diff --git a/homepage/content/articles/0100-matomo.md b/homepage/content/articles/0100-matomo.md index 4558ab9..800c419 100644 --- a/homepage/content/articles/0100-matomo.md +++ b/homepage/content/articles/0100-matomo.md @@ -27,7 +27,7 @@ On the technical side, the following issues are particularly apparent. Installin ### Operators and users as equal parties -To address the above mentioned issues we develop a fair, self hosted and lightweigt web analytics tool that treats operators and users as equal parties. It is called Offen and is [available as a production ready version.](https://www.offen.dev/get-started/) +To address the above mentioned issues we develop a fair, self hosted and lightweigt web analytics tool that treats operators and users as equal parties. It is called Offen and is [available as a production ready version.](/get-started/) *Offen's default is to NOT collect any data.* Usage data is collected after opt-in only. If users choose to opt in, they have full access to their data. They can delete it any time or opt out completly. @@ -50,7 +50,7 @@ Our strict focus on data protection also means that there are some Matomo featur We hope this overview helps you to get a better insight into the topic of fair web analytics. If you are passionate about ethical software and want *a truly lightweight and privacy focused alternative to Matomo* you should give Offen a try. Why not let both run parallel for a while and then see how it feels? We are looking forward to your [feedback.](mailto:hioffen@posteo.de) -Find further information in our [explainer](https://www.offen.dev/#bg-explainer), test it on your system or get everything you need to use Offen in production. +Find further information in our [explainer](/#bg-explainer), test it on your system or get everything you need to use Offen in production.
diff --git a/homepage/content/articles/0120-opt-in-quality.md b/homepage/content/articles/0120-opt-in-quality.md index 8b42aaa..4df1da5 100644 --- a/homepage/content/articles/0120-opt-in-quality.md +++ b/homepage/content/articles/0120-opt-in-quality.md @@ -13,13 +13,13 @@ bottom_cta: matomo ### Fair web analytics -A key feature of our fair and open web analytics tool [Offen](https://www.offen.dev/get-started/) is that data will only be collected after website users have opted in. This is absolutely necessary for a fair data transfer, but also comes with another, not so obvious implication. +A key feature of our fair and open web analytics tool [Offen](/get-started/) is that data will only be collected after website users have opted in. This is absolutely necessary for a fair data transfer, but also comes with another, not so obvious implication. Collecting data only with *user consent has a significant impact on the quality of analytics* insights, especially for operators of smaller websites. ### Analyzing our own turf -Our own homepage [offen.dev](https://www.offen.dev/), on which of course an Offen instance is installed, can be described as rather small. It currently has an average of 280 unique users after opt-in and 660 verified page views per month. +Our own homepage [offen.dev](/), on which of course an Offen instance is installed, can be described as rather small. It currently has an average of 280 unique users after opt-in and 660 verified page views per month. We estimate our opt-in rate, meaning the percentage of website users who agree to the data collection, to be about 40%. This figure is a subjective estimate and derived solely from the personal feedback of a relatively small group of test users. @@ -75,4 +75,4 @@ This is why the use of all available data is not the way to do better web analyt If you are looking for a self hosted as well as lightweight alternative to common web analytics tools and want to optimize your website for quality you should give Offen a try. Why not let it run parallel to your current tool for a while and then see how it feels? We are looking forward to your feedback. -Give it a spin with our [demo](https://www.offen.dev/try-demo/) or directly head to our [get started](https://www.offen.dev/get-started/) section. +Give it a spin with our [demo](/try-demo/) or directly head to our [get started](/get-started/) section. diff --git a/homepage/content/articles/0140-privacy-cookies.md b/homepage/content/articles/0140-privacy-cookies.md index c086736..a2fbe75 100644 --- a/homepage/content/articles/0140-privacy-cookies.md +++ b/homepage/content/articles/0140-privacy-cookies.md @@ -37,7 +37,7 @@ In case your conclusion is that you do need to collect the data, don't be afraid Regulations around data protection and collection often distinguish essential and non-essential features, and this makes a lot of sense. If a user can log in to your service and you have to store a session identifier in a cookie to enable this, it is perfectly fine to do so without consent. Having to provide credentials over and over again for every request made against your server would render your service unusable, hence it is an essential feature. -Non-essential features are usually revolving around performance and analytics. Collecting analytics data for a website definitely is not required for the user to use your service. This means it is non-essential usage and you should be asking for consent before doing so. Regulations around this topic only cover cookies, but taking privacy seriously, you would apply this principle to all techniques. On a side note, [quantity does not necessarily mean quality in web analytics](https://www.offen.dev/blog/opt-in-quality/). +Non-essential features are usually revolving around performance and analytics. Collecting analytics data for a website definitely is not required for the user to use your service. This means it is non-essential usage and you should be asking for consent before doing so. Regulations around this topic only cover cookies, but taking privacy seriously, you would apply this principle to all techniques. On a side note, [quantity does not necessarily mean quality in web analytics](/blog/opt-in-quality/). Most importantly, both essential and non-essential segments require making sure their technical implementation is secure and respects user privacy as much as possible. diff --git a/homepage/content/articles/0180-analyticstxt.md b/homepage/content/articles/0180-analyticstxt.md index d249230..c6f0ed4 100644 --- a/homepage/content/articles/0180-analyticstxt.md +++ b/homepage/content/articles/0180-analyticstxt.md @@ -15,7 +15,7 @@ The variety of data protection regulations and the range of methods used to coll ### Learning from building Offen -We recently drafted a standards proposal that allows websites and services to disclose information about their use of analytics software and user tracking. As this is related to our work on [Offen](https://www.offen.dev/), we wanted to provide some insight here into our motives, implementation and state of affairs on this matter. +We recently drafted a standards proposal that allows websites and services to disclose information about their use of analytics software and user tracking. As this is related to our work on [Offen](/), we wanted to provide some insight here into our motives, implementation and state of affairs on this matter. Offen is a fair web analytics software that treats operators and users as equal parties. Operators can self-host Offen and gain insights about how users interact with their services while ensuring that users remain in full control over their data. @@ -27,7 +27,7 @@ In the course of the development of our software, we came across a fundamental p ### What today's web lacks -Sure, terms like "data protection", "privacy-focused" or "privacy-friendly" are widespread and appear reliably in consent banners and privacy statements of of websites and services. But what do they actually [stand for?](https://www.offen.dev/blog/privacy-friendly-and-fair-web/) +Sure, terms like "data protection", "privacy-focused" or "privacy-friendly" are widespread and appear reliably in consent banners and privacy statements of of websites and services. But what do they actually [stand for?](/blog/privacy-friendly-and-fair-web/) In many cases, users still don't know what data is being collected and how it is being used. This leaves them confused about their situation and does not help to reduce the underlying mistrust towards operators and the web in general. diff --git a/homepage/content/articles/0210-offen-protocol.md b/homepage/content/articles/0210-offen-protocol.md index 589590b..e27899e 100644 --- a/homepage/content/articles/0210-offen-protocol.md +++ b/homepage/content/articles/0210-offen-protocol.md @@ -9,7 +9,7 @@ author: Frederik Ring must_read: True bottom_cta: cookie -# Say Hi to the Offen Protocol +# Introducing the Offen Protocol The most unique feature Offen has to offer is the ability of users to discover their data and manage it in a "self-service" fashion. This might seem like a highly unique feature at first glance, it's also a requirement mandated by GDPR for everyone that collects data. The “rights of the data subject” are defined as: @@ -55,7 +55,7 @@ The Offen Protocol is designed to be used in a server/client setup where both th The Offen Protocol explicitly does not prescribe anything about what kind of data is being shared between clients and the server and how the server models and stores the data itself. The only hard requirement is the use of a user identifier that is handled using HTTP cookies. This also means the protocol is not a good fit when the client is not a browser. -Using cookies might sound invasive at first sight, yet if you evaluate the options on the table without any bias, it is [the most privacy friendly, secure and robust option](https://www.offen.dev/blog/privacy-cookies/) there is. Collection of usage data requires the user to consent in any case, so to us, there is no reason not to use this approach. +Using cookies might sound invasive at first sight, yet if you evaluate the options on the table without any bias, it is [the most privacy friendly, secure and robust option](/blog/privacy-cookies/) there is. Collection of usage data requires the user to consent in any case, so to us, there is no reason not to use this approach. ### The specification diff --git a/homepage/content/articles/0230-consent-tool.md b/homepage/content/articles/0230-consent-tool.md new file mode 100644 index 0000000..2574f66 --- /dev/null +++ b/homepage/content/articles/0230-consent-tool.md @@ -0,0 +1,135 @@ +title: Say hi to the Offen Consent Tool +description: A lightweight solution for managing user consent on websites. +date: 2022-06-16 +slug: consent-tool +url: /blog/consent-tool/ +sitemap_priority: 0.7 +image_url: /theme/images/offen-blog-230-consent-tool.jpg +author: Hendrik Niefeld +must_read: True +bottom_cta: protocol + +# Say hi to the Offen Consent Tool + +This article is about our new Offen Consent Tool *[Fast forward to the details here.](#consent-tool)* + +--- + +### What’s wrong with consent? + +“Cookie banners are just a pain in the ass.” or "Why are there so many buttons? I just don’t care.” - that's what you hear when a conversation revolves around today's web experience. + +But if we consider solely the situation within the EU, the scenario is actually quite simple. GDPR states that data processing, any compelling reasons aside, is only legal if consent is freely given, specific, informed and unambiguous. However, the fact that this implies a real choice by the data subject is often where the problems start. + +The very fact that consent requests are often described as “cookie banners” is the first major misconception here. Relevant requests to invade the privacy of users are thereby framed as useless information about the use of certain technical specifications. This is all the more disappointing as cookies can actually be [quite useful for protecting privacy.](/blog/privacy-cookies/) + +it is usually not the consent request that is annoying but the fact that so many operators do not accept a possible “no” from the user. A whole arsenal of dark patterns and UX gimmicks is employed to willfully circumvent the actual intention of the GDPR, the informed decision of the user, and force a "yes". So it's not surprising that so-called "consent management tools" have become established, which suggest to be able to increase the rate of user consent. + +Lucky are those who have found a way to completely avoid consent requests. But unfortunately, all too often, data collection is not abandoned here, but only some technical loophole is exploited that lies in some grey area of jurisdiction. + +### Our take + +As we develop a [fair and lightweight web analytics software](/) that treats operators and users as equal parties our attitude to the issue of consent is clear: Consent is a must. Absolutely. We need the user's consent for anything that may contribute to their identification. + +We are committed to privacy and the rights of users, but we also support the legitimate interest of operators to improve their services. Requesting consent is, in our opinion, the only way to mediate meaningfully between these two aspects. And as a side effect, the [quality of the collected data is significantly improved.](/blog/opt-in-quality/) + +> *Nevertheless, the simplest option is all too often ignored: Do you really need all this?* + +We believe that a large part of the operators collect data even though they have neither time nor sufficient experience to evaluate it for any real benefit. Similar questions arise when using other third-party services. Why, for example, not integrate fonts yourself into a website with little effort? + +Not at least this is due to the fact that many developers of SaaS tools are still not willing to support the operators in properly implementing the applicable laws. They are hesitant about an important principle when it comes to consent. Accept a "no" as much as a "yes”. + + + +This leads to another essential question of principle that is asked far too rarely. Does a service “make no sense” if some of the users want to remain anonymous? Then maybe there is something wrong with it in the first place… + + + +### The Offen Consent Tool + +Having outlined the reasons for a consistent implementation of consent, let’s consider the technical aspects. Many elements that are implemented on web services today provide no or at best inconvenient solutions. For operators of small and medium-sized services it is very tedious to integrate these different consent requests correctly. + +Your analytics tool thinks it doesn't need a consent request? There are tweets embedded in your blog articles? What’s with that TikTok you want to share with your readers? The nice font featured on your page, is it provided by a third party? How do you collect consent for all of this? + +Well, we have developed a tool for these needs. Say hello and give it a try. We used it to conditionally embed the following Tweet. + +
+
+
+
+ + + + +The *Offen Consent Tool* keeps your data footprint small by never storing data about consent decisions on your end. As a lightweight solution for managing user consent on websites, it focuses on these objectives: + +- No server side persistence of consent decisions +- No need to assign user identifiers or similar, meaning no additional tracking vectors +- Consent decisions are secured from interference of 3rd party scripts +- Users can revoke their consent decisions and any traces at any time by clearing their cookies or using the provided UI +- Operators can customize the UI elements in use to match their design + +Installation requires you to be able to configure deploy a simple web server to a dedicated domain. Linux binaries and a Docker image are provided, or you can build the server for any other platform. However, it is not a solution to the requirements of GDPR. Operators must comply with the applicable regulations themselves. + +### Get started today + +The *Offen Consent Tool* is using 1st Party Cookies to store user's consent decisions. To enable this mechanism, you need to deploy the respective server to a sibling domain, i.e. if you plan to use the tool on `www.example.com`, it should be served on a domain like `consent.example.com`. The tool can serve any number of domains at once, so it's possible to use the same deployment for multiple domains at once. + +Next deploy the application to a domain like `consent.example.com`. On the host site `www.example.com` embed the client script: + +```jsx +