@spackmat opened this Issue on September 5th 2017

Hi,

we as a public german university have a problem with the behavior of Piwik regarding DoNotTrack.

At the moment, if you configure Piwik to respect the DNT-header, visitors sending a DNT-header won't be counted at all (unless they come with IE, but that's another weird problem, see #9987). In my interpretation of the DNT-specification, a submitted DNT-header means, that a user doesn't want to be tracked, i.e. he/she doesn't want to get a cookie set (or any other method like fingerprinting) to be recognized as the same user on following visits. Or even within his particular visit, when it's interpreted strictly. This says nothing about counting his/her pageviews anonymized. It is called DoNotTrack, not DoNotCount.

So Piwik should count those visitors, but not track them, if the respect-DNT-setting is activated.

On my personal blog, I did some tests in 2014 and at this time, activating DNT in Piwik resulted in only about half counted visitors (from 100-150 visitors per day to 50-100 with DNT-feature activated). On other sites, I administrate, the impact was lower, but around 20% loss in counted visitors was standard then.

For our data protection commissioner it seems to be okay, if we then don't respect DNT at all, so we'll likely deactivate this feature. But this is a shame, since we want to respect the decision of our visitors, that they don't want to be tracked between their visits. But we also want reliable statistics.

I appreciate your comments on this.

Greets,
spackmat

@sgiehl commented on September 10th 2017 Member

Interesting point of view. For sure we could change implementation to count those visitors. But we would need to do some kind of "internal" fingerprinting, as otherwise each page view would be counted as new visit. Would be almost the same as for those not accepting cookies.
I don't see any useful possibility of counting DNT users without any kind of fingerprinting. That would mess up most numbers.

@spackmat commented on September 11th 2017

I see, then what about tracking within a session/visit with a session cookie, but not over several sessions? This respects DNT in a broader sense and is better than not respecting DNT at all to not lose the pageview-counts?

Our data protection commissioner wrote now, that from his point of view, we (and any other public german institution) cannot deactivate the "respect DNT" feature, if this means, that Piwik will create a profile for users with active DNT. I'll ask him, if it would be okay, when Piwik would only build intra-session profiles to distinguish visits from single page views.

@mattab commented on September 11th 2017 Owner

Interesting idea to track anonymously the users. To ensure we track people anonymously we would need to take several steps:

  • no fingerprinting
  • no possibility to track a same person's visits across days (each visit needs to get a new idvisitor)
  • no storing of IP address at all (not even anonimised)
  • no geolocation (not even on the anonimised IP address)
  • no storing of personal data such as User ID
  • how do we restrict storage of personal data in Custom Dimensions or custom variables... possibly we need to discard all custom dimensions values?
  • and possibly more
@spackmat commented on September 11th 2017

@mattab that would be cool, since we only want to have reliable data about how our website is used and what pages are visited. we don't have any interest in (and strict laws against) profiling users. Geolocation on a per-country-basis is also sufficient for this usecase, no geolocation at all iss too strict, because then we shouldn't record any data enabling to fingerprint a user. This goes too far.

But this goes at all way far above my feature request to at least count users with DNT enabled. :) What technology is used by our users, how many come, where do they come from, which pages do they visit and which paths do they follow is all we want to know.

@mattab commented on September 18th 2017 Owner

But this goes at all way far above my feature request to at least count users with DNT enabled. :)

The thing is that we can't just start tracking users with DNT without considering everything related to privacy. So we must go through the complex process of identifying everything that could lead to profiling users and remove the information, when DNT is enabled.

Powered by GitHub Issue Mirror