731852 - Privacy Policy Violation: Improper Web Analytics / User Tracking

Status: VERIFIED FIXED

(developer.mozilla.org Graveyard :: Editing, defect)

Description

[Adam Muntner [:adamm] (use NEEDINFO)]

** Summary: Privacy Violation - Improper Web Analytics / User Tracking


** Reproduction Steps: 

1. Visit HTTP://developer.mozilla.org/en/HTML/Canvas

2. View source

3. Search for the string "UA-68075-16" to navigate to the affected code. (reproduced below)

</div><script type="text/javascript">$(function() {var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");$.getScript(gaJsHost + "google-analytics.com/ga.js", function() {try {var pageTracker = _gat._getTracker("UA-68075-16");pageTracker._setDomainName(".mindtouch.com");pageTracker._trackPageview();} catch(e) {}});});</script>


** Recommended Remediation: Remove the javascript

Comment 1

[James Socol [:jsocol, :james]]

Can you point to what's actually violating any policy? Is it the ".mindtouch.com", or the fact that we're using GA at all? Do we have any other analytics on MDN?

Comment 2

[Adam Muntner [:adamm] (use NEEDINFO)]

UA-68075-16 is a google analytics cookie owned by mindtouch.com. Mozilla doesn't get these analyitcs, they do. 

I looked further, and it appears to be on every page of MDN under Docs. 

A web search turned this up: http://forums.developer.mindtouch.com/showthread.php?9620-Google-Analytics-default-Account-ID

indicating this is likely a widespread issue for all mindtouch customers. 

Anyone know who has a relationship with Mindtouch/can put me in touch with someone there?

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

http://developer.mindtouch.com/en/kb/Configuration_keys_and_values

Configuration of the MindTouch API service is handled a startup xml file (/etc/dekiwiki/mindtouch.deki.startup.xml) and the database table 'config'. [SNIP]

ui/analytics-key	UA-68075-16

It's a default mindtouch configuration, it sounds like their installation docs probably don't mention changing this value.

Comment 4

[Luke Crouch [:groovecoder]]

I left a comment on http://forums.developer.mindtouch.com/showthread.php?486-Google-Analytics but we'll remove this from the footer code ourselves if there's no way to disabled via configuration.

Comment 5

[Adam Muntner [:adamm] (use NEEDINFO)]

Luke - nice find! On the page you linked to, I saw one to http://developer.mindtouch.com/Deki_Wiki/Features/Google_Analytics - based on this page, it looks like the answer is to just blank the field in the config.

Are there any other Mozilla sites using this wiki software? They may have the same issue.

Comment 6

[James Socol [:jsocol, :james]]

(In reply to Adam Muntner :adamm from comment #5)
> Are there any other Mozilla sites using this wiki software? They may have
> the same issue.

Absolutely not. :)

We do have a support contract with MindTouch if we need it, but hopefully this is something we can change via configuration or a template.

Comment 7

[Jean-Yves Perrier [:teoli]]

There is a Google Analytics entry on the MDN control panel: https://developer.mozilla.org/deki/cp/analytics.php

The UA string is currently empty. (Maybe somebody just flipped it)

Comment 8

[Luke Crouch [:groovecoder]]

the config change didn't affect local so I think we'll have to do this with a template/skin change.

Comment 9

[Luke Crouch [:groovecoder]]

Attachment: remove analytics call

Comment 10

[Craig Cook (:craigcook)]

Comment on attachment 604604 [details] [diff] [review]
remove analytics call

Patch applied in r102846

Comment 11

[raymond [:retornam] (inactive)]

qa-verified-trunk https://developer-stage9.mozilla.org/en/HTML

Comment 12

[raymond [:retornam] (inactive)]

verified fixed https://developer.mozilla.org/en-US/