What privacy-respecting analytics means

"Privacy-friendly analytics" is on a lot of product pages, and it can mean anything from a setting that shortens IP addresses to a design that never records who anyone is. This article sets out what the phrase should mean in practice, what you can still learn when you measure that way, and what you give up. It applies to websites and browser extensions alike, whatever tool you use.

Start from the question, not the data

Most products need analytics to answer a handful of questions:

• How many people use it, and is that growing?
• Which features or pages do they use, and which do they ignore?
• Do people come back after the first day, the first week, the first month?
• Where do new users come from?
• Did the last release make things better or worse?

None of these needs to know who anyone is. They need counts, trends and proportions across everyone, not a record of one person. Privacy-respecting analytics starts there: collect what answers the questions, and nothing that only serves to follow an individual.

The practices that make it privacy-respecting

No identity

Nothing recorded should identify a person: no name, email address or account number, and nothing that could be joined with another system to find them. If you need to tell people apart to count them, a random identifier generated on the device does that without saying anything about who they are.

No fingerprinting

Fingerprinting builds an identifier from things about the device: screen size, fonts, time zone, graphics card and so on. It needs no storage, which is exactly why it is used to follow people who clear their cookies, and why it undermines their choices. A privacy-respecting tool does not fingerprint, and does not use the IP address as an identifier either.

No following people across sites

An identifier should belong to one site or one extension. Shared identifiers, third-party cookies and ad-network pixels exist to follow people from one product to the next, and they turn analytics into profiling.

Less detail, kept for less time

Record what answers the question at the precision it needs. A country, or a region, answers "where are our users"; a street address does not need to exist. Keep raw events only as long as you need to compute your reports, then keep the totals. Record the browser and operating system family rather than exact versions, which are a fingerprinting ingredient.

The IP address is used, then dropped

Every request carries an IP address; there is no avoiding receiving it. What matters is what happens next. Work out what you need from it, such as a country, then discard it rather than storing or logging it.

No data you did not mean to collect

Page addresses can contain search terms, email addresses or tokens. Form fields contain what people typed. A privacy-respecting tool collects the events you choose to send and strips what you did not, such as query strings, rather than recording everything and filtering later.

The person's choice is honoured

When someone opts out, through your own setting, a browser's built-in consent, or a signal such as Global Privacy Control, nothing is sent. Not "anonymised", not queued for later: nothing.

Reports are shared deliberately

Reports about your users should be visible to your team, not published or embedded where anyone can read them.

What you still learn

Measured this way, you can still answer every question in the list above:

• Active users per day, week and month, from the random identifier.
• Feature and page use, from the events and pages you choose to record.
• Retention, from whether the same identifier comes back after its first day.
• Sources, from the referring site and campaign tags on the landing page.
• Countries and regions, from the IP address before it is discarded.
• Browsers, operating systems and device types, as families.
• The effect of a release, from all of the above over time.

What you give up

There are real trade-offs, and it is better to know them up front.

• No individual journeys. You cannot replay what one named person did. If your product needs that, for support or for billing, it is a different system with its own consent, not analytics.
• No cross-device linking. The same person on a laptop and a phone counts as two. Without an identity, there is nothing honest to join them on.
• Counts are estimates at the edges. People who clear storage come back as new; people who opt out are not counted. Trends remain reliable; exact headcounts never were.
• No advertising audiences. Data that cannot follow people cannot be used to retarget them. For most products this is a feature.

Why it is worth it

• Fewer disclosures and fewer review questions. Browser extension stores ask what you collect; the less you collect, the shorter the answers.
• Less to protect. Data you never stored cannot leak.
• Trust. People increasingly notice what tools a product embeds. "We count how features are used, and nothing about who you are" is a sentence you can say in public.

Common questions

Is data with a random identifier anonymous?

Not strictly. Data tied to a random identifier is pseudonymous: it says nothing about who the person is, but it does tie their events together. Treat it with care: keep it scoped to one product, never join it to an account, and delete it with the rest of the raw data.

Can I still run experiments?

Yes. Send the variant a person saw as an event property, and compare how each variant performs. Experiments compare groups, which is exactly what aggregated analytics is good at.

Will I count fewer people?

Yes, a little. People who opt out, or whose browser sends Global Privacy Control, are not counted, and people who clear their storage come back as new. Trends and proportions stay reliable, and they are what decisions are made on.

Does respecting privacy cost more?

It usually costs less: less data to store, fewer disclosures to write, less to secure. The main cost is giving up reports built on individual tracking.

How AnalyticsTrend does it

AnalyticsTrend is product analytics for browser extensions and websites built on the practices above: no cookies, no fingerprinting and no personal data unless you put it in an event property. Its identifier is random and scoped to one product. The IP address is turned into a country, and in some countries a region, then discarded. Raw events are deleted after 90 days and daily totals are kept. Of a page's query string it reads only the named campaign parameters, never the rest. It respects Global Privacy Control and your own consent switch, and reports are shared only with your account's members.

The complete list is in What it collects. To see the reports, read Reading your reports. For what this means for consent on a website, see Analytics without cookies: what changes and what does not.