1515144 - Prevent Google Analytics script from being loaded when DNT:1 so that Tracking Protection doesn't have to block it

Status: VERIFIED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Darkspirit]

Attachment: Screenshot_20181218_203721.png

I found this always a bit strange and never filed a bug about it so far, sorry.

Comment 1

[Kohei Yoshino]

BMO respects DNT. Even when Tracking Protection is disabled, we always take DNT into account.

https://github.com/mozilla-bteam/bmo/blob/master/extensions/GoogleAnalytics/web/js/analytics.js

Comment 2

[Darkspirit]

(In reply to Kohei Yoshino [:kohei] (Bugzilla UX) (FxSiteCompat) from comment #1)
> BMO respects DNT. Even when Tracking Protection is disabled, we always take DNT into account. 

Yes, but "process less data" is not the same as "Do not track" with the european legal meaning of Opt-Out and Mozilla's strictness.

When Tracking Protection is disabled there is still a connection made to analytics.google.com even when sending a DNT:1 header. There shouldn't be one in this case. It is unexpected that tracking protection still has to block a tracker on a Mozilla website regardless of prior user choice.

Comment 3

[Darkspirit]

So we would have to check either client-side or server-side for the DNT:1 header and to not deliver or execute this line:
https://github.com/mozilla-bteam/bmo/blob/f8a6f476946b994f7f555da0ebbb14fc57a4f9c4/extensions/GoogleAnalytics/template/en/default/hook/global/header-additional_header.html.tmpl#L23

Comment 4

[Kohei Yoshino]

I have never seen a standard way to load Google Analytics on Mozilla properties, but yeah, it’s possible to insert the async <script> only when DNT is disabled. The official code snippet is here:

https://developers.google.com/analytics/devguides/collection/analyticsjs/

Comment 5

[Dylan Hardison [:dylan] (he/him)]

In the template, this would be [% IF c.req.headers.dnt %] ... [% END %]

Comment 6

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

I thought we had a cross-Mozilla standard for implementing this, because when we re-introduced GA, we discussed making certain that no-GA code was loaded if DNT:1?

Comment 7

[Kohei Yoshino]

(In reply to Dylan Hardison [:dylan] (he/him) from comment #5)
> In the template, this would be [% IF c.req.headers.dnt %] ... [% END %]

We could probably do it. Since older versions of IE and Firefox showed weird behaviour, we are using a DNT helper script developed for www.mozilla.org. But these oldies are no longer supported in Bugzilla, we can just rely on the HTTP header and remove the helper.

Comment 8

[Kohei Yoshino]

Attachment: GitHub Pull Request

Comment 9

[Kohei Yoshino]

Merged to master.

Comment 10

[Darkspirit]

Verified, it has been deployed. Thanks :)