With server side tracking you're not able to identify and properly track non-logged in users. GA (and other client-side tools) take care of this, via cookies.

Additionally, a common argument is that the server side logs contain a lot of logs from bots/crawlers and GA (and alike) can filter them. The other side of the coin is that GA (and alike) are not able to track users with Adblockers.

They also ensure that you need the annoying popup to consent to tracking to comply to the law, rather than doing no tracking and not annoying your users.

You can set a tracking cookie when the user first accesses your website without needing them to log in.

For the vast majority of sites I would bet using IP address alone would be enough to track enough users individually over their single sessions to be statistically useful.

Does anyone have any experience? How bad does CG-NAT mess this up over a large enough cohort of users?

It's a problem introduced at least in part by SPAs. When the application runs entirely in the client browser, save for a few API calls (that may be shared between multiple pages) it's difficult to tell which pages are actually being viewed, unless you have the client application report back to you (or to Google)

Easily addressable by including a header like x-from-page where you declare which "SPA route" the backend requests were made from.

Marketing teams with large budgets.

Not that they actually get questioned properly about actual stats, but they can confidently say they have GA set up and it’s showing some numbers, so just trust us.

Google is “trusted”. Why would the person setting their budget put faith in some hand rolled/open source solution ?! /s

I've worked at an web agency creating many websites for mid-sized companies (million of views each month). My conclusion is that it is about feelings. It feels good to know you have some data about your users, even if you in most cases are not going to look at it. If someone hire someone to look at it then the findings are not acted upon.

The best way to get feedback is to talk to your users face to face, or do a questionnaire.

The question I have isn't why you need analytics but why you'd ever need any PII in the data. I don't care whether Bob clicked the button I only care whether 1% or 50% of users click the button. Or if those who clicked button A are likely to click button B so they should be closer together. Analytics should be anonymous usage statistics not tracking individuals. We are clumping two things together where one is bad and the other is useful and mostly harmless to integrity.

That’s the idea but to know that an anonymous user who has clicked button A goes on to click button B requires you to track that user via some kind of random ID that uniquely identifies their browser/device. This new Swedish ruling says that ID is itself PI.

How does the ruling come to that conclusion? How does an ID that uniquely identifies a user but can't be used to trace back to a physical person be PII?

Reading the linked rulings it seems like it's not the IP (even though it's only blanked at the last octet) but rather other cookie values, which may in turn be traceable to the user?

Of course if a cookie value is sent and in some other system that same cookie value is stored next to a user's name, then that cookie value is definitely PII and can't be sent via GA, that much I understand.

The key passage from the longest ruling (DI) seems to be

Dessa identifierare har skapats med syftet att kunna särskilja individuella besökare, såsom klaganden. De unika identifierarna gör därmed besökarna på Webbplatsen identifierbara. Även om sådana unika identifierare (enligt punkt 1 ovan) i sig inte skulle anses göra enskilda identifierbara, måste det dock beaktas att dessa unika identifierare i det aktuella fallet kan kombineras med ytterligare element (enligt punkterna 2–4 ovan) samt att det är möjligt att dra slutsatser i förhållande till information (enligt punkterna 2–4 ovan) som medför att uppgifter utgör personuppgifter, oaktat om IP-adressen inte överförts i sin helhet

Basically: the random ids aren't enough by themselves, nor is the IP, but the IDS together with partial IPs and something else is.

I don't know what the bottom line is though. And that worries me a bit. Any analytics will be at risk of doing this. In my desktop app analytics we blank IPs etc, but just storing some hardware data (ram amount, cpu freq, windows version, screen resolution...) means that we eventually have enough entropy to say with certainty that each user we have has a unique set of parameters in the data we log. It's almost impossible to NOT fingerprint perfectly if you gather even just basic hardware and OS info, for example. But there is of course zero chance that we could use the data backwards and say "ok which single physical person is it that has a 16 core machine and 16Gb ram" making it "not PII"?

What makes you think it’s legal to use those log files for that purpose? ;)

> Who needs analytics? I'm confused.

SEO and Marketing Dept. of any company.

Back in the day before responsive design, I loved having stats on things like screen resolution you couldn’t otherwise get from server logs. You also get stats on keywords driving traffic to individual pages.

It's just something data goblins like to collect and obsess over instead of making an actually good product.

The questions is not just if the raw data is available ( Google Analytics also has the data accessible in Google BigQuery) but if business stakeholders have the ability to easily access the data and drive decision making.

You need an interface that visualizes the data and decentralizes access and analytics as much as possible.

Since Google Analytics is free and more or less part of one of the biggest marketing stacks (Google Ads) you will find a lot of marketing stakeholders with at least some knowledge of the tool. But perhaps the landscape will change with the very rocky start of Google Analytics 4