There seems to be a trend among this current wave of privacy friendly analytics providers like Fathom, Simple Analytics, Goatcounter, Plausible and others (my project Offen is probably a fringe part of this wave as well to be transparent) and also affiliated websites to make the stats for their websites publicly accessible. It serves as a nice instant demo for the product, and it is supposed to show off their approach towards “privacy friendliness”. Offen does not have such an easily accessible demo. If you want to have a look at how it works, you will need to download the binaries and run a local version that is populated with random data. This might seem overly complicated, but there’s a good reason why it works that way. In the following, I will explain this to you from my perspective as a user of the internet.

Stop sharing my data with the public

Public dashboards are the exact opposite of privacy friendliness. Instead, they show how low our standards have become, and what we as users are willing to accept by now: someone else is selling your data as a marketing effort for their service, and tech bros are already clapping “because transparency”. If anyone who is running such a service is reading this: I’d much appreciate if you stop making my data public right now. And if you’re actually interested in what your user’s users think, let me tell you why.

Pseudonymity does not give you a blank cheque

A lot of your services advertise how they do not collect personally identifiable data. This serves as an explanation for not having to comply with any existing regulations around notifying users, and instead to just collect data from the very beginning, no exceptions. This might be legally sound, but does that matter much when the ethical implications of this approach stop being of importance?

The fact that you hash my IP address (or use similar hacks for achieving pseudonymity) and just store that obfuscated version does not mean the usage patterns aren’t mine anymore. The referrer where I dug up your site is mine, just like the funnel I will follow on your website. The device I am using, its screen size, they are still mine, just like my geographical location is. Truly anonymous would mean you also obfuscate my behavior so that it’s not me anymore. This is probably not what your analytics service wants, though.

And after collecting all of this data, it is being made public? If people really think this is a good idea, let me repeat my idea: you can hash my name 14 times in a row using the strongest algorithm there is, and do it again tomorrow using a different salt: the hashes will differ, but the person behind the data will still be me. This is not the “privacy focus” you are selling, so let me also repeat what I already said: stop sharing my data with the public.

Let me opt out if you can’t be bothered to allow me to opt in

What makes the situation even worse is the fact that all of this happens without my consent. The tools have worked around GDPR successfully, so let’s not have “the annoying cookie banner” and move on? Well, what if I told you I would appreciate being asked for my consent, and before I haven’t made any decision, you just wouldn’t collect any data? I actually don’t want to install uBlock Origin because you can’t be bothered to do your job. But I do have to.

If this sounds too far fetched for you (hint: it isn’t far fetched, really) then at least give me the possibility to opt out easily, Google Analytics can do that too. Because - you might have noticed by now - I don’t want you to share my data with the public. Instead I want you to respect my choices and my privacy. As a user I do not care about formal GDPR compliance that very much, but I care about if you treat me with respect. With your public dashboard, you are giving me the feeling you don’t. And you even tell the public about it as if it were a feature.

Share my data with me instead of everyone else

While we’re at it, instead of sharing my data with the public, why don’t you share it with me instead, and just me? Why don’t you tell me about what you do with it, which conclusions you are drawing from it and how long it will be retained? I would be much more willing to grant access if I knew what you are doing. I would be much more willing to grant access if I knew I could revoke the decision again.

With your public dashboard, I feel like a trophy for you to showcase to the world. Much hits, so wow. Sorry, but no: this is not privacy focus, this is a marketing tactic.