Disabling analytics for the Pro client of Elvis 5 Server

• 

  Siebrand Mazeland

  • February 03, 2017 15:04
  • Edited

  I love that you want to have usage info, but making Google aware of the traffic patterns of all Elvis installations on an opt-out basis it is a bit much in my opinion. I really think this should be an opt-in feature. Currently, this is an enormous privacy leak.

  0
• 

  Tom Pijsel

  • February 07, 2017 08:17

  We configured tracking with Google to only tracks the initial hit with a blank URL. This means we do not know which folders are on the server (for example). We use this information to for example monitor the spread of browser. 

  Besides that we track specific events that happen within the client, think for example of the number of uploads. This is done completely anonymous and we never track privacy related information. 

  0
• 

  Siebrand Mazeland

  • February 07, 2017 09:51

  > This is done completely anonymous and we never track privacy related information. 

  I think that is a naive view on anonymity in this day and age. Aside from calls to Google Analytics, there appears to be a second analytics service involved, too. I've noticed calls to https://api.amplitude.com, which I assume means that a second analytics service hosted by Amplitude is involved. Amplitude appears to have offices in San Francisco and Amsterdam.

  > We configured tracking with Google to only tracks the initial hit with a blank URL.

  I'm not sure what this means. I did some random testing, and I also found that Amplitude's API is called twice when a single file is uploaded in the HTML client. Event types: Main upload and Application State.

  Both Amplitude and Google Analytics are probably free products (or USD 2k/month and USD 150k/year respectively), which means that the companies providing the analytics services need to get their income from something else, which usually means that the data you have them collect is used to enrich their profiles, which they then sell to marketeers.

  WoodWing creates and sells Elvis DAM that loads a pixel from Google from a browser out of the box for each page view of the HTML client (/app/). That identifies users to Google by an IP address and often a browser signature, and that provides a wealth of information when there is already a wealth of information present. This is something Google has, and even though I don't know Amplitude, .

  While you are using Google Analytics, the Dutch Autoriteit Persoonsgegevens has published a manual for privacy friendly analytics gathering using Google Analytics. Can you please confirm that you configured Google Analytics are recommended there? Can you provide any information about what third party Aplitude does with the data you collect through them, aside from making it available for you to analyze?

  This is the information sent to Amplitude (some values redacted) for a "Feedback Debug" event:

  • device_id
  • user_id
  • timestamp
  • event_id
  • event_type":"Feedback Debug","
  • version_name":null,"
  • platform":"Web","
  • os_name":"Firefox"
  • os_version":"51"
  • device_model":"Mac"
  • language":"nl"
  • event_properties
  • preferences

  As long as the tracking goes through third parties, to be on the safe side, I'll be recommending to disable analytics for Elvis installations that I'm involved in.

  0
• 

  Siebrand Mazeland

  • March 06, 2017 22:05

  I've opened a support case for this issue, as there doesn't appear to come a reply in a timely manner for this issue: https://helpcenter.woodwing.com/hc/en-us/requests/30520

  0

Please sign in to leave a comment.