floc VS Plausible Analytics

Draft: https://github.com/WICG/floc

"The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. The algorithms might be based on the URLs of the visited sites, on the content of those pages, or other factors. The central idea is that these input features to the algorithm, including the web history, are kept local on the browser and are not uploaded elsewhere — the browser only exposes the generated cohort." Source: https://github.com/WICG/floc

Google (or other third-party tracking) is also not effected by VPN. These groups use cookie syncing to assign you a unique ID and then collect this ID again as you browse the internet. That buyerID can then be cross-referenced (even with other buyerIDs) to generate all sorts of different demographic/psychographic information and used to fingerprint your online life for audience targeting. Google actually is in the works to take this a step forward with the FloC experiment. FloC (Federated League of Cohorts) actually deprecates the Set-Cookie header in favor of in-browser history scanning. Basically, in a year or two they plan to incorporate Chrome into their adtech stack and have it report your history/behavior to Google (regardless of whether you save history or not). Here is some good info on that: https://github.com/WICG/floc

Instead they propose new standards, like HTML Imports or FLoC, and the W3C decides as a whole whether or not they become official standards.

With cross-site cookies, adnetwork.com has full information about what sites you've visited (among sites that incorporate their cookies). This isn't good either! But generally speaking, an individual site using adnetwork.com for advertising won't have or want access to that vector of your interests; many site operators don't even have visibility into what ads win real-time bidding, just that they're receiving money for providing their inventory. Certainly there are players that can provide demographic targeting metadata to site operators, but to my knowledge they are less widely known and certainly not cheap, and I imagine (or hope) any players with wide enough cookie reach would be discouraged from maintaining a database that could associate metadata with PII.

With FLoC, though, the idea was that the browser would provide document.interestCohort() and the individual site's JS could react accordingly: https://github.com/WICG/floc . This means that any site, regardless of its contracts with ad networks, could immediately identify your cohort and associate it with your activity. Web developers working in good faith would be encouraged to have user.cohort or user.topic fields from day one "just so you have it" - imagine all the ways someone could use this in bad faith. Inevitably this data would leak (or be intentionally leaked) and could trivially become a target list for doxxing closeted people. It's a dangerous, dangerous proposal.

You can't find any info about this because there isn't really any. Josh Karlin, who is the maintainer of the FLoC working document, said at an event that it might make sense to swap to topics. It's essentially just reducing the entropy of the cohorts and giving them a more comprehensible (and probably less useful) taxonomy. That's all the info there is.

https://github.com/WICG/floc explains the overall goals.

It's pretty complicated and my understanding could be wrong and definitely not an expert. All the stupid CIA-style names that keep changing don't help. Turtledove, fledge, sparrow lol.

But from what I think I know that's kind of right technically, but kind of not in terms of actual real privacy.

Yes, the actual browsing data, e.g. for the basic floc cohorts only what amazon product page you visited, is no longer 'sent' to ad networks (that's a pretty big oversimplification of how ad networks track you but for brevity). That data is parsed in your browser to generate a cohort ID for you.

But this cohort ID is exposed to the world document.interestCohort() and is what's used for targeting and tracking.

To me it seems that the cohorts are so small "thousands of people" + IP or UA it's basically the same as a semi-long lasting uuid.

Here's an image from google's site.

https://web-dev.imgix.net/image/80mq7dk16vVEg8BBhsVe42n6zn82...

It also seems like Chrome/google might be still defaulting browser settings to give themselves even more data just like they currently do?

https://github.com/WICG/floc#qualifying-users-for-whom-a-coh...

BUT when you layer on the other proposals (Fledge/Turtledove/Dovekey or whatever) - which I don't understand that much maybe someone else can explain - it seems like it basically collect this page/product level data and makes it available to DSP etc for tracking/ad serving (again if not technically 1:1 basically in consequence given the sizes of these groups).

Like one of the proposals talks about a 'trusted' key/value server which doesn't seem that different from what already happens? The original proposal wanted to move the entire ad bid/target/serve process into the browser.

I could do the same exercise with Google Analytics and Google Tag Manager, but luckily I don't need to, since Plausible already did. A piece of advice, rip out Google Analytics and use Plausible instead. It first of all doesn't destroy your website, and secondly it doesn't violate the GDPR - So you can embed it on your site without having to warn your visitors about that they're being spied on by Google.

Also, currently we are using https://plausible.io/ for analytics. No other bugs.

I just swapped out Google Analytics with Plausible for AINIRO.IO. It’s only been a week, but so far I am super jazzed about it. First of all, Plausible doesn’t use cookies, so I can completely drop all cookie disclaimers and popups I had because of GDPR. Second of all, the site scores significantly better on load time. This results in a 10x better user experience for my website visitors, while making sure the website is still 100% conforming to GDPR laws.

No clue what you mean, browser cache might even clear itself without you doing anything manually. This thing makes no sense.

Nowhere ever did it say Tech Demo anywhere, not in the HN headline, not on the page itself. No, thanks. And even as a tech demo, there is nothing impressive going in. It is stores shit to local storage, I guess. Lol, I just looked this up, and it was in Firefox on 2009 already? WHAT? https://developer.mozilla.org/en-US/docs/Web/API/Window/loca... I never used it myself directly, but I remember reading about some API that kind of is the new version of cookies that can store more and better and I think that is it. 2009, I would swear what I think about was newer, maybe I am mixing something up, maybe not.

It has unnecessarily tracking from the comment above, not sure if it even sends all your notes to https://plausible.io, and I do not care. For me, this fails as a tech demo or whatever the fuck It's supposed to be. Sorry to not get all excited about everything posted here. In 2009 it for sure would ;)

If you already use Posthog, Web Analytics has been in Public Beta for quite some time.[1]

If I remember correctly, CloudFlare Analytics does not need you to register your domain with them. I personally feel keeping domain registration coupled with your DNS provider is not a good idea.

Plausible[2] has an Open Source self-hostable version but is not so updated in sync with their SaaS version.

Umami[3] is another simple, clean one. And, of course, as many have suggested, Matomo is the other well-established one. If you want to avoid maintaining a hosting routine, a lot do the hosting out of the box these days. PikaPods[4] was good when I tried and played around for a while.

1. https://posthog.com/docs/web-analytics

2. https://github.com/plausible/analytics

3. https://umami.is

4. https://www.pikapods.com

Plausible - Open Source Alternative to Google Analytics

There are many good, lightweight, and open-source alternatives to Google Analytics, such as Plausible, Matomo, Fathom, Simple Analytics, and so on. Many of these options are open-source, and can be self-hosted.

You log the IP address, referrer, user agent and the requested page URL but you don't set a unique cookie to identify the user.

This still gets you plenty of actionable analytics information: where geographically people are located (via GeoIP), what pages are most popular, what platforms (including desktop vs mobile) people are using.

I've been using https://plausible.io for analytics on a bunch of my sites for a couple of years now and I honestly don't miss the extra level of detail I got from cookie-based analytics I've used in the past.

The analytics provider I've gone with is Plausible. Sadly it's not free - about $9 a month - but it's easy to use, lightweight (the script is less than 1kb), and respects privacy, so it's worth a look IMO.