huge for them. Lets be realistic. They are not all idealistic developers at Cloudflare. It is a huge business with lots of unethical people working at it, like in many big businesses. At some point some internal pressure might overwhelm a minority fighting against it and the change will happen. Perhaps it will happen step by step, slowly boiling the frog.

FULL STOP: Cloudflare Analytics sells their data to Teradata.

https://www.teradata.com/Resources/White-Papers/Price-Perfor...

Uh, no.

[Counter-]Citation, please.

I am Cloudflare's CTO.

then you probably may want to talk to your marketing branch, you know, before you may get caught with your pants down … at something like a congressional hearing … or something.

What has that Teradata whitepaper got to do with Cloudflare?

I agree, the problem is not each site storing stats about their visitors, it's one site storing stats about all the visitors across many websites.

If any network gets significant market share (like Google or Cloudflare), they can probably still follow you around by correlation of IP, user agent, routing location etc.

I think there's some confusion about what Google Analytics does. It doesn't really engage in browser fingerprinting. It only tracks down to the individual session.

Is that what they're slurping?

Or just what they're showing you?

I work in marketing systems administration. I've had access to over a dozen GA implementations, some for Fortune 500 companies.

It doesn't remotely do what people in this thread seems to think it does. Which is bizarre given you can go set up an account for free and see for yourself.

They seem to be confusing it with some of the third party ad tracking software. But GA is really dumb as a brick (and that's a feature, not a bug).

> I've had access to over a dozen GA implementations, some for Fortune 500 companies.

The concern isn't about what GA gives to its implementers, it's about what it collects internally.

Google is an advertising company and has a financial incentive to stalk everyone. Their bad faith implementation of the GDPR consent flow (which IMO does not actually comply, but the regulators are incompetent or unwilling to enforce the law) proves it. The current regulatory environment doesn't do enough to discourage non-consensual data collection, so given this fact and the company's past history we need to assume the worst until proven otherwise.

They can keep GA dumb as cover and do their dirty work with tag manager or fonts.

If you have a static IP (afaik, I do) it can be used for fingerprinting.