Plausible Analytics: GDPR Compliance w/o Cookie Consent Banner

by bugfactory • 2 years ago

145 137 2 years ago

jsheard• 2 years ago

Obligatory GoatCounter plug: https://www.goatcounter.com

It's also cookieless, the hosted version is free to use within reason, and it's extremely lightweight if you choose to self-host it. It doesn't even need a separate database, it can run self-contained with SQLite (or Postgres if you prefer). A good fit for small sites where the big industrial-grade solutions are overkill.

Sephr2• 2 years ago

This service claims to not track personal data, yet their docs admit to storing hash(siteID + User-Agent + IP) + seen_paths on their backend for session tracking.[1]

Sites can track sessions without tracking personal data.

1. https://www.goatcounter.com/help/sessions

justmedep• 2 years ago

„ In comparison, in the context of the European GDPR, the Article 29 Working Party[6] considered hashing to be a technique for pseudonymization that “reduces the linkability of a dataset with the original identity of a data subject” and thus “is a useful security measure,” but is “not a method of anonymisation.”[7] In other words, from the perspective of the Article 29 Working Party, while hashing might be a useful security technique, it is not sufficient to convert personal data into deidentified data.“

https://www.gtlaw-dataprivacydish.com/2021/03/what-is-hashin...

inhumantsar• 2 years ago

right below that the docs also say that this hash is not persisted, only cached in memory and mapped to a UUIDv4. The UUIDv4 is what persists between sessions.

The IP address and User-Agent are never stored to the database or disk, and there is no conceivable way to trace the random UUID back to this. It’s only stored in memory, which is needed anyway for basic networking to work.

I can't say whether that is GPDR compliant but it's definitely not storing the hash

yunohn2• 2 years ago

Sites can track sessions without tracking personal data.

Could you detail how that would work?

yreg• 2 years ago

I like Umami: https://umami.is/

LorenDB• 2 years ago

Currently using Umami, but I've considered switching to Plausible due to Umami's less-than-stellar development performance (e.g. breaking the site details page for a few days recently).

8organicbits• 2 years ago

Also happily using hosted GoatCounter. Last year I noticed some occasional operational hiccups, like service brief downtime, but this year it's been completely stable as far as I can tell.

D13Fd• 2 years ago

I used to like simpleanalytics.com but their site has been very slow lately.

kstrauser3• 2 years ago

Plausible is very nice, but it lacks much of the information from Matomo (like “after viewing /foo, visitors tend to view…”). Matomo is very nice, but it lacks the free Google Search Console integration (“people are currently finding you from these Google searches: …”) from Plausible.[0]

I’m vain and curious enough to want to see the Google data, but not so much as to pay $160/yr for the Matomo plugin for my personal blog.

[0] This isn’t the same as Google Analytics. You can get this information without installing a tracker on your site.

jgalt212• 2 years ago

you can fill in this hole with Google Search Console.

https://search.google.com/search-console/about

It's not perfect, but it is free.

kstrauser3• 2 years ago

Yeah, that’s what I do now. It’s not as convenient as having it integrated directly into the stats, but free sure beats $160 for my hobby blog.

bugfactory3• 2 years ago

Plausible can fetch and show the used "search terms" if you connect it to your Google Search Console.

kstrauser3• 2 years ago

Right, but Matomo can’t. Matomo has more information otherwise, but Plausible does that part well.

Ameo3• 2 years ago

I'm a very happy self-hosted Plausible user for years now. Solid, simple, and easy to maintain.

bugfactory3• 2 years ago

Did you use the hosted version, too? I wonder if it is possible to seamlessly switch between hosted and self-hosted.

Ameo3• 2 years ago

I've not tried their hosted version no. I doubt that there would be a seamless way to switch between them since all the data lives in Clickhouse, but I could be wrong.

dustedcodes3• 2 years ago

How are you self hosting it? I find its requirements extremely heavy for a simple analytics solution. It requires a PostgreSQL and Clickhouse database. I don't find self hosting Clickhouse particularly easy. Wish they had an option to just use SQLite as an alternative.

ayuhito2• 2 years ago

I completely agree that the self-hosting story for Plausible is overkill for most websites.

So much so that I made my own that focuses on self-hostability using SQLite and DuckDB (no external dependencies, can run on a 256MB VM): https://github.com/medama-io/medama

Ameo3• 2 years ago

I use the docker-compose setup they provide. There are only two containers iirc, Clickhouse and their web server.

Stuck it behind a NGINX frontend and it works just fine.

a1o• 2 years ago

Can I use plausible in a desktop application? I would like to have an idea of exactly which versions of an open source desktop app I maintain are being actively used so I know what to pay attention and invest efforts as I would like my users to be constantly migrating forward - we do have like 20 years of backwards compatibility so we push things forward very slowly.

ioseph• 2 years ago

I don't see any reason why not: https://plausible.io/docs/events-api although you'd have to come up with your own user-agent

clone1018• 2 years ago

I was able to do it pretty easily with a mobile app, should be just as easy on desktop. You could even register custom “pages” for various parts of the desktop app.

https://github.com/Glimesh/glimesh_app/blob/main/lib/track.d...

Nursie• 2 years ago

Cool. Perhaps companies and governments (gov.uk I'm looking at you) could consider using this stuff instead of forwarding all their public interactions to an unaccountable US corp.

XCSme2• 2 years ago

Or better if they choose a self-hosted solution.

ChrisArchitect• 2 years ago

Anything new here with this editorialized title?

Their most recent blog post:

Things I hate about GA4

https://plausible.io/blog/things-i-hate-about-GA4

(https://news.ycombinator.com/item?id=40904139)

bugfactory3• 2 years ago

No, nothing new. I recently discovered Plausible myself and was more than happy to delete a few Cookie Consent Banners. That's all ;)

pdyc2• 2 years ago

Let me plugin my tool as well. Please give it a try https://easyanalytics.win/en IT does not requires cookie consent banner.

Zaheer• 2 years ago

We use Plausible but have found it quite slow for our needs.

newusertoday2• 2 years ago

Can you elaborate? how many views do you have per month.

pdyc2• 2 years ago

initial rendering is slow or filtering is slow? are you doing something special with it? what is your typical data size?

theanonymousone3• 2 years ago

I was always confused by GDPR. What are the minimum requirements to avoid the banner? Anonymising the IPs and not keeping anything else, or you can keep anything as long as you don't share them with third-parties?

blkhawk2• 2 years ago

well AFAIK a simple session cookie doesn't need a banner. Also i think if you do everything local to your system you don't need one either. The point where you need one if you use any system that utilizes third parties to track the user.

So if you store and analyze everything "locally" to your server you don't need cookies and therefore no banner no matter how much you "track" since its all request made to your own server you merly use the telemetry of.

You can't share that data without consent but thats a seperate data protection thing from the cookie banners.

blkhawk2• 2 years ago

Oh and the GPDR is mostly confusing because it was interpreted with malicous complyance by the whole industry - at least in effect if not intention. it is simply easy for upper management to take a "better safe than sorry" approach and by now the banners have reached a degree of dark pattern development that is horrifying in their relentlessness.

shafyy5• 2 years ago

Essential cookies (e.g. a cookie that saves the cart's content in an e-commerce app) are fine. PII (personally identifable information) is never fine (this includes IP addresses, email addresses, more or less exact geolocations) - so anonymized IP is ok.

gmokki• 2 years ago

What is an anonymized IP? And how would that be useful?

I think simple hash(IP) is only pseydonymiztion and can be reversed with a bit of work. And thus cannot be stored without consent.

Of course mapping each IP to random id and not storing the mapping should be completely ok.

And legitimate reasons allow storing the mapping for a short period for debugging and attack detection.

theanonymousone3• 2 years ago

Many thanks. What about "fingerprints" such as browser user agent, country, ...? They are not exactly PII, are they?

And regarding anonymisation, is it enough to remove the last two parts of an IPv4 IP, or it must be more?

ben_w2• 2 years ago

IANAL, but for me the thing is mostly clear* and the only question is "what counts as 'legitimate interest'".

https://gdpr.eu/cookies/

1) If it's strictly necessary, e.g. logging in or legal obligation, you're fine and don't need to ask

2) If the data can be associated with a specific human, and it isn't covered by #1, then ask

3) ??? legitimate interest ???

* but I know from experience that this means "don't trust my own feelings of clarity, ask a lawyer"

bryanrasmussen2• 2 years ago

legitimate interest - anything to make your application function.

you have an online mail service, you have to save email accounts of emails you receive so you can respond to those.

you allow people to forward their emails received to other email addresses, you need to save those other email addresses.

This would be in dbs for that stuff if you have third party marketing analytics, just because you have legitimate interest to save email to make application work doesn't mean you can pass that email into third party marketing analytics. That is not legitimate interest.

if you have a newsletter service and someone signs up to receive newsletter then you need to save their email to send that newsletter. you don't need to ask, they have implicitly given you permission by asking you to send them the newsletter.

If you have a process for removing users from service for violation of terms then you probably need to be able to keep information about them otherwise they can just say get rid of info and then sign on again - this would come into the parts of the Digital services acts about obligations to users and appeals process for removal etc. but different thing, if you have removed someone you need to be able to identify when they try to come on again.

timeon• 2 years ago

This is bit OT, but that site states:

Allow users to access your service even if they refuse to allow the use of certain cookies

Does it mean that sites like https://www.spiegel.de, are not GDPR compliant?

iamacyborg3• 2 years ago

The banner has nothing to do with GDPR, it’s more to do with PECR.

shafyy5• 2 years ago

Let me also plug my free, open-source and self-hosted event-based analytics solution: Fugu (https://github.com/shafy/fugu). Fugu does not track unique visitors (not even daily like Plausible does) and is made for event-based tracking. Comes with included Docker config to make it easy breezy to self-host.

rickette• 2 years ago

When you host your static site on Cloudflare Pages you'll also get Cloudflare Analytics which is cookieless.

Smar• 2 years ago

You still need to ask permission for storing identification data, regardless whether user's browser is told to save cookies or not.

iamacyborg3• 2 years ago

Yep. The legislation has nothing to do with cookies, it’s about storage of unique identifiers. The actual method of storage is largely irrelevant.

jwr• 2 years ago

Serious question: what is the value of web analytics for people?

I run a SaaS business and I dropped Google Analytics a long, long time ago. Primarily because of the tracking, but also because I really couldn't see the value of the data.

In the old days, you could at least use the "Referer" (sic) header to know where people came from and what they searched for. But that is long gone, and the only source of that data is Google/Bing search console.

Page visits are a vanity metric: they tell me nothing about my business. The only thing that actually matters for a SaaS are signups and MRR. Measuring your business by page views is like measuring the business performance of a Walmart by counting cars on the freeway nearby. Yes, the numbers are somewhat related, but you can't draw any conclusions.

I made it a point not to include any third-party JavaScript on my site, but even if I were to make an exception for these analytics, I can't really see the point, unless you are running an ad-driven site where pageviews are king.

jonplackett• 2 years ago

Do you not at least want to know page views ratio to sign ups so you can see conversion rate? Or do you have a different / better way to do things like testing a new design / price.

vasco• 2 years ago

This seems contrarian just for contrarian sake, given how much literature there is about this, and the fact that it's almost self evident. Tracking impact of your changes, seeing if your users are getting lost after changing something, understanding where they spend the most time, etc.

Say for example, if all your users start spending 30% more time in your reset password page after you pushed out some changes. How would you know? What could be causes of that? Could something be broken with the login? Apply this to everything.

Not having analytics is literally not caring about what they do in your product, so you're either never changing the product and 100% confident it'll always work, or you're probably giving them a worse experience than you could.

How you do this tracking is another story, but there's ethical ways to do it.

raverbashing• 2 years ago

I think you're taking about different things and yes, user tracking inside your site/app is definitely useful, still, it can be anonymous

zelphirkalt• 2 years ago

Tracking impact of your changes, seeing if your users are getting lost after changing something [...]

The change of adding obnoxious tracking of course accounts for some user loss itself, which it cannot measure. On some of those "modern" websites, that show me a whitescreen without JS, I check my uBlockOrigin and see the domain of that website and some Google shit? Tab closed. No thank you, I will go elsewhere.

dustedcodes3• 2 years ago

Sales is driven through traffic. No traffic == no sales.

Understanding what drives traffic to your SaaS website is such an important piece of information. For instance, if you write two articles, one describing how to use your product to achieve a certain thing which customers want to do, and another article which compares your product to a competitor product and one of the two articles creates 50x more traffic than the other then you'd certainly want to know this, because then you know what articles give you the biggest return on your time writing them.

Just one of so many examples how web analytics is such an important tool to being a good sales person.

diffeomorphism• 2 years ago

That sounds like a non-example. Why do you need invasive, personalized surveillance for that? Traffic and aggregate data are an entirely different question.

that_guy_iain5• 2 years ago

Referer works standalone with search consoles.

Page visits tell you have many people you get. If you then use how many sign ups you get then you have a conversion rate. That’s an important figure. Page visits can also tell you if your marketing efforts have worked. Imagine doing all the marketing work and not knowing if it did anything.

pickledoyster4• 2 years ago

OP clearly stated that signups and MRR are the really important figures for SaaS. Not incidentally, those two metrics also tell you if your marketing efforts are working.

cryptonym2• 2 years ago

Only page view? That's not really useful and you already got that with backend logs.

With true analytics, understanding typical session helps you optimising users workflow, making sure relevant features are easily discovered at the right place.

It really helps when you want to work on user experience. You may need metrics such as LCP, INP and CLS with details per type of page, ability to drill down data and get that in real time.

ROI of such script depends on what you do with the data. If that's vanity or not even looked at, you are emitting CO2 for nothing.

pickledoyster4• 2 years ago

optimising users workflow, making sure relevant features are easily discovered work on user experience

These are qualitative improvements which are extremely unlikely to stem from quantitative metrics, especially when the sample size is not significant (which it is for the vast majority of pages in existence).

pickledoyster4• 2 years ago

You got quite a few seo garbage-level nonsense replies. In my experience, you are right, and most tracking metrics have long since become the (vanity) goal to justify the existence of these 'digital marketers'.

It's funny that they spout nonsense about better UX or how you wouldn't be able to do CRO when you'd just laid out two metrics that are actually important and don't require any website analytics to track.

troyvit• 2 years ago

The value of web analytics for our organization lies in the same realm as the value of Plausible over any third party analytics: The Funnel.

We're a membership driven organization, and by "membership" I mean we rely on donations to fund our content creation (Though whether you're a member or not you have the same level of access to our content). We care about raw traffic numbers, because it relates directly to our mission of informing people. It tells us how many people we inform day to day.

So yeah we care about those raw numbers, and those numbers are difficult to get w/out javaScript r/n because caching and the terrible log retention of our hosting providers.

Raw traffic numbers only tell part of the story though. We want to know the path people take from first landing on the site to becoming a donating member so that (in theory) we can do more of the things that promote that behavior in more people. That's The Funnel, and that's where orgs like Plausible are best. They're first party tracking, so the data stays with us. Also since they're first party tracking we can track a person's overall relationship with our site, from the first news story they read to the moment they first hit our donation page 3 years into the relationship or whatever.

We should be able to do that with our GA set up, but one of the reasons I want us to shift to Plausible is for its simplicity.

_heimdall• 2 years ago

In around 8 years of web development, mostly focused on consulting and focusing on ecommerce, I've never seen a net gain from using analytics on a site. If the end goal is to produce data for the sake of data, well sure that will work. Rarely does anyone analyze the data though, and I've never seen anyone dig into the validity of the data and ensure that Google Analytics is in fact accurate and reliable for them.

One of the most disappointing client experiences I had was after building a custom shop for a company that was heavily focused on graphic art. We optimized the hell out of their site, getting performance scores of 97+ when every page was image heavy and included a product grid designed for a masonry grid look similar to Pinterest.

A few days before launch they asked us to add their Google Pixel script. The next day they had included 7 or 8 different third party scripts and blown performance scores into the mid 50s. Its their site and they can do what they want with it, but I sure could have saved a lot of dev time if performance didn't matter at all.

XCSme2• 2 years ago

Something like this helps me a lot to understand if the visits I get are useful, and where to focus my marketing efforts: https://s3.amazonaws.com/i.snag.gy/cCdZa9.jpg

pogue2• 2 years ago

I'm planning on running a small niche WordPress blog that I would like to monetize with adsense & possibly an affiliate program. I see there's a lot of choices for analytics available listed by users in this post. Does Adsense require Google Analytics or could I use one of these more privacy friendly ones?

that_guy_iain5• 2 years ago

Im confused why you would care for a privacy friendly option when you‘re already willing to give Google all the data anyways.

pogue2• 2 years ago

Is there a better option than adsense that pays out as well?

NicuCalcea• 2 years ago

AdSense and Google Analytics are two separate products, you can use either, both or neither. If you have AdSense though, you've already allowing Google to track your users, so I don't think ditching Analytics would make the blog any more private.

ayuhito2• 2 years ago

Obligatory plug for Medama, which focuses on easy self-hostability: https://github.com/medama-io/medama

I think Plausible’s self-hosting is not simple, requiring unnecessarily heavy databases like ClickHouse, which can be overkill for the average website owner. Comparatively, this project can effectively run on a 256MB VM for most small website with no external dependencies.

phyzix5761• 2 years ago

In my opinion Cookie Consent Banners have made using the internet an overall worse experience.

mediumsmart• 2 years ago

I opened the site but would it be plausible for their analytics to tell them that Orion does not load the css? Safari does it without consent.

Plausible Analytics: GDPR Compliance w/o Cookie Consent Banner

Related Stories