To opt out of Google Analytics you have to install a browser extension
tools.google.com
tools.google.com
(function() {
var a = document.createElement("script");
a.type = "text/javascript";
a.innerText = 'window["_gaUserPrefs"] = { ioo : function() { return true; } }';
document.documentElement.insertBefore(a,
document.documentElement.firstChild);
})()
"matches": [
"http://*/*",
"https://*/*"
],
I see what you did there. Won't this break with ManifestV3?
It’s going to force the adoption of cors-proxy type solutions instead of a relatively simpler extension.
Obviously ad blockers will accomplish that. But Google can’t just tell people “go install ublock origin.” It’s not a project under their control and they’re not going to vouch for it in that way. And of course they don’t want to promote ad blocking in general.
One of the comments posted the code; it seems pretty simple. It looks like it just tells every website the same thing: basically “this browser opts out of GA.”
I know that used to be true, but is that true anymore?
I saw comments like this in previous discussions about this snippet: https://news.ycombinator.com/item?id=18680149
You absolutely can identify someone server-side with heuristics. Your browser sends its IP address, user-agent and possibly referer header at a minimum when fetching the Google Analytics JS, and I'm not even talking about fingerprinting your TCP or TLS stack.
That's true but kinda irrelevant. IPv6 is at best as bad for privacy as static IPv4 since you're assigned a fixed range, so the adversary can both identify you by the static part of your address, and possibly resolve devices behind the router which would be hidden by NAT in IPv4.
[GA] Do Not Track Enabled; Google Analytics not loaded and tracking disabled
> After discussing this with several content blocking extension developers, we have decided to implement DNR and continue maintaining support for blocking webRequest
> DNT is not widely adopted by the industry, with companies citing the lack of legal mandates for its use, as well as unclear standards and guidelines for how websites are to interpret the header. Thus, critics proport that it is not guaranteed enabling DNT will actually have any effect at all.
* Webpage Contents Can read sensitive information from webpages, including passwords, phone numbers, and credit cards ..... * Can see when you visit all webpages
Is the cure worse than the disease? Analytics might be an invasion of my privacy, but it is benign compared with seeing my password. I am not saying that the extension steals my passwords, but how do I know it does not?
Also, please don’t answer that honestly because lots of banks actually had vulnerabilities that allowed hackers to inject js into their sites to steal login info.
That said, the analytics scripts can also do all of that. They can only do it on pages where they're embedded, of course, but especially for Google's scripts, that's probably most (not all) web sites (either in the form of Analytics, Tag Manager, or Ads).
Firefox now has a program where they go through a vetting process for a subset of the available extensions.
>Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status.
https://support.mozilla.org/en-US/kb/recommended-extensions-...
The warning is for the "inject arbitrary code into any page" one.
So then Apple made a sandboxed ad-block extension point which would take a list of rules and apply them directly.
This wasn’t flexible enough for everyone, so now we are back to square one again.
In this case, google analytics only goes through analytics.google.com, so it’s easy to block at a DNS level.
You'll not be able to block the next generation of server-side analytics tools like Cloudflare Analytics [0] -- seems like that's a direct response to increasing block rates.
What I do care about and actively block is JavaScript trying to enumerate fonts or fingerprint my canvas or whatever is the latest and greatest web API abuse for fingerprinting.
Unfortunately, Cloudflare is in a position to do just that, just like major analytics providers.
https://www.teradata.com/Resources/White-Papers/Price-Perfor...
Or just what they're showing you?
It doesn't remotely do what people in this thread seems to think it does. Which is bizarre given you can go set up an account for free and see for yourself.
They seem to be confusing it with some of the third party ad tracking software. But GA is really dumb as a brick (and that's a feature, not a bug).
The concern isn't about what GA gives to its implementers, it's about what it collects internally.
Google is an advertising company and has a financial incentive to stalk everyone. Their bad faith implementation of the GDPR consent flow (which IMO does not actually comply, but the regulators are incompetent or unwilling to enforce the law) proves it. The current regulatory environment doesn't do enough to discourage non-consensual data collection, so given this fact and the company's past history we need to assume the worst until proven otherwise.
I went to visit a friend a few days ago. At some point she wanted to show me something on YouTube on her laptop. While staring surprised at the screen, I asked, "What is this? Is it what you wanted to show me?" She was as surprised as me, "No, of course not, this is just an ad." It felt very strange to me as I haven't seen an ad on YouTube for many years.
So I inquired, "You know adblockers exist, why do you put up with this crap?" She answered, "Yes, sometimes people tell me this, then I install it, and then something breaks, like YouTube layout or the comments don't load etc., so I uninstall it, this happens every few years."
So this gave me some insight why a non-technical person may choose not to use an adblocker. I fixed it for her and I hope she enjoys smooth experience for a few months.
It actually becomes a bit of an issue when some idiot somewhere designs a business process around client side tracking. I'm currently fixing a broken process with a client where their users can request an upgrade, and ~1/3 of them (the technical users from above) never even process because some yuckster built it all inside of the tracker.
I don't need the information Google Analytics provides and want to avoid 3rd party cookies - something like Cloudflare Analytics looks appealing, but I'd prefer an OSS, self-hosted solution.
(function() {
var a = document.createElement("script");
a.type = "text/javascript";
a.innerText = 'window["_gaUserPrefs"] = { ioo : function() { return true; } }';
document.documentElement.insertBefore(a, document.documentElement.firstChild);
})() 0.0.0.0 google-analytics.com
0.0.0.0 ssl.google-analytics.com
0.0.0.0 www.google-analytics.com
Extensions for all the major browsers.
I mean to give credit, it’s hard to provide a universal opt out as it can’t be buried in account settings in some profile somewhere (the end user may not have a google account). Technically speaking, how do you opt out of something that is both invisible and universal?
Disclaimer: googler but opinions are my own
Respect the Do-Not-Track HTTP header and never generate the return response.
Because Google refused to adopt it. Because they don't want an easy and simple opt-out.
As Google lobbied to kill the bill to give DNT regulatory teeth, and then joined the DNT committee and stalled it out until it died, I fully expect them to undercut the GPC.
There is even a manual on how to do that.
http://svn.cacert.org/CAcert/CAcert_Inc/Board/oss/oss_sabota...
google knows what you browse
facebook knows who you know
amazon knows what you buy
but for a browser company, isn't a browser extension better than some other way to opt out? otherwise they would have to associate you to an account.
Thanks Google.
Well the better way would have been to honour the browsers 'Do Not Track' headers, but Google pretty much ignored these, presumably because it would have caused too much impact, which is one of the reasons it failed.
But now, Google could support 'Global Privacy Control' by implementing it in Chrome and honouring GPC headers across Google! That's the obvious way to support an opt-out considering there is an emerging standard and that they own a browser. But... again, it's probably better for them to ignore this from a commercial perspective and in their best interests if GPC fails, so better to implement some shitty add-in that discourages people from opting out (if you want to opt out of tracking from 100 companies, are you expected to have 100 different plugins?).
If the GDPR would make ignoring DNT illegal, that would be great. Is there anyone who honours the DNT header?
Apple even pulled support in Safari as pretty much no advertisers were using it to stop tracking, but some advertisers were (ironically) using the header setting for additional fingerprinting.
Sure - creeps. It distinguishes you from other viewers so is used as another vector to abuse your privacy.
It's not. All this stuff should be opt-in: I shouldn't have to tell people to leave me alone.
at least, this is how it's been argued in the US in the past.
You can let a browser with privacy extensions access Google services but not other apps that don't need it.
https://f-droid.org/en/packages/net.kollnig.missioncontrol.f...
I'm not affiliated, just a fan. No root needed, it pretends to be a VPN. It does take some time to set this up, though, especially if you take the strict approach and block all trackers for all apps by default.
(Chrome Cleanup Tool)
onclick="trackInteraction();doInteraction()"
(Disclaimer, written by me)
Google is doing everything to track even if you opt-out. And they will continue to implement their workarounds.
Quick solution: Use Firefox.
Stop throwing data at Google. Google is evil (Google "don't be evil" for more info on that).
Use Chromium. Use Vanadium.
I would suppose the advantage of FF is the way smaller marketshare, along with technical competence of at least some of its user making it not such a attractive target, compared to chrome.
Doesn’t PM becomes unsecured from ASLR option being enabled?
Something about CPU NUMA and the generalized malloc’s Arena architecture?
Firefox team also needs a bit of spanking - WTF are you doing with this product? The PMs and the leadership of Firefox is fucking things up. We just want a goddamn browser. Stop changing the UI. Stop with all this other bullshit. No one is asking for it. I really don't want a future Firefox-AI assistant. The way things are going, the probability of this is pretty high.
And yes, I filled in a fake address, and then was not able to redeem the card. They need "more details", and the process can take several weeks. Google is evil in every pore.
Or better....
Use Ecosia.org, Startpage.com, or Qwant.com to search for
"Google is Not What It Seems"
Adsense, Tag Manager, Analytics
Blocking them with uBlock origin is a bit of a PITA, as the rules always break sooner or later, and whenever I happen to end up on google somehow, getting the banner does tend to get a bit annoying
Source: I've been on several implementation teams for cookie banners.
( You can also turn off the crypto notifications )
Google Analytics is a decentralized service. Individual websites are running their own implementations. The alternative where Google has a central database you can opt out of seems worse.
https://raw.githubusercontent.com/StevenBlack/hosts/master/h...
And since this is passive blocking (no need to install executables, like add-ons) its probably the safest way to block ads and trackers.
That said, you have to keep in mind that ms/apple/google crap is whitelested so you're going to need to purge their pages. Takes about a minute to disable all whitelisted entries.
I disagree with your "the only", uBO also supports deny-allow for script blocking.[1]
Beside, `google-analytics.com` is wholly blocked by default in uBO -- i.e. without having to fiddle with the default, out-of-the-box configuration -- and the blocked GA scripts are replaced with neutered ones in order to reduce likelihood of site breakage.
---
There might be an interesting conversation to have here, but this isn't it. AFAICT this is someone guerilla marketing their chrome extension.
> There might be an interesting conversation to have here, but this isn't it. AFAICT this is someone guerilla marketing their chrome extension.
This is Google's extension...
"You can opt-out of having your site activity available to Google Analytics by installing the Google Analytics opt-out browser add-on"
And not related to their license.