News for hackers. Stuff that matters.

A comment on Google Analytics 4 Has Me So Frustrated, We Built Our Own Analytics Service.

Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by justinzollars on Wednesday May 17, 2023 @03:05PM (#35979756)
I recently gave google analytics 4 a shot. I actually had the thought that I had more access to information, and my analytics were better in 1998. Its a disaster.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by londons_explore on Wednesday May 17, 2023 @03:08PM (#35979791)
Because google analytics 4 sticks to the gdpr...

your analytics in 1998 did not...

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by habibur on Wednesday May 17, 2023 @03:17PM (#35979906)
1998 analytics used Apache log files as the only source.

Wondering if Apache log files are GDPR complient or not.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by justinzollars on Wednesday May 17, 2023 @03:36PM (#35980151)
1998 Apache log files were wonderful. I could see everything.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by influx on Wednesday May 17, 2023 @04:28PM (#35980850)
Urchin, the company Google acquired to make Google Analytics could process Apache Log files. It was really great.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by justinzollars on Wednesday May 17, 2023 @08:38PM (#35982928)
sounds like an awesome company for its time!
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by londons_explore on Wednesday May 17, 2023 @03:22PM (#35979969)
Most GDPR experts will tell you that traditional log files aren't compliant. They contain personally identifiable information (IP address), and you didn't get consent from the user before collecting it, nor are they required to provide the service the user requested.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by vince14 on Wednesday May 17, 2023 @03:42PM (#35980237)
https://gdpr-info.eu/recitals/no-49/

> Network and Information Security as Overriding Legitimate Interest

> stopping ‘denial of service’ attacks

Storing logs with IPs is no problem at all.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by mpeg on Wednesday May 17, 2023 @04:02PM (#35980513)
Storing the log files (or IP addresses in general) is not a problem IF you're using them only with a legitimate interest basis.

For instance, you can use this stored IP address to help identify whether your user has had their account breached, and prompt for extra verification before letting them log in. You can also do a full browser fingerprint for this purpose, this is all covered under legitimate basis.

However, once you use any of this data to market to the user then you are in breach of the GDPR as you did not have a consent basis for it. The storage was never a problem, it's the use of it that becomes a problem.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by cccbbbaaa on Wednesday May 17, 2023 @04:26PM (#35980821)
You're mostly right, but legitimate interest also require balance. Fingerprinting may be considered to be too intrusive if logs are enough.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by mpeg on Wednesday May 17, 2023 @06:02PM (#35981823)
Depends on the product, payments products generally use fingerprinting and present extra prompts if you're using an unknown device – that is kind of one of the main problems of the GDPR though, there are nuances and it's usually not white and black what can be done without specialised legal counsel (and sometimes, even then...)
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by justinzollars on Wednesday May 17, 2023 @04:11PM (#35980620)
Sounds like there could be an opportunity here for a GDPR noncompliant analytics product. Personally, my customers are in the United States and I don't want ambiguity in my analytics because of Lawyers who reside outside of my jurisdiction.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by LunaSea on Wednesday May 17, 2023 @05:39PM (#35981598)
If your customers are of a European nationality you will need to comply as well.
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by mpeg on Wednesday May 17, 2023 @06:04PM (#35981844)
Technically correct, but arguable... There are lots of UK and EU-based companies that blatantly breach the GDPR and get away with it as the regulatory bodies don't have the resources to chase after every breach at home, let alone abroad.

Unless you are a huge company or have a significant amount of customers in the UK/EU it's probably okay to ignore the GDPR.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by LunaSea on Wednesday May 17, 2023 @05:37PM (#35981579)
Your interpretation is incorrect.

You have the right to log IP addresses only if they are used for the two purposes you listed, otherwise you will need explicit consent.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by cccbbbaaa on Wednesday May 17, 2023 @03:53PM (#35980395)
CNIL disagrees and says you can need them to secure your service. Legitimate interest (art. 6(1)f) is applicable (recital 49). You can also be required by law to keep them for some time, so legal requirement is applicable (art. 6(1)c). Other uses may require consent.

Cf: https://www.cnil.fr/sites/default/files/atoms/files/recomman... (in French, though)

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by whstl on Wednesday May 17, 2023 @04:32PM (#35980902)
Exactly. It's not just about what you collect and store, but also about what you do with the information.

You can collect them as a legal requirement, or for "legitimate interest" purposes such as fraud prevention. But you can't use this data for analytics without proper consent.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by mpeg on Wednesday May 17, 2023 @06:08PM (#35981875)
Contractual basis too, is often the easiest way to collect and store PII. Eg if you have a contract with someone you can often store a lot of their data to fulfil the contract.

There is meant to be a sense of proportionality, but as many things with privacy laws it's subject to interpretation and intentionally left vague.

[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by alex_lav on Wednesday May 17, 2023 @03:21PM (#35979951)
A quick google search suggests GA4 is not GDPR compliant
[ Parent | on HN ]
Re:Google Analytics 4 Has Me So Frustrated, We Built Our Own... by streptomycin on Wednesday May 17, 2023 @05:36PM (#35981564)
Nah a lot of it is weird UI decisions. Like to view what browser versions your users are using, in UA you just go to the browser page and click the browser and it lists the versions and number of users. In GA4... good fucking luck, you need to make some weird custom report where you need to select the right parts of your data and tell it whether they are "metrics" or "dimensions" or "rows" or "columns" or "values" or "filters" or "segment comparisons". It's a nightmare. And it's like that for basically everything other than the premade UIs, which feel like they are oversimplified and targeted more towards apps than websites. Generally it feels like I'm using a product made by people who hate the Internet and wish all their website users would go away, but hey it's free...
[ Parent | on HN ]