Unexpected Google Analytics discovered on self-install of ODK Central

1. What is the problem? Be very detailed.

I saw that Google Analytics was being loaded on my installation of ODK Central. This is not my Google Analytics, it came with the installation. See this screenshot:

Also, see this line in the source code as the likely source: https://github.com/getodk/central/blob/647569c54f6bbf26ea356eca0d14f7e5d1a89c6b/docs/news.html#L7

Is this something that is intended to be present? Is Google needed to run ODK Central news feed? It seems like the Google tag manager / Google Analytics should be removed from the ODK Central.

Central has both error logging (described here) and web analytics (described here).

The latter is used as a lightweight, reliable, and privacy-preserving way to measure Central's adoption. We go out of our way to collect just what we need and the data is anonymized and only made available to the core team. Without adoption data, it's extremely difficult to source funding for continued development.

The web analytics are embedded in the news feed that Central loads. That page is at https://getodk.github.io/central/news.html and is external to your server. Because it is an external website, it knows nothing about your server, your actions on the server, or your data in that server. All it knows is that some anonymous person went to that page (in the same way that we know some anonymous person clicked the above link or went to the docs). Folks who are not comfortable with this can remove the news feed from the source.

We document this behavior at https://docs.getodk.org/security-privacy/#websites. But upon review, I do think we should add an ODK Central section in our security and privacy documentation to make it easier to find (filed by @danbjoseph here).

To help the Central team prioritize fixes and features, we will be adding more usage analytics over time. Is your concern here that we should not have any analytics or error logging in Central? Or more that there was not enough visibility that analytics and error logging were enabled? Or that it's Google Analytics?

1 Like

I didn't see anything about Google Analytics at that page when I posted this topic.

I know Google is easy, but I would not have thought that you would use it for hit counts. As an alternative, you could set up your own little web app that supplies the News JSON data and keeps track of all GET requests along with Referrer headers and other headers you are interested in. Would that give you all the information you want?

In terms of analytics and error logging: error logging is a no-brainer. And thank you for the opt-out instructions. But I wonder about analytics from Google Analytics without an opt-out. Is that something an open source community wants?

ODK started at Google and we've used Google Analytics from the beginning of the project. That particular copy was there when we separated the ODK/ODK-X sites in October. Here's the commit.

We are a small team with limited resources. Building and hosting our own reliable hit tracker is not a good use of our time. We do at some point want to move away from Google Analytics and provide an opt-out in Central, but we need to balance that with all of the other user-requested functionality and the relative benefit this brings.

For now, you can remove the analytics easily by editing the source. We would also consider a feature design for a user-facing opt-out from someone who would like to implement it.

Perhaps you will provide all these details when you describe it on the getodk site, but what data do you have access to given that you have Google Analytics? I'm wondering particularly about geolocation data. I know that Google Analytics has (had?) somewhat precise location data. Since you also have Referrer data, you would know where our team is logging in from. Is that so?

If I were to create a hit tracker, would the team consider accepting it? Feel free to be honest if the answer is no. I wouldn't want to waste anyone's time.

Also, I just checked on ODK Aggregate, and I did not see Google Analytics there. Was Google Analytics ever on ODK Aggregate?

Thanks, but no thanks on the hit tracker. The migration and maintenance is not something we can take on at the moment.

I believe Google Analytics only knows continents, sub-continents, countries. No idea about Referrer data, but https://support.google.com/analytics has lots of great info.

I don't believe Google Analytics was ever in Aggregate.

Yeah, it would definitely be a puppy of a gift.

2 Likes