Re: dev-webdev Digest, Vol 30, Issue 9

[Christopher More]

Google Analytics isn't respecting DNT for a variety of reasons, but it
doesn't technically mean that it can't. It would simply be a conditional
statement around the tag loading. We have this conversation about every 6
months since 2012. :-)

* GA does not collect PII. It's all aggregate trends as hit-level data
isn't very useful.
* We don't directly link the GA sessions/cookies to other 3rd party
services for additional tracking
* All cookies are 1st party Mozilla domain cookies.
* We don't do cross-domain GA tracking as each sub-domain has its own
unique tag and has a sub-domain filter attached to the GA profile.
* We use GA to understand the UX and find out what is working.
* We don't do GA re-targeting like other companies do as common practice.
* We have opt-ed out (at the account level) of Google or 3rd parties from
using the aggregate data to understand general trends.
* We have enabled IP anonymization at the tag level for a few websites.
Others Mozilla websites could do the same.
* We provide a user opt-out of GA and Optimizely for sites that use them in
our websites privacy policy.

Idealistically, we could say that Apache, caching proxies, or our 3rd party
CDN should not set server/router/network logs when DNT is enabled as that
could be considered by some as "tracking".

I have also some some research on DNT on www.mozilla.org and while the
percentage is small, there are some browsers that are enabled by default
from the factory, which would make them pretty much disappear from metrics
that are being used to understand the health of the Firefox product. Not
having a clear picture on metrics could negatively impact the health of
Firefox and ultimately lead to reduced impact on our mission. Oh wait, now
I am being idealistic. :-)

More "light" reading on the topic:

https://bugzilla.mozilla.org/show_bug.cgi?id=858839

https://bugzilla.mozilla.org/show_bug.cgi?id=697436

The blog cited above is good and contains useful information.

-cmore

On Wed, Feb 25, 2015 at 12:00 PM, <dev-webde...@lists.mozilla.org>
wrote:

> Send dev-webdev mailing list submissions to
> dev-w...@lists.mozilla.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.mozilla.org/listinfo/dev-webdev
> or, via email, send a message with subject or body 'help' to
> dev-webde...@lists.mozilla.org
>
> You can reach the person managing the list at
> dev-webd...@lists.mozilla.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of dev-webdev digest..."
>
>
> Today's Topics:
>
> 1. Re: Blog Post: Privacy and Google Analytics (Peter Bengtsson)
> 2. Re: Blog Post: Privacy and Google Analytics (Paul McLanahan)
> 3. Re: Blog Post: Privacy and Google Analytics (Nikos Roussos)
> 4. Re: Blog Post: Privacy and Google Analytics (Paul McLanahan)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 25 Feb 2015 10:39:37 -0800
> From: Peter Bengtsson <pbeng...@mozilla.com>
> To: Chris Van Wiemeersch <cwiem...@mozilla.com>
> Cc: dev-webdev <dev-w...@lists.mozilla.org>
> Subject: Re: [webdev] Blog Post: Privacy and Google Analytics
> Message-ID:
> <
> CALTBac2myvo4LHiyyKyH9Ygw...@mail.gmail.com>
> Content-Type: text/plain; charset=UTF-8
>
> Did you implement all those things?
> In particular, I'm concerned about depending on localStorage because if the
> site is hit with a cold localStorage cache getting the browser to boot that
> up is synchronous and might block the loading.
>
> Also, why isn't the default Google Analytics respecting Do Not Track?!?!
>
> On Mon, Feb 23, 2015 at 9:53 PM, Chris Van Wiemeersch <
> cwiem...@mozilla.com> wrote:
>
> > I stumbled upon this blog post by fellow Mozillian, Guillaume Marty
> > (gmarty):
> >
> > http://gu.illau.me/posts/privacy-and-google-analytics/
> >
> > A few months ago on the Marketplace team we discussed whether Google
> > Analytics should be disabled when Do Not Track is enabled. The consensus
> > was no - but with an asterisk.
> >
> > This blog post is a good read for those who want to use Google Analytics
> > without sacrificing user privacy (i.e., you!).
> >
> >
> > Best,
> >
> > cvan
> > _______________________________________________
> > dev-webdev mailing list
> > dev-w...@lists.mozilla.org
> > https://lists.mozilla.org/listinfo/dev-webdev
> >
>
>
>
> --
> Peter Bengtsson
> Mozilla Web Engineering
>
>
> ------------------------------
>
> Message: 2
> Date: Wed, 25 Feb 2015 13:53:30 -0500
> From: Paul McLanahan <pm...@mozilla.com>
> To: dev-webdev <dev-w...@lists.mozilla.org>
> Subject: Re: [webdev] Blog Post: Privacy and Google Analytics
> Message-ID:
> <CACTwJeOBy56qWngi4x9+k9+5nXwwa3kukHfnz0OxqDH=
> myK...@mail.gmail.com>
> Content-Type: text/plain; charset=UTF-8
>
> On Wed, Feb 25, 2015 at 1:39 PM, Peter Bengtsson <pbeng...@mozilla.com>
> wrote:
>
> > Also, why isn't the default Google Analytics respecting Do Not Track?!?!
>
>
> They say they are. And for us they have to respect it under contract. That
> does not keep their JS from loading on the page from their servers and
> receiving the data. They just pinky-swear that they'll not store it. That's
> great, and certainly better than them ignoring DNT completely, but I still
> don't trust them to actually discard these data at all. This is exactly the
> kind of info on which their entire business is built. It seems safest to me
> to do as the post suggests and only load the GA JS after checking the DNT
> state manually. I could see updating the check to opt-in IE users since you
> can't know the user's intent due to MS enabling DNT by default, but that's
> left as an exercise for the reader.
>
> I've filed a bug for bedrock [0] to investigate manually disabling GA (and
> GTM and Optimizely) when we detect that a user has enabled DNT. Thanks for
> the heads-up on this cvan!
>
> [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1136169
>
>
> Paul
>
>
> ------------------------------
>
> Message: 3
> Date: Wed, 25 Feb 2015 21:07:23 +0200
> From: Nikos Roussos <ni...@mozilla.com>
> To: dev-webdev <dev-w...@lists.mozilla.org>
> Subject: Re: [webdev] Blog Post: Privacy and Google Analytics
> Message-ID: <14248912...@mail.roussos.cc>
> Content-Type: text/plain; charset=utf-8; format=flowed
>
> On Wed, Feb 25, 2015 at 8:53 PM, Paul McLanahan <pm...@mozilla.com>
> wrote:
> > I've filed a bug for bedrock [0] to investigate manually disabling GA
> > (and
> > GTM and Optimizely) when we detect that a user has enabled DNT.
> > Thanks for
> > the heads-up on this cvan!
> >
> > [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1136169
>
> This has a long history. If you have the time read through this old bug:
> https://bugzilla.mozilla.org/show_bug.cgi?id=858839
>
> ~nikos
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Wed, 25 Feb 2015 14:28:26 -0500
> From: Paul McLanahan <pm...@mozilla.com>
> To: dev-webdev <dev-w...@lists.mozilla.org>
> Subject: Re: [webdev] Blog Post: Privacy and Google Analytics
> Message-ID:
> <
> CACTwJeP+w1Fvcq67DNYi0xih...@mail.gmail.com>
> Content-Type: text/plain; charset=UTF-8
>
> On Wed, Feb 25, 2015 at 2:07 PM, Nikos Roussos <ni...@mozilla.com> wrote:
>
> > This has a long history. If you have the time read through this old bug:
> > https://bugzilla.mozilla.org/show_bug.cgi?id=858839
> >
>
> I remember that discussion well. Thanks for finding the bug. I still feel
> that while we're following the letter of the DNT standard, we're violating
> the spirit. A lot of this is moot anyway for many Firefox users since
> tracking protection blocks requests to Google Analytics anyway. I both like
> that and take it as a statement on Mozilla's part that GA is in fact
> tracking and should be blocked if you would prefer not to be tracked. The
> other effect would I hope be that the little icon that indicates that
> Firefox has blocked a tracker would no longer show up on www.mozilla.org
> :/
>
> pmac
>
> --
> Paul [pmac] McLanahan
> Web Developer @ Mozilla
> http://pmac.io
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> dev-webdev mailing list
> dev-w...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-webdev
>
>
> ------------------------------
>
> End of dev-webdev Digest, Vol 30, Issue 9
> *****************************************
>



--
Chris More
Sr. Manager of Firefox Growth & Analytics
Mozilla Corporation
Mountain View, CA

Phone: 814-883-1418
E-mail: cm...@mozilla.com
Twitter: @chrismore
IRC: cmore