While I find it questionable that a government agency should be collecting analytics on its visitors in the first place, there are self-hosted analytics tools that they can use. One Google search turns up plausible.io which, even if its less convenient than Google would help with trust. It seems we've completely normalized the State conducting mass surveillance, tracking and metadata collection on citizens with the aid of corporate tech giants like Google.

The US government does run its own self-hosted analytics platform (https://analytics.usa.gov), which the USPS does in fact use. Which makes it all the more questionable that they were additionally using third-party analytics.

Offtopic, I chuckled that the top* city visitors come from is Ashburn.

That's definitely just a GeoIP database picking up AWS traffic.

* (in the last 30 minutes, as of now)

> The data come from a unified Google Analytics account for U.S. federal government agencies known as the Digital Analytics Program.

Well…

I don't think basic analytics is objectionable for a government org web service. I'd hope they'd be tracking "Do people use this? What kind of devices do people consume this site on? Is the page even loading properly for most people?"

This is analytics data.

Or maybe you'd call that "mass surveillance".

Sure, basic analytics is not objectionable. The issue comes from the analytics not being limited to basic things, as this post shows.

> I find it questionable that a government agency should be collecting analytics on its visitors in the first place

I don't agree with them using known abusers of personal data for the tooling, but this is what I was talking about.

I don't like them using Facebook for analytics, I don't know what they were getting from it. But the basic premise of analytics, I think they should do.

Sure, but the answer they gave to this reporter was the same usual corporate garbage response that included "we need analytics to market our products" (???)

I think it's fucked up that any agency is "marketing products" at all, but inasmuch as this is necessary in some way, surely they don't need the kind of surveillance marketing that's questionably even worth it for corporate advertisers to use. It literally reads like a google or facebook lawyer wrote it

i mean the entire last few decades or so people have been banging the drum that parts of government, like the USPS, should "operate like a business" or even be privatized. so this being an end result of that is not that shocking, unfortunately.

What's even sadder is that this is said in an economic and regulatory environment that has gradually winnowed away all the examples of businesses that made the argument even the slightest bit compelling if you squinted

The problem is that the USPS isn't really a "government agency". It's a weird hybrid where in some ways the USPS is more or less forced at act as a private company would. I agree that it's bonkers that a national postal service would need to "market its products", but the USPS is constantly facing funding issues (in no small part due to its weird setup), so they have to do something to... well, drum up business.

I agree that they shouldn't be using tracking code from Facebook etc. for their analytics, but they do need analytics of at least some sort. I think that should hopefully be uncontroversial.

That wasn't always true, and changes in that direction were made to a lot of government agencies, doing things like making them pretend their budget is a business and that they need revenue streams is nonsensical and doesn't work, and I can say that with confidence because every time such changes are implemented the value of the department goes downhill fast, to the point where some people speculate that the intention of such policies is to kill those agencies. I sometimes buy that, but I also think we should acknowledge that while neoliberal political projects are often cynical and greedy, they are also often the result of incompetence. I see a certain naivete in people whose core competency has been gaining power through social influence not knowing how to actually build systems that work

Some of us do in fact believe that the only way to avoid common issues with mishandling information is not to gather it in the first place. I see sides of the same coin.

Is Matomo not suitable?

I believe at least one French government website uses Matomo, based on the fact that I once used their React snippet to make it work.

Matomo is pretty solid. And you can always use it just to ingest the data, then analyze it with something other than the default dashboards.

Security and similar audits are a big deal in government. Or, at least, they were...

And now you see why the GDPR requires a site to list the third parties involved.

https://www.royalmail.com/privacy-notice and the cookie policy, 3.4.

I must be missing something. Their list of who they are data with is vague such as "other organisations if this is necessary as part of providing services to you or them."

I suppose it is nice that they tell you that they may send your name, contact information and purchase information to market research companies?

Still, I'd expect the government's bean counters to ensure that any usage of third party analytics involves some ironclad agreement to the effect of, "If you fail to meet <Herculean privacy desiderata>, then we f---ing own you", so at least the government gets something when said third party inevitably violates the agreement.

Except it was the government agency that violated their agreements by providing this data. At least Facebook, based on their response, specifically put in the agreement that this sort of data should never be provided. It seems like the proposal of consequences flows the wrong way here.

Imagine believing this wasn't the product of corruption and nobody got kickbacks for letting this "mistake" happen.