Bedrock: Investigate alternate / 1st party analytics

[alexgibson]

Description

With the rise of adblockers and tracking protection, we should investigate a 1st party, self-hosted, analytics solution. This will become especially useful for user agents that default to privacy always on.

Example: Firefox Nightly with a new profile visiting Mozorg:

[alexgibson]

/cc @hoosteeno

[hoosteeno]

The code landing in a future version of Firefox will block cookies from certain third party providers identified by Disconnect.me. GA's basic analytics cookies (including GA and GTM) will not be blocked.

Analysis here.

[pmac]

I've tested the site in a fresh profile in Nightly 70.0a1 and it does indeed block GTM loading. I'm not sure about cookies, but it doesn't look like we'll be getting any data from Firefox users once 70 is released.

[hoosteeno]

A fresh Nightly profile on today's version on standard ETP is not blocking GTM, nor is it highlighting the presence of trackers in the shield icon (See attached). GA will work as expected under these conditions.

In standard mode, clicking on the shield icon reveals a UI that explains what was allowed: google-analytics.com was allowed.

Visiting about:preferences#privacy and changing the level of tracking protection to "Strict" causes Firefox to block all trackers, first party and third.

I suspect clicking on the shield icon at this point should reveal a UI that shows all the things that were blocked. This is not currently true; I'll file a bug if warranted.

All of this is to say, the UI may be a bit fluid right now, there may be some bugs, but the out-of-the-box, the browser is behaving exactly as we expect. It loads GTM; allows analytics; and does not raise big alarms about doing so. With strict mode on, it blocks GTM.

[hoosteeno]

Update: The reason we don't see any trackers blocked in strict mode is that Fx70 sends DNT headers when strict mode is enabled, and dubmo respects them WRT GA tags. Nothing was blocked because nothing was sent.

[pmac]

Doh! You're right. I was seeing googletagmanager.com being blocked because I have a local DNS tracking blocker. It works as you describe when I turn that off. My apologies for the churn.

[alexgibson]

See also: https://bugzilla.mozilla.org/show_bug.cgi?id=1576673

For posterity, it's bugs like this (^) that drive forward the affirmation to me that we should be investigating other solutions for our analytics. The page mentioned in that bug was a valulable source of measurement for website performance, since it was seen by so many people. Firefox traffic provides a large and diverse audience both in terms of geography and connectivity, and being able to measure and optimize for those users on our website remains an important feature.

Whilst this may not impact our measurement for Skyline, it is something we need to keep prioritized and on the roadmap for bedrock imho.

[alexgibson]

See also: https://bugzilla.mozilla.org/show_bug.cgi?id=1578872

[alexgibson]

Depends on https://github.com/mozilla/bedrock/issues/8482

[alexgibson]

Further reading: https://blog.convert.com/analytics-ab-testing-cookies-after-consent-in-europe.html

[alexgibson]

I'd like to keep this issue in our minds, so I'm sharing a couple of recent new products that aim to provide privacy-preserving analytics as an alternative to GA:

• https://plausible.io/
• https://www.goatcounter.com/

[pmac]

I also found https://usefathom.com/ via https://switching.software/replace/google-analytics/

[alexgibson]

Depends on https://github.com/mozilla/bedrock/issues/9028

[alexgibson]

Relevant: there are reports that Safari on the next version of macOS (Big Sur) may block GA by default (even with anonymised IP):

https://appleinsider.com/articles/20/06/22/safari-now-blocks-google-analytics-on-sites-new-privacy-report-feature-shows