Now there’s a fun idea!! I wonder how difficult it would be to spoof events.

Edit: looks like this might exist already: https://addons.mozilla.org/en-US/firefox/addon/adnauseam/

You're talking about Adnauseum

https://adnauseam.io/

Chrome banned it from their add on store but it can still be installed manually

I’d imagine that by this point in time, they are able to filter this specific type of noise out of the dataset. They have been tracking everyone for so long that I doubt there’s anyone they don’t know about whether directly of shadow profiles. These randomly generated users would just not match up to anything and would be fine to just drop

I have a quite common name in my country and snatched firstname.lastname@gmail.com for that name many years ago. Many use it by accident somehow when registering for things. Possibly (hopefully!) half of all leaks containing my email address are for other people. Never thought of what it might do for ad profiling, but hopefully it is adding at least some noise to it.

Maybe I could manually improve a bit on that by deliberately register myself for various random services and just clicking around a bit to pretend I am interested in things I have no interest in. On the other hand with 20 years of tracking I think Google has all my interests and habits nailed down anyway.

Google Tag Manager is a single place for you to drop in and manage all the tracking snippets you might want to add to your site. When I've worked on B2C sites that run a lot of paid advertising campaigns, the marketing team would frequently ask me to add this tracking pixel or another, usually when we were testing a new ad channel. Want to start running ads on Snapchat? Gotta ad the Snapchat tracker to your site to know when users convert. Now doing TikTok? That's another snippet. Sometimes there would be additional business logic for which pages to fire or not fire, and this would change more often. Sometimes it was so they could use a different analytics tool.

While these were almost always very easy tickets to do, they were just one more interruption for us and a blocker for the stakeholders, who liked to have an extremely rapid iteration cycle themselves.

GTM was a way to make this self-service, instead of the eng team having to keep this updated, and also it was clear to everyone what all the different trackers were.

Google Tag Manager lets you add tracking stuff on your website without needing to touch the code every time. So if you want to track things like link clicks, PDF downloads, or people adding stuff to their cart.

It doesn't track things by itself. It just links your data to other tools like Google Analytics or Facebook Pixel to do the tracking.

This kind of data lets businesses do stuff like send coupon emails to people who left something in their cart.

There are lots of other uses. Basically, any time you want to add code or track behavior without dealing with a developer.

I was tasked with auditing third party scripts at a client a couple of years ago, the marketing people where unable to explain wtf tag manager does concretely without resorting to ‚it tracks campaign engagement´ mumbo jumbo, but were adamant they they can’t live without it.

XSS-as-a-service. It lets people drop in random JavaScript to be injected on to the page without any oversight.

It’s used by marketing people to add the 1001 trackers they love to use.

The chief reason is that websites pay for advertising and want to know if the advertising is working and Google tag manager is the way to do that, for Google Ads.

This is not unreasonable! People spend a lot of money on ads and would like to find out if and when they work. But people act like its an unspeakable nebulous crime but this is probably the most common case by miles.

This may have changed, I last used Tag Manager 9-10 ago. You basically added a single Javascript snippet to you website, then you could inject other Javascript into the pages, using various rules. So rather than having to redeploy our site every time the marketing department wanted to add a new tracking or retargeting script, we could just add it in Tag Manager. I think is a great tool if you insist on doing these types of thing. You can also extract and transform variables, so all the customization required to adapt to each service could be done within Tag Manager, keeping your website simpler.

One major issue Tag Manager solved for us was that a bunch of these online marketing companies that have their own tracking pixels/scripts absolutely suck at running IT infrastructure. More than ones we experienced poorly written 3rd. party scripts would break our site. Rather than having to do a redeployment, to temporarily disable a script, I could easily pop into the Tag Manager console and disable to offending service.

Maybe Google Tag Manager has changed, but it was a good tool, if you where in the business of doing those sorts of things. I suppose it's also a clever way of blocking all tracking from a site by just stopping the Tag Manager script from loading.

It’s a little bit like dependency injection for websites, used by marketing teams.

The people responsible for maintaining a site don’t want to know about all the different analytics tools the marketing team wants to use, and don’t want to be involved whenever any changes need to be made. So they expose a mechanism where the marketing team can inject functionality onto the page. Then all the marketing tools tell the marketing team how to use GTM to inject their tool.

Maybe you’re being misled by the cryptic name. It’s got nothing to do with managing tags, it’s a behaviour tracker and fingerprint machine.

There's a section in the article titled, "WHAT DOES GOOGLE TAG MANAGER DO?":

> Whilst Google would love the general public to believe that Tag Manager covers a wide range of general purpose duties, it's almost exclusively used for one thing: surveillance.

This is why I generally keep a mostly-clean browser around for development (only including some dev extensions). I've wasted half an hour when I had a stray uBO filter go off on a component I was working on once (wasn't even an ad) and that taught me a valuable lesson.

If you're testing a website, you've got to test it like your customers use it. I shake my head at the incompetence of web designers every time I encounter a website filled with scroll bars because the devs on macOS haven't bothered testing any other device.

It really isn't. I've been blocking all JavaScript for years now, selectively allowing what is essential for sites to run or using a private session to allow more/investigate/discover. Most sites work fine without their 30 JS sources, just allowing what is hosted on their own domain. It takes a little effort, but it's a fair price to pay to have a sane Internet.

The thing is - with everything - it's never easy to have strong principles. If it were, everyone would do it.

Impossible to know because when I disable Javascript "the majority of the internet" works fine. As does a majority of the web.

I read HN and every site submitted to HN using TCP clients and a text-only browser, that has no Javascript engine, to convert HTML to text.

The keyword is "read". Javascript is not necessary for requesting or reading documents. Web developers may use it but that doesn't mean it is necessary for sending HTTP requests or reading HTML or JSON.

If the web user is trying to do something else other than requesting and reading, then perhaps it might not "work".

It depends.

If you're spending 99% of your time on your favourite websites that you've already tuned the blocking on? Barely a problem.

On the other hand if your job involves going to lots of different vendors' websites - you'll find it pretty burdensome, because you might end up fiddling with the per-site settings 15+ times per day.

Whitelisting JS has worked on my end for a while.

I won't browse the Internet on my phone without it, everything loads instantly and any site that actually matters was whitelisted years ago.

StackOverflow switched over from spying with ajax.google.com to GTM in the past year or so. All for some pointless out of date jQuery code they could self-host. I wonder how much they're being paid to let Google collect user stats from their site.

It's easier than I thought. I just use uBlock Origin with everything blocked by default and then allow selectively.

Echoing others, I've used NoScript for years and at this point it is practically unnoticeable.

Many sites work without (some, like random news & blogs, work better). When a site doesn't work, I make a choice between temporarily or permanently allowing it depending on how often I visit the site. It takes maybe 5 seconds and I typically only need to spend that 5 seconds once. As a reward, I enjoy a much better web experience.

The sites that don't work are usually the worst websites around - you end up not missing much. And if it's a store or whatever, you can unblock all js when you actually want to buy.

People who want you to run their scripts aren't really your friends

About as tiring as hearing about it all the time. Thank god it's a fringe topic these days but this article snuck it in. Probably the constant use of the word "surveillance" was an early tell haha.

But I like it better when they have to guess. If it's something we care about enough, we'll let them know.

If the analytics brought us to this, of what use are the analytics?

> if site owners can't easily assess the performance of their site

I would be more than happy to opt in to performance metrics or other reports if only I could have some level of trust that improving the UX is all it's gonna be used for. I want to live in a world where that is the everyday normal, and where the non-consensual collection and sale of personal data is a high-profile public scandal with severe legal consequences.

Effective and accessible UX design is a solved problem. It’s a matter of education of front end developers, not of A/B testing your users to death.

Belt and suspenders approach is to attach analytics to the most important events on the server side and combine with the session.

If the frontend automatic js is blocked, it doesn’t matter.

Analytics can have good uses, but these days it's mostly used to improve things for the operator (more sales, conversions, etc) and what's best for the website isn't always the best for the user. And so I block all that.

> Should we go back to static pages and mining Urchin extracts, and guessing what people care about?

Yes absolutely do this please.

Why even bother with the effort of analytics only to ignore the answers? I'm honestly not sure I've ever seen a website improve.