Don't be coy. Call it what it is - an analytics service.

And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

In what way? I agree that personally tracking an individual and using psychology tricks and whatnot to trick them into buying stuff is bad, but if it's just a company knowing what works well for them, I don't see the argument.

> when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party

Retail stores also use your shopping data to target you with ads. Credit cards also obviously sell your purchase data to anyone willing to pay for it. I wouldn't be surprised if retail stores even sell your cash purchase data to any third party willing to pay for it.

Information is valuable, but it is not holy.

Analytics isn't that. Analytics is tracking a customer walking into the store and looking for which store they came from. Analytics is noting down how long a customer spent holding a blue item, if they looked at a big red item, and noting it down because it might matter. Analytics is seeing how the customer went back and forth between one aisle and another. Whether looking at one item made them less inclined to look at the next. Analytics is hoarding all of that information and keeping it even if the customer doesn't make a purchase.

Of course stores have been looking at how and why and when customers shop for years, but through consensual studies. They learnt to put the fruit at the entrance and the sweets at the exit. They learnt to put their high value items at eye level. And they didn't do it through spying and analysing the behaviours of everyone walking through their doors. They didn't keep years of CCTV with the sole excuse that they might want to see how long you lingered between deciding on diaper brands.

The web has no excuse.

How, you don't enter your name when you pay with cash.

Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first.

Edit:typos

You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint".

"Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash"

And the store person will then what? Open excel wnd write "a dude with glasses was ehre at 12:51"? and then send the file to 100+ partners?

>You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint".

So the physical stores have some shady dudes attempting to lift fingerprints from money then some statistics guy try to put probabilities on which fingerprint matches which anonymous guy?

here in my country you still pay with cash and the store people put it in a machine combine it with money from other people, it will be a lot of work and risk for some shitty nano reward.

Edit typo

it is cash, not cache.

(By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)

Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so those "partners" take a quick look?

If they want to send you a letter, they have to give your data to the postal service. Again, no consent needed.

This is legal because our whole economy is based on devision of labor. Privacy laws account for that.

My problem is with the 100+ partners that are OBVIOUSLy not partners and not required to have my data.

False equivalence, no online stalking company actually works like that (that would require a server-side hook). They all make the visitor go to the third party's desk and increase the tally themselves (via http request), giving the tracker company access to all the contact details of the visitor.

Before the internet, the owner took a shoe box of receipts to their bookkeeper every month. Those receipts had your name, date, etc. on them.

How, when I buy stuff in real world and pay with cash I don't ask for an Id Card, so why do you think the store needs names on the receipts? Is this something that happens in your country? For buying cars,land you need an Id, if I buy even an expensive electronics no Id is needed I just return the product and the receipt that has no name on it back.

I remember when my grandfather was doing accounting for a bar before Internet days, they papers were about the stuff not about people, like how many bear was bought, how much was sold stuff like that.

GDPR requires data sharing to be done for a defined purpose.

The purpose of sharing data with an external company bookkeeper for bookkeeping is not remotely connected to any purpose an analytics service fulfills. So while the shared data is capable of the same insights, it's explicitly illegal for it to be processed that way without a defined purpose (which is it's own can of worms).

>entirely anonymous browsing data

It's never entirely anonymous, because how useful data is, is inversely related to how anonymous it is.

ergo it would only be truly anonymous if it was truly useless.

Can you ask your bookkeeper to tell you the top 3 best selling products for your top 5 customers without declaring that the purpose of the data transfer to the external bookkeeper is also to run sales analytics?

> top 5 customers

You probably have to declare that the data is processed for that purpose in general terms but I don't see why consent would be necessary. Anyway, this analytics service claims it doesn't do this kind of analysis.

This is very unlike the accounting firm, which never receives any identifying for cash transactions and thus couldn't store it even if they wanted to.

It's still a difference between not having data and not storing it. The later needs trust, the former doesn't.

I think you are wrong. What they receive is a set of purchases in a given period of time that allow them to make many important decisions (when people buy most, what purchases are more likely on a given date etc.) but there is no way of finding out my shopping habits.

The issue with all the tracking is that most consumers have no choice, no functional UI to interact with the tracking systems, and no clear idea of who they are ultimately transacting with.

With enough good data (so probably not in all sectors) you can also identify people out of the system.

There are not that many bits of entropy in (contextualized) human behavior.

Sure, it's technically possible. But if you would actually do that, you run afoul of the GDPR requirements for informed consent: retroactively identifying people in a dataset requires the same consent as targeted data hoovering, so if an individual has only consented to being included in anonymized statistics that practice is sure to get flagged down as unlawful.

Extreme case: you are the only person that ever buys product X around time Y, so that fact can be used as an anchor to build a profile.

You need to be way more paranoid if you want to be a true privacy warrior.

I think the element you're missing is - of course this is OK, it happens all the time. What the comment you were responding to before wasn't making clear is that when it's done, there must be contractual provisions limiting the service provider's use of the data, so they can't use it for their own purposes.

There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics.

[1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-g...

[2] https://docs.simpleanalytics.com/what-we-collect

I'm OK with websites using self-hosted tools such as Matomo as long as the data never leaves their servers. Analytics is important to any business. But I choose to do business with said business, not with Shopify, not with Google, not with Facebook or Twitter (I'm looking at those "sign in with" widgets that run social media code in my browser) or whatever 3rd party "SaaS" service the website is outsourcing my data to for ease of development or convenience. I don't consent to my data being shared with people I don't know about and did not consent to give a single shred of my information to.

What you're asking for would require a fundamental restructuring of the internet, and of software business models, and a lot of other stuff. I can't see that happening any time soon.

In the meantime you can try using Tor, but good luck not getting blocked on half the websites you want to visit - and you can't blame the website for that (they need DDoS/spam defence).

[1]: https://europa.eu/youreurope/citizens/consumers/internet-tel...

This is kind of ridiculous in the cloud era, isn't it?

The analogy with external accountant up this thread is a good one. It's not about where data are processed, it's about how it's used.

But I agree with your conclusion: what matters is how it's being used. In this case - whether you share/sell it to others or not.*

[*] But not only: it also matters if you take adequate care in protecting personally identifiable information or not.

The problem with Google Analytics here is not that it's a third-party but that it's under US control.

So do you want “we want to load JS from a CDN like literally everyone does, is that okay” popups on every website?

- reduces the number of TCP connections - reduced the risk of failure if the relevant edge node can't be reached

Browsers don't support cross-site caching of 3rd-party content so whatever limited benefits there might have been of using a library CDN are long gone

It's about getting jquery physically closer to your users. And sure upload it to your "own" CDN that you pay Azure or whoever for.

I be willing to bet that most web developers don't know about how the browser cache is partitioned

And most people don't know that it never really worked (apart from perhaps a few Google fonts)

Well, carry on and load it, it's your server.

Oh, wait, you mean you want ME to load it, into MY browser? That's a problem - my browser only loads JS from the origin server, and only if I give it explicit permission.

As a developer, I deplore the use of CDNs to serve javascript libraries; you don't know what the CDN is going to serve to your users, it could change without warning and break your site.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Neither is widespread. Leaving users, especially vulnerable ones, to the whims of businesses.

Privacy isn't a "technical matter".

Better to protect the people from all the bad companies, not just the ones who do business in the EU, right?

And no: the GDPR isn't just about GA, and it isn't just about the internet; it's about any personal information.

It's not against the law to just walk in; or rather, it's the civil offence of trespass - you can sue the trespasser for damages, e.g. causing wear on your expensive carpet (but you'd have to produce evidence of monetary damages). And you can physically remove them, perhaps with the help of a bailiff. But the police won't help with common trespass - it's not a crime.

[Edit] At least, that's how I understand the law here. IANAL.

The internet is just not designed for privacy at a technical level.

The Internet is A-Ok.

The issue lies with various slimy companies that exploit web developers ignorance, laziness and negligence with free and easy shortcuts in exchange for the private data of said developers' clients.

No one's forcing you to use CDNs in place of a properly setup caching. No one's stuffing Google Fonts down your designer's throat, they are just lazy to add local resources. An analytics service is not required and there are simple self-hosted options. And so on and so forth.

And the most infuriating part is that these companies, Google being the offender, know perfectly well that they are exploiting the ignorance and they are willingly facilitating and encouraging the spread of practices that would've been viewed as wildly unethical not 10-15 years ago.

Just look at the level of general erosion of privacy and nearly universal lack of concern for it in general population. If you reflect on it for a moment, it is plain fucking scary.

Arguably, they provide code that can be run in your browser, but your browser chooses to run it. And since your browser is a user agent, you choose to run the code by way of installing and configuring a browser that makes that choice by default.

You might never know that they backfeed data into external analytics services. Under this assumption, wouldn't you need to stop using _any_ website, at all?

It's not an "also" analytics service. It _is_ an analytics service.

If a website poped a question saying "Do you consent to your visit data being passed to Simple Analytics for processing?", how many people would say Yes? Close to zero. Just look at the stats on 3rd party cookie refusals - when done easily, the refusal rates are in high 90%. People may be lazy, but they sure as heck know they don't want to be tracked IF it's actually mentioned.

So what you offer is a GA alternative that makes website operators feel better about themselves for not using the GA. The situation with the visitors remains exactly the same - the still getting shafted with something that none of them wants.

The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it.

This is an argument taken to a naive extreme. You can't expect every business to also be in the business of analytics, it's not realistic. There's a reason companies have business partners who specialize in certain services.

It's why you have accountants, lawyers, marketers, etc.. Not every company can afford to have all these specialists on payroll, so you work with a service provider that lets you afford the services in a fractional way. You give them access to your data, including customer data sometimes, and in return they provide you with insights and information from that data.

Analytics is just another service provider like that.

You should of course work with a reliable and trusted partner that treats your customer data appropriately and has strong privacy guarantees.

The problem with GA is not "third party", it's "third party that uses my data for its own purposes" because that's the actual cost of using a free service.

Saying "no third parties at all" is not how businesses have operated since forever.

Privacy-respecting analytics should be self-hosted. No one's arguing against an average business using an analytics service, but that shouldn't be bundled with any "privacy" monickers.

If Simple Analytics were pitched as "not a Google Analytics", this would've been perfectly fine. But they insist on the privacy angle and it just demonstrates they don't grok what tracking concerns are about.

You're clearly a tech person so maybe it feels self-evident or easy for you to do that, just like taxes and law seem self-evident to accountants and lawyers, but the average business owner doesn't have time or money - or the skills - to figure all that out on their own, so they hire a service provider.

Do you think accountants and lawyers come to the business and work on their computers exclusively? No, they receive copies of the confidential business data and work on it within their own business environment.

And do you think accountants and lawyers don't include "privacy" in their pitch?

How is that different from analytics saying "we will keep any data you share with us private, and for your use only".

Based on your argument, as a business owner I should purchase and co-locate my own server, because even if I self-hosted my analytics, I'm storing that data on a third party server owned by my hosting provider!

Does US law require accountants and lawyers to give the NSA access to their customers' data upon request, with an automatic gag order attached? If it did, would it still be OK for non-American companies to a US-based accountant or lawyer?

No, and that's the point I was making! It's a fallacy to say "all analytics providers are selling my data". That's not true, it's Google.

OP was claiming that any third-party analytics are unacceptable, simply because of how Google operates.

That's the discussion in this subthread.

Don't put words in my mouth. I was not claiming that.

Third-party analytics _that bill themselves "privacy-first"_ are still not what any user would consent to voluntarily, so the "privacy" angle is largely irrelevant. What they should be billing themselves as is "not Google Analytics", which will be factually correct and somewhat relevant.

> Don't put words in my mouth. I was not claiming that.

You stated that only self-hosted analytics were acceptable. Your exact words were:

> The only way to do analytics in a way that's respectful to the visitors' privacy is with an installable on-host software. That's it.

This implies - to me - that in your view all third-party analytics are unacceptable from privacy perspective.

I'm not sure how else I was supposed to parse that statement?

Either way, I disagreed with that, and said it's certainly possible to work with third-party service providers, of many kinds including analytics, while still respecting your customers' privacy.

The difference with GA is that GA offers to fill this need of website owners for free while it actually processes and sells the visitors data for immoral ends. The whole "the customer is the product" deal.

I don't understand why simply sending data from one server to another is seen as such a big deal, the problem with Google and Facebook and the rest is how they build extremely detailed personal profiles that they use to cause social harm. Surely that is very different from tracking which pages get the most views or how much time - on average - people spend on your website?

The only real advantage Simple Analytics has here is that they aren't Google, so they aren't as much of a political target and don't have deep pockets to attract legal predators on the lookout for an oversize payout—which is a pretty thin justification for treating them any differently.

The advantage of a service like Simple Analytics remains; it does not store or process any user data.

How is that more respectful? I can fingerprint you pretty much the same with server logs (IP, user-agent, ...), don't I? I can even use cookies without any JS.

In this case, Google is non-compliant but the gp's service/tool does appear to be. I think you're underplaying the distinction here quite severely.

TL;DR this is about what's illegal, not what's "evil".

Matomo is the privacy-friendly analytics tool that comes to my mind anyway.

(I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)

I agree with you though.

If you walk into a grocery store, and cameras record which aisle you walk down, which items you stop to look at and which things you buy. Is that legal?

What if the cameras block out your face and all identifying features. Is that legal?

Do you own a blob of a person walking down an aisle? Does the grocery store?

In the EU, this would fall under the same data protection regulation as websites, and other local regulations regarding camera surveillance. In short, a store owner can't just secretly record customers.

Do they have to get explicit consent from each customer and save that info for audits?

Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surprising.

Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0]

[0] https://news.ycombinator.com/item?id=30135264

If you can read German, you can look at the Austrian decision directly, the complainant has uploaded it at [1] and the relevant section is D.2 b) starting at page 27.

[1] https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...

> In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States.

This is an accurate description of GA's pseudonymous identifier. It is not accurate as a description of an IP address. And if CNIL meant the IP Address, they would have said so, as they did in other rulings.

This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.

Peace mission.

Why are anonymised IP addresses still considered "Personal Data"? Is it because Google is doing the anonymisation?

0: https://support.google.com/analytics/answer/2763052?hl=en

The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient.

The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date.

Minor nit - "PII" really isn't the right term to use, because it suggests the info itself must be personally identifiable to an individual. The GDPR covers much more than this, and uses the term "Personal Data".

e.g. Google could make Google Analytics compliant (likely by, as you say, housing EU data in Ireland), but it seems that currently they are not.

Also, beyond the physical colocation of data, there are ancillary issues around data being readily accessible (either by internal engineers/agents or external authorities) from outside the EU to consider as well.

https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat... (2016) and https://en.wikipedia.org/wiki/CLOUD_Act (2018).

If so, it might end up in court again, and we'll have to see how that precedent gets set out. Will be curious to see how this plays out.

I suspect the issue is rather that Google Ireland are not in fact exclusively housing EU data within Ireland (or the EU in general).