Show HN: Google Analytics alternative with the most generous free tier(beamanalytics.io)
beamanalytics.io
Show HN: Google Analytics alternative with the most generous free tier
https://beamanalytics.io/
97 comments
I'm interested in Beam Analytics partly because I personally find the new Google Analytics 4 user interface (especially around cohorts) to be surprisingly frustrating to use, and I have used the previous versions of Google Analytics for 10+ years. Is it just me, or did Google Analytics 4 also just get redesigned in a strangely more frustrating way?
I would suggest PostHog. They do have 1 Million/month event free tier and can be self hosted. Love their offering and been using it for a year now without any problem.
Last time I looked at PostHog, their documentation for self-hosting had the tone that you’d be an idiot to use it for anything other than a small experiment and that it would fall over for any production workloads. It actively discouraged me from going any further with PostHog.
I wonder if they acquired Urchin (GA, ~2005, so well before they started cornering mobile/browser markets) to start building out and improving their rankings through the data. If they have user data through Chrome, why would they want to keep footing the bill for hosting free analytics for everyone? What easier way would there be to kick everyone off than launching GA4, which seems to be universally despised? Google's liaisons have said that the data from GA was firewalled, but I'm more skeptical, since a lot of times they say things opposite of what many have actually observed.
they could have.. I dunno... maybe start charging for it instead of effectively murdering the product?
> they could have.. I dunno... maybe start charging for it instead of effectively murdering the product?
Google Analytics has a paid tier but I remember someone on reddit joked like the price is probably too high because they don't even show it publicly...
Google Analytics has a paid tier but I remember someone on reddit joked like the price is probably too high because they don't even show it publicly...
GA Premium started at $100k/yr ~10 years ago and pretty much only disabled sampling on reports and added additional custom dimensions. This was pre-360 days and was 5x what we were paying for Adobe Analytics. Once you get to those levels, Snowflake/Segment/CDP type platforms combined with your own storage and COTS BI tooling become more appealing due to flexibility and data portability.
What CDP type platforms do you recommend? Adobe CDP?
it's unusable! I'm sure someone can use it, but the old one needed almost no explanation, and this... I'm definitely shopping around now
I don't think using the word "best" on the landing page is very smart.
In fact, you don't even provide a demo page of your own analytics, so how exactly is a anyone supposed to judge whether or not you're the "best", not to mention be comparable to something like Plausible, which has always shown its own analytics as a demo experience.
There's definitely a market for this kind of analytics (many similar products have been launched in the last 2 years), but you should probably rethink your strategy a little bit.
At the moment, the site feels quite bland (maybe it is a side project, I don't know) and you should perhaps focus more on explaining how you achieve certain things (E.g. How exactly are you compliant?).
In fact, you don't even provide a demo page of your own analytics, so how exactly is a anyone supposed to judge whether or not you're the "best", not to mention be comparable to something like Plausible, which has always shown its own analytics as a demo experience.
There's definitely a market for this kind of analytics (many similar products have been launched in the last 2 years), but you should probably rethink your strategy a little bit.
At the moment, the site feels quite bland (maybe it is a side project, I don't know) and you should perhaps focus more on explaining how you achieve certain things (E.g. How exactly are you compliant?).
Note that despite the claims of GDPR compliance, Beam is likely _not_ GDPR compliant for a few different reasons. Going off of this doc[0], a few things stand out.
First, there's a Javascript snippet you add to your site to set up Beam. That Javascript snippet loads additional Javascript from beamanalytics.b-cdn.net. If you add the Beam provided Javascript to your site, every time a user visits your site, their IP address will be shared with beamanalytics.b-cdn.net. If the user didn't consent to sharing their IP address with beamanalytics.b-cdn.net, you do not have a lawful basis[1] for sharing the user's IP with beamanalytics.b-cdn.net.
Second, there's this notion that because Beam hashes IP address that "anonymizes" the data[0][2]. According to GDPR, this is actually "pseudonymisation"[3]. If you know what hash function is used, you can still tie back the hashed data to the original user. Pseudonymized data still meets the GDPR definition of personal data[3] so applying this hash doesn't actually do anything in terms of helping with GDPR compliance.
First, there's a Javascript snippet you add to your site to set up Beam. That Javascript snippet loads additional Javascript from beamanalytics.b-cdn.net. If you add the Beam provided Javascript to your site, every time a user visits your site, their IP address will be shared with beamanalytics.b-cdn.net. If the user didn't consent to sharing their IP address with beamanalytics.b-cdn.net, you do not have a lawful basis[1] for sharing the user's IP with beamanalytics.b-cdn.net.
Second, there's this notion that because Beam hashes IP address that "anonymizes" the data[0][2]. According to GDPR, this is actually "pseudonymisation"[3]. If you know what hash function is used, you can still tie back the hashed data to the original user. Pseudonymized data still meets the GDPR definition of personal data[3] so applying this hash doesn't actually do anything in terms of helping with GDPR compliance.
[0]: https://beamanalytics.io/data
[1]: https://gdpr-info.eu/art-6-gdpr/
[2]: https://news.ycombinator.com/item?id=35539476#35546091
[3]: https://gdpr-info.eu/art-4-gdpr/If pulling a third party resource is not compliant then loading from any cdn is non compliant. Can a website not even load an external font resource?
Loading fonts from Google Fonts for example is indeed considered not GDPR compliant without consent, because it reveals your visitors IP addresses. You can self hosts the fonts however and then it should be fine.
There was at least one German court that considered that non-compliant: https://www.reddit.com/r/gdpr/comments/sg8sll/no_legitimate_...
They've gone insane.
> If pulling a third party resource is not compliant then loading from any cdn is non compliant
Loading data from a third party can be GDPR compliant, but isn't always. One legal basis for processing personal data is "legitimate interest"[0]. Legitimate interest is incredibly vague. In short, it allows you to process data as long as doing so is necessary or of critical important to your business.
As an example, in order for someone to visit your website, you need to receive and process their IP address. That's just how TCP works. Since you have a "legitimate interest" to process their IP address so they can visit your site, you don't need to ask for consent before processing their IP. Similarly, since DDOS prevention is critical for maintaining your website, you are allowed to process IP address for DDOS prevention as long as you intend to process the IP only for DDOS prevention.
For your specific question, a website loading an external font resource would likely fall under legitimate interest since the font is necessary for the website to function.
Since user analytics is not necessary or critical to a business, you cannot share IP address with a third party if the intent of doing so is so you can perform analytics on your users.
[0]: https://gdpr-info.eu/art-6-gdpr/
Loading data from a third party can be GDPR compliant, but isn't always. One legal basis for processing personal data is "legitimate interest"[0]. Legitimate interest is incredibly vague. In short, it allows you to process data as long as doing so is necessary or of critical important to your business.
As an example, in order for someone to visit your website, you need to receive and process their IP address. That's just how TCP works. Since you have a "legitimate interest" to process their IP address so they can visit your site, you don't need to ask for consent before processing their IP. Similarly, since DDOS prevention is critical for maintaining your website, you are allowed to process IP address for DDOS prevention as long as you intend to process the IP only for DDOS prevention.
For your specific question, a website loading an external font resource would likely fall under legitimate interest since the font is necessary for the website to function.
Since user analytics is not necessary or critical to a business, you cannot share IP address with a third party if the intent of doing so is so you can perform analytics on your users.
[0]: https://gdpr-info.eu/art-6-gdpr/
> For your specific question, a website loading an external font resource would likely fall under legitimate interest since the font is necessary for the website to function.
Google Fonts was ruled to be non-compliant: https://www.theregister.com/2022/01/31/website_fine_google_f...
You can work around this by just uploading the font to your own website.
Google Fonts was ruled to be non-compliant: https://www.theregister.com/2022/01/31/website_fine_google_f...
You can work around this by just uploading the font to your own website.
Specifically, a website operator using Google Fonts was ruled to be non-compliant, for not disclosing that they were doing so, and refusing to honour their preference of the user.
I think a pure-play hosting service is probably fine for hosting fonts and relying on legitimate interest, but that's not Google, who is not being paid directly for hosting the fonts, and who actively wants to use the users' information for marketing purposes that the user clearly does not want.
I think a pure-play hosting service is probably fine for hosting fonts and relying on legitimate interest, but that's not Google, who is not being paid directly for hosting the fonts, and who actively wants to use the users' information for marketing purposes that the user clearly does not want.
So using jQuery from a CDN would also cause a fine?
I'm no lawyer, but I think that will depend on a number of factors. One important distinction is whether the CDN is based in Europe (or a country that has received an adequacy decision) or not. The details of your data processing agreement with the CDN will also matter, I assume.
In practice, I doubt someone will go through the legal trouble for something like jQuery. If you want to be sure, self-host your resources; it's not like using CDNs will give you any speed advantage anymore with modern browsers isolating websites.
In practice, I doubt someone will go through the legal trouble for something like jQuery. If you want to be sure, self-host your resources; it's not like using CDNs will give you any speed advantage anymore with modern browsers isolating websites.
Depends on the CDN.
If you pay the CDN, and they're not using your customers' data to make money, then probably not.
If you don't, or they do, then it's a violation of EU law if you do not allow (at least) EU users to easily control the use of that CDN. If you are making money, and you try telling the regulator that for your business, that you need (legitimate interest) to have jQuery hosted by a CDN that is using EU personal data illegally, then you might get a fine if they are reachable by the EU, because very few judges are going to believe that bullshit.
If you pay the CDN, and they're not using your customers' data to make money, then probably not.
If you don't, or they do, then it's a violation of EU law if you do not allow (at least) EU users to easily control the use of that CDN. If you are making money, and you try telling the regulator that for your business, that you need (legitimate interest) to have jQuery hosted by a CDN that is using EU personal data illegally, then you might get a fine if they are reachable by the EU, because very few judges are going to believe that bullshit.
It can be compliant if you have a GDPR data processing agreement with the third party and you inform the end users about the processing.
Agree, I think you need to self-host your analytics to be compliant. The main idea of GDPR is to NOT send data to third-parties.
For a simple analytics try https://counter.dev/ which is _open source_ which is a must for proper privacy
Simple Analytics is also simple analytics :)
https://www.simpleanalytics.com
https://www.simpleanalytics.com
Do they have a free plan?
They mention this in the pricing page:
> After your trial expires, your plan downgrades automatically to the basic free version.
But it's not explained what are the features of that plan.
They mention this in the pricing page:
> After your trial expires, your plan downgrades automatically to the basic free version.
But it's not explained what are the features of that plan.
Seems similar to Umami (also open source).
https://umami.is/
https://umami.is/
looks interesting. Why is there no release though?
Hey ho, I am the maintainer of counter.dev. Hmm what you mean with release. It did got two times on the hacker news front page and there is a self hosting golang executable in a seperate but linked github repo as a github release.
What you mean with release :-) Le't see if I can do it.
What you mean with release :-) Le't see if I can do it.
Thanks for the clarification. We have: https://github.com/ihucos/counter.dev-selfhost/releases :-)
It's on another repo because for self-hosting we "white label" it stripping the logo and so on.
It's on another repo because for self-hosting we "white label" it stripping the logo and so on.
<3
https://beamanalytics.io/blog/proxying-beam-through-cloudfla...
"Proxying Beam Analytics through Cloudflare"
"Use proxying to avoid adblockers distorting your data"
How does bypassing content/tracking/ad blockers fit into your privacy narrative?
"Proxying Beam Analytics through Cloudflare"
"Use proxying to avoid adblockers distorting your data"
How does bypassing content/tracking/ad blockers fit into your privacy narrative?
Why do people need things like Google Analytics when they can just self-host? I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results. But 3-rd party alternatives can't do this anyway or can they?
Yes. There are a number of powerful self-hostable open-source website analytics solutions, for example https://github.com/matomo-org/matomo.
Matomo is nice, and a 1 click install in Wordpress as well.
matomo and goatcounter are nice, but there are even solutions which don't need any extra CPU or any extra client request:
• https://goaccess.io/
• https://www.awstats.org/
Both of them are free/open-source.
• https://goaccess.io/
• https://www.awstats.org/
Both of them are free/open-source.
This is pretty old school, lots of sites these days don't have server logs
[deleted]
Self-hosting is a pain for technical teams, let alone the average user of GA who doesn't really want to deal with self hosting at all. My experience with self-hosted solution (Posthog) was really bad and we had to switch to their cloud-based option.
A pain in what sense? I self-host my own stuff and had fewer issues than with services. I also know many people self-hosting their own platforms, and they rarely encounter problems. Stuff usually doesn't break by itself, it breaks when things are changed.
> I thought the reason people rather use actual Google Analytics is Google's ability to track specific people across multiple websites and promote websites with Analytics in the search results.
This... isn't possible
This... isn't possible
[deleted]
Appreciate the free tier. I seem to recall looking around at analytics options and them being too expensive for my idle projects.
Is there more documentation on "custom events" (listed on the pricing page)? I assume this is just an API I can arbitrarily ping. Can that be used for cohort/funnel analysis instead of a /page; e.g. for a single-page app?
Is there more documentation on "custom events" (listed on the pricing page)? I assume this is just an API I can arbitrarily ping. Can that be used for cohort/funnel analysis instead of a /page; e.g. for a single-page app?
Yes absolutely! You can use custom events in both funnels and cohort analysis. You can read more about it here https://beamanalytics.io/blog/custom-events-on-beam
I have to admit, that I find centralized analytics as a service just really difficult to reconcile with higher degrees of privacy.
That’s why I still prefer analytics solutions that can be self hosted.
That’s why I still prefer analytics solutions that can be self hosted.
Why is it that I always have to "talk to you" when I'm at a big company to get a quote, instead of just receiving some standard price I can see on the page?
Is it because, working for a big company, there's a sales target on my back and you want to use that to extract the maximum tolerable pricing from my group, just because you can?
Is it because my use case is so complicated you think that you need to offer me value-added services that help you achieve the margins you want?
Why is it that you, even just as an individual with a startup idea, have already fallen into this kind of pricing behavior? Where did you learn to do this? Do you already have VC-backed sales people telling you to do this?
Why is this such a common practice?
Maybe that's why I use other services that at least treat me the same as everyone else.
Is it because, working for a big company, there's a sales target on my back and you want to use that to extract the maximum tolerable pricing from my group, just because you can?
Is it because my use case is so complicated you think that you need to offer me value-added services that help you achieve the margins you want?
Why is it that you, even just as an individual with a startup idea, have already fallen into this kind of pricing behavior? Where did you learn to do this? Do you already have VC-backed sales people telling you to do this?
Why is this such a common practice?
Maybe that's why I use other services that at least treat me the same as everyone else.
Is this only about big companies? I work in a small-to-medium company and people still want to talk to me (even though I write them great detailed and unambiguous emails specifically because I hate calling) every now and then.
Thanks for the generous free tier. I used plausible for a month then shifted to cloudflare web-analytics, that also has a free tier. Cloudflare UI is very basic, will give beamanalytics a try. Would appreciated if there were any comparisons.
How do you justify GDPR compliance?
GDPR compliance is not to be confused with privacy.
You don't have Data Protection Officer (even if you have one, you ought to publish their details). Neither does Plausible.
Your privacy policy lacks details, e.g.: where you process data and what is data retention.
You are incorporated in not an Adequate Country, meaning you face challenges becoming GDPR-compliant without additional measures that span beyond SCCs. Similarly to Fathom (BC is not under PIPEDA, hence is not adequate).
Privacy-friendly? Probably. GDPR-compliant? No.
GDPR compliance is not to be confused with privacy.
You don't have Data Protection Officer (even if you have one, you ought to publish their details). Neither does Plausible.
Your privacy policy lacks details, e.g.: where you process data and what is data retention.
You are incorporated in not an Adequate Country, meaning you face challenges becoming GDPR-compliant without additional measures that span beyond SCCs. Similarly to Fathom (BC is not under PIPEDA, hence is not adequate).
Privacy-friendly? Probably. GDPR-compliant? No.
Hi - this is the other co-founder of Beam. Thank you for your comments and questions.
1. We are incorporated in the UK. I could be wrong but I think the European Commission did indicate that the UK was an Adequate Country?
https://commission.europa.eu/law/law-topic/data-protection/i...
2. For the details that our privacy policy lacks, I think they can be found in our Data Policy. Any further issues, please let us know.
https://beamanalytics.io/data
3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed.
https://commission.europa.eu/law/law-topic/data-protection/r...
The definition of sensitive data can be found on this EU site and Beam does not process any of this type of data.
https://commission.europa.eu/law/law-topic/data-protection/r...
1. We are incorporated in the UK. I could be wrong but I think the European Commission did indicate that the UK was an Adequate Country?
https://commission.europa.eu/law/law-topic/data-protection/i...
2. For the details that our privacy policy lacks, I think they can be found in our Data Policy. Any further issues, please let us know.
https://beamanalytics.io/data
3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed.
https://commission.europa.eu/law/law-topic/data-protection/r...
The definition of sensitive data can be found on this EU site and Beam does not process any of this type of data.
https://commission.europa.eu/law/law-topic/data-protection/r...
Re-read that link at #3. Here's the key bit.
"its core activities involve processing of sensitive data on a large scale ---> OR <--- involve large scale, regular and systematic monitoring of individuals"
Any analytics provider is fundamentally doing "large scale, regular and systematic monitoring of individuals".
"its core activities involve processing of sensitive data on a large scale ---> OR <--- involve large scale, regular and systematic monitoring of individuals"
Any analytics provider is fundamentally doing "large scale, regular and systematic monitoring of individuals".
I was hoping to find something like this mentioned in here. I’ve worked on a tracking tool that I don’t think does tracking of “individuals”. Instead I’m collecting stats about the site and impressions on its pages. It’s actually very, very simple. I am not tracking visitors and I don’t log IP addresses. It doesn’t set any cookies or anything else in the browser.
I built this to track my own sites but I am curious if anyone else cares. I created a landing page to see if there’s any interest.
https://protectivemetrics.com
The product is working on a few sites of my own and is hosted on a raspberry pi in my home office. I’d need to do some work to make it available for others, but I don’t want to invest more into it unless there’s any interest.
I built this to track my own sites but I am curious if anyone else cares. I created a landing page to see if there’s any interest.
https://protectivemetrics.com
The product is working on a few sites of my own and is hosted on a raspberry pi in my home office. I’d need to do some work to make it available for others, but I don’t want to invest more into it unless there’s any interest.
Heads up your site has a grey background and white text when using system dark mode on Firefox mobile.
Yes, you are right that there is another part of the definition about large scale, regular and "systematic monitoring" of individuals. Apologies for not including that in the answer above.
Quoting from WP 243 Annex provided by the EU:
"The notion of regular and systematic monitoring of data subjects is not defined in the GDPR, but clearly includes all forms of tracking and profiling on the internet, including for the purposes of behavioural advertising. However, the notion of monitoring is not restricted to the online environment."
The link is here
https://ec.europa.eu/information_society/newsroom/image/docu...
We anonymize and aggregate all data so can't track or profile any users, or do such monitoring offline.
Quoting from WP 243 Annex provided by the EU:
"The notion of regular and systematic monitoring of data subjects is not defined in the GDPR, but clearly includes all forms of tracking and profiling on the internet, including for the purposes of behavioural advertising. However, the notion of monitoring is not restricted to the online environment."
The link is here
https://ec.europa.eu/information_society/newsroom/image/docu...
We anonymize and aggregate all data so can't track or profile any users, or do such monitoring offline.
Off topic: This comment reads so much like a message in ChatGPT conversation :D
1. My apologies. I as looking at the link from WordPress. Right. As UK entity you are good.
2. Your subprocessor uses AWS. No way to stay compliant if you transmit visitor IP to US cloud (even if they use European servers).
3. Sadly, wrong. You should immediately consult privacy professional. DPO is necessary. There are 3 tests.
https://ico.org.uk/for-organisations/does-my-organisation-ne...
Answer to question 2 is yes btw.
You are not compliant without DPO and because you are using AWS, even if indirectly.
2. Your subprocessor uses AWS. No way to stay compliant if you transmit visitor IP to US cloud (even if they use European servers).
3. Sadly, wrong. You should immediately consult privacy professional. DPO is necessary. There are 3 tests.
https://ico.org.uk/for-organisations/does-my-organisation-ne...
Answer to question 2 is yes btw.
You are not compliant without DPO and because you are using AWS, even if indirectly.
Thank you for your follow up.
1. Glad we're in agreement!
2. We agree it is not GDPR compliant to transmit IP address data to the US. This is why we salt and hash all PII data so no IP address data is sent to the US. Please see our data policy.
https://beamanalytics.io/data
3. Thank you for your suggestion. We have already consulted privacy professionals and have been assured no DPO is required.
Thank you for this conversation about GDPR. We appreciate your interest in Beam's work.
1. Glad we're in agreement!
2. We agree it is not GDPR compliant to transmit IP address data to the US. This is why we salt and hash all PII data so no IP address data is sent to the US. Please see our data policy.
https://beamanalytics.io/data
3. Thank you for your suggestion. We have already consulted privacy professionals and have been assured no DPO is required.
Thank you for this conversation about GDPR. We appreciate your interest in Beam's work.
>salt and hash all PII data
Can you share more detail on this? On this page[1], I see this:
[1] https://beamanalytics.io/data
Can you share more detail on this? On this page[1], I see this:
hash(pepper(salt(ip address + user agent data))) = anonymized hashed data
[1] https://beamanalytics.io/data
Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?
There is a way to use AWS assuming you can assure no Personal Data is processed in plain text on AWS.
There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS.
They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS.
Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups.
There are valid use cases. But these are very limited.
There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS.
They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS.
Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups.
There are valid use cases. But these are very limited.
Aula - a system used for communication between parents and schools in Denmark - is using AWS. They use encryption and ensures that only European datacenters are used.
Source (in Danish): https://aulainfo.dk/guide-til-projektledere/sikkerhed-i-aula...
IANAL but as I understand it there is, currently, no way to legally use a service for personal data handling that falls under the US CLOUD act.
In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS.
Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment.
Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly).
If I recall correctly there are EU-US talks to create Privacy Shield #3.
In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS.
Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment.
Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly).
If I recall correctly there are EU-US talks to create Privacy Shield #3.
> I think the European Commission did indicate that the UK was an Adequate Country?
Every so often I see something like this:
https://www.mayerbrown.com/en/perspectives-events/publicatio...
I suspect the UK is planning a number of changes that may change this, so even though I'm British, for the avoidance of doubt I prefer companies actually hosted in the EU and that will agree to conduct business in Europe (and thus under EU courts, rather than GB ones).
> 3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed.
You are totally incorrect about that.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
Every so often I see something like this:
https://www.mayerbrown.com/en/perspectives-events/publicatio...
I suspect the UK is planning a number of changes that may change this, so even though I'm British, for the avoidance of doubt I prefer companies actually hosted in the EU and that will agree to conduct business in Europe (and thus under EU courts, rather than GB ones).
> 3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed.
You are totally incorrect about that.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
I was linked to this post by a friend regarding the comments you made about Fathom's GDPR compliance.
1. The GDPR is regulation from the European Union
2. PIPEDA has an Exemption order for BC (British Columbia, Canada) and applies "in respect of the collection, use and disclosure of personal information that occurs within the Province of British Columbia".
Firstly, the Exemption order states "Whereas the Governor in Council is satisfied that the Personal Information Protection Act, S.B.C. 2003, c. 63, of the Province of British Columbia, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act, applies to the organizations described in the annexed Order;"
Secondly, which part of BC's Personal Information Protection Act would undermine it's adequacy ruling under the GDPR?
Finally, let's get into Fathom's pageview/event collection script and explain how it works:
1. There is no collection, use and disclosure of personal information that occurs within the Province of British Columbia
2. EU traffic is automatically routed via EU Isolation and processed on German-owned servers. This allows us to stop US government snooping on EU traffic
3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this.
I'll wait back to hear back from you on which parts of the BC's PIPA undermine the adequacy ruling. Our lawyer here in Canada is incredibly well versed in Canadian privacy law, so we can definitely loop her in if there's any confusion here.
I hope that addresses your point and helps inform other people who may be reading this.
1. The GDPR is regulation from the European Union
2. PIPEDA has an Exemption order for BC (British Columbia, Canada) and applies "in respect of the collection, use and disclosure of personal information that occurs within the Province of British Columbia".
Firstly, the Exemption order states "Whereas the Governor in Council is satisfied that the Personal Information Protection Act, S.B.C. 2003, c. 63, of the Province of British Columbia, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act, applies to the organizations described in the annexed Order;"
Secondly, which part of BC's Personal Information Protection Act would undermine it's adequacy ruling under the GDPR?
Finally, let's get into Fathom's pageview/event collection script and explain how it works:
1. There is no collection, use and disclosure of personal information that occurs within the Province of British Columbia
2. EU traffic is automatically routed via EU Isolation and processed on German-owned servers. This allows us to stop US government snooping on EU traffic
3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this.
I'll wait back to hear back from you on which parts of the BC's PIPA undermine the adequacy ruling. Our lawyer here in Canada is incredibly well versed in Canadian privacy law, so we can definitely loop her in if there's any confusion here.
I hope that addresses your point and helps inform other people who may be reading this.
https://iapp.org/news/a/schrems-ii-impact-on-data-flows-with...
> To date, Alberta, British Columbia, and Quebec have privacy legislation that takes commercial activities in those provinces out of the federal jurisdiction through the "substantial similarity" exemption to PIPEDA. Federal privacy law defers to provincial law if a province meets the substantial similarity test, providing a baseline of privacy regulation across Canada. This division of authority is important, because for provinces recognized as substantially similar, their laws have not been given the stamp of "adequacy."
I might have framed my statement too strongly. Fathom can be GDPR compliant assuming additional contractual clauses are in place. That is what is mentioned in the linked IAPP assessment.
> 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this.
The same could be said about Amazon, Google, and Azure employees and their data centre employees in Europe. What matters is effective control. You are not in BC but the company, and your position and responsibilities are governed by the laws of the province of British Columbia.
Although, in the case of Canada, SCCs will be actually effective as there are no surveillance laws similar to the US.
> To date, Alberta, British Columbia, and Quebec have privacy legislation that takes commercial activities in those provinces out of the federal jurisdiction through the "substantial similarity" exemption to PIPEDA. Federal privacy law defers to provincial law if a province meets the substantial similarity test, providing a baseline of privacy regulation across Canada. This division of authority is important, because for provinces recognized as substantially similar, their laws have not been given the stamp of "adequacy."
I might have framed my statement too strongly. Fathom can be GDPR compliant assuming additional contractual clauses are in place. That is what is mentioned in the linked IAPP assessment.
> 3. Fathom Analytics is incorporated in BC. But nobody in BC has access to our EU Isolation infrastructure. I'm the CTO of Fathom Analytics and I have access to our EU Isolation infrastructure. I'm not in BC. Additional access to EU Isolation is from Germany only. Heck, not even GitHub Actions has access to EU Isolation, we self-host GitLab to keep things completely isolated. We put a lot of time and effort into this.
The same could be said about Amazon, Google, and Azure employees and their data centre employees in Europe. What matters is effective control. You are not in BC but the company, and your position and responsibilities are governed by the laws of the province of British Columbia.
Although, in the case of Canada, SCCs will be actually effective as there are no surveillance laws similar to the US.
1. I understand the piece about "stamp" of adequacy. But when the Schrems II ruling happened, the world learned that we cannot always rely on "stamps" and need to look into the laws. At this moment in time, the European Commission says that Canada has adequacy ruling as a whole and there is no note about it not apply to British Columbia.
So my question to you is: Which part of the Personal Information Protection Act in BC would undermine the EU's adequacy decision towards BC? The reason I'm pushing on this question is because the "stamp" occurs for a reason. Please let me know where the PIPA would lead to the European Commission labelling BC as inadequate.
2. We're mixing things up here with Amazon, Google and Azure. Those companies are subject to FISA 702[1] and EO12333[2]. We are not subject to these surveillance laws here in Canada. I've spoken at length about this before, about how the US government could compel one of these companies to secretly spy on people using their EU infrastructure. So our company is not in the same position.
I'll wait for your specifics around the PIPA.
[1] https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveilla... [2] https://en.wikipedia.org/wiki/Executive_Order_12333
So my question to you is: Which part of the Personal Information Protection Act in BC would undermine the EU's adequacy decision towards BC? The reason I'm pushing on this question is because the "stamp" occurs for a reason. Please let me know where the PIPA would lead to the European Commission labelling BC as inadequate.
2. We're mixing things up here with Amazon, Google and Azure. Those companies are subject to FISA 702[1] and EO12333[2]. We are not subject to these surveillance laws here in Canada. I've spoken at length about this before, about how the US government could compel one of these companies to secretly spy on people using their EU infrastructure. So our company is not in the same position.
I'll wait for your specifics around the PIPA.
[1] https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveilla... [2] https://en.wikipedia.org/wiki/Executive_Order_12333
Disclaimer: I am not a Privacy Lawyer, I am basing what I wrote here on the text of IAPP. I was looking for a reviewed PIPEDA adequacy decision. I saw references about it coming in 2020, then 2021, then 2022. Can't really find anything specific.
RE: 1
I am looking at this document: https://www.bclaws.gov.bc.ca/civix/document/id/complete/stat...
I assume this is up-to-date.
I will take one example: the Right to be forgotten. I don't see provision that satisfies the right to be forgotten: https://gdpr.eu/right-to-be-forgotten/
You seem to have a more in-depth understanding of PIPA. Can you point me towards a similar requirement in PIPA?
Looking at C-27, it appears that even PIPEDA is playing catch-up. But that was CPPA.
Btw. I am not suggesting Adequacy is always decided on privacy laws being EXACTLY like GDPR. Given the only reference to adequacy I found thus far was based on a 2001 review, I am not sure what would be appropriate criteria here beyond access to "an appropriate" level of legal protection.
The text in IAPP article refers to the adequacy of PIPEDA. Not Canada. It is actually interesting that there is no adequacy with Canada, but only with Canadian PIPEDA.
RE 2:
Right, I was referring to the fact that customers of Fathom sign contract/get into agreement with a company in British Columbia under its laws. It is mostly irrelevant where their CTO resides (it would be relevant if you resided in a non-adequate country, as your privacy policy would have to account for relevant data transfers).
RE: 1
I am looking at this document: https://www.bclaws.gov.bc.ca/civix/document/id/complete/stat...
I assume this is up-to-date.
I will take one example: the Right to be forgotten. I don't see provision that satisfies the right to be forgotten: https://gdpr.eu/right-to-be-forgotten/
You seem to have a more in-depth understanding of PIPA. Can you point me towards a similar requirement in PIPA?
Looking at C-27, it appears that even PIPEDA is playing catch-up. But that was CPPA.
Btw. I am not suggesting Adequacy is always decided on privacy laws being EXACTLY like GDPR. Given the only reference to adequacy I found thus far was based on a 2001 review, I am not sure what would be appropriate criteria here beyond access to "an appropriate" level of legal protection.
The text in IAPP article refers to the adequacy of PIPEDA. Not Canada. It is actually interesting that there is no adequacy with Canada, but only with Canadian PIPEDA.
RE 2:
Right, I was referring to the fact that customers of Fathom sign contract/get into agreement with a company in British Columbia under its laws. It is mostly irrelevant where their CTO resides (it would be relevant if you resided in a non-adequate country, as your privacy policy would have to account for relevant data transfers).
Fathom's script forgets everybody by default, it's literally built into the tech. No EU personal data is touching Canada.
The background of Schrems II was that the US government can compel US companies to track foreign nationals and it would be lawful under US law. This is where the argument of "company in X under Y laws" comes into play. For example, Amazon is a US company. An EU subsidiary is still subject to it's parents control. If that parent is a US company, it's subject to US surveillance laws. Hello Schrems II.
So I'm not fully following why we're having a discussion around processing happening in Canada when personal data (IP Address) hits our EU Isolation infrastructure.
If you have any sources you can cite where the European Commission states BC as an exemption to Canada's adequacy ruling, please throw it back to me. I've not seen that.
The background of Schrems II was that the US government can compel US companies to track foreign nationals and it would be lawful under US law. This is where the argument of "company in X under Y laws" comes into play. For example, Amazon is a US company. An EU subsidiary is still subject to it's parents control. If that parent is a US company, it's subject to US surveillance laws. Hello Schrems II.
So I'm not fully following why we're having a discussion around processing happening in Canada when personal data (IP Address) hits our EU Isolation infrastructure.
If you have any sources you can cite where the European Commission states BC as an exemption to Canada's adequacy ruling, please throw it back to me. I've not seen that.
This is exactly why I ignore the GDPR.
This applies to Plausable as well as to BeamAnalytics: You claim that the data of your users "belongs to them" and only to them.
Question: "How can any of your users verify that you're not selling their data?"
There's no way other than believing your word. And you have access to the DB. Therefore, given that your claims and the ones of Plausable, can't actually be verified by their users, any time, how is your service different from Google Analytics than? At least with Google Analytics one knows that there's no privacy.
In your case the user doesn't know it with certanty because he can't verify it, but he assumes that everything is performed correctly and privacy-friendly -- by taking your, and the owners of Plausible, word for it. It's based mostly on believe, that is.
Question: "How can any of your users verify that you're not selling their data?"
There's no way other than believing your word. And you have access to the DB. Therefore, given that your claims and the ones of Plausable, can't actually be verified by their users, any time, how is your service different from Google Analytics than? At least with Google Analytics one knows that there's no privacy.
In your case the user doesn't know it with certanty because he can't verify it, but he assumes that everything is performed correctly and privacy-friendly -- by taking your, and the owners of Plausible, word for it. It's based mostly on believe, that is.
I started to watch the Beam video, and here is some immediate and simple constructive criticism:
(1) Have the picture of your face BIGGER. Then SMILE and be HAPPY, even a little enthusiastic.
(2) Don't drop your voice volume at the end of sentences. Speak VERY clearly: Enunciate the words clearly. E.g., write out the narration and practice reading it.
(3) Be sure the room and microphone give good sound quality. Have the sound volume HIGH, TOO high, and let the users reduce the sound volume at their end if they wish.
(4) If you know a women who would do you a favor, have her do the narration. Write out carefully a clear narration you want her to say. Better still if she is reasonably pretty, not glamorous but professional and still pretty.
(5) There is a lot of numerical data on your screen that is unreadable to 80+% of your target audience. If some text or data is unreadable, then reformat it or just omit it from the presentation. Generally don't put anything on the screen that is unreadable. In simple terms, use a large font 100% black on a white or at least light background.
(6) Early in the video there is a graph. There are two curves that are easy to see, but there is annotation on the two axes that is unreadable due to being too small and not dark enough. For such annotation, make it big, black, and easy to read.
(7) You may be assuming too much for your best targeted audience, the one with nearly all your candidate customers. E.g., I'm doing a startup, a Web site, have the code running as intended, likely will want some analytics, but so far have had no occasion to find out just what "Google Analytics" is. So, I'm a candidate customer, but to sell to me something or someone will have to give me at least a 101 level introduction to Web site analytics -- it is to your advantage for the part of your audience that needs the 101 introduction for that someone to be you.
(1) Have the picture of your face BIGGER. Then SMILE and be HAPPY, even a little enthusiastic.
(2) Don't drop your voice volume at the end of sentences. Speak VERY clearly: Enunciate the words clearly. E.g., write out the narration and practice reading it.
(3) Be sure the room and microphone give good sound quality. Have the sound volume HIGH, TOO high, and let the users reduce the sound volume at their end if they wish.
(4) If you know a women who would do you a favor, have her do the narration. Write out carefully a clear narration you want her to say. Better still if she is reasonably pretty, not glamorous but professional and still pretty.
(5) There is a lot of numerical data on your screen that is unreadable to 80+% of your target audience. If some text or data is unreadable, then reformat it or just omit it from the presentation. Generally don't put anything on the screen that is unreadable. In simple terms, use a large font 100% black on a white or at least light background.
(6) Early in the video there is a graph. There are two curves that are easy to see, but there is annotation on the two axes that is unreadable due to being too small and not dark enough. For such annotation, make it big, black, and easy to read.
(7) You may be assuming too much for your best targeted audience, the one with nearly all your candidate customers. E.g., I'm doing a startup, a Web site, have the code running as intended, likely will want some analytics, but so far have had no occasion to find out just what "Google Analytics" is. So, I'm a candidate customer, but to sell to me something or someone will have to give me at least a 101 level introduction to Web site analytics -- it is to your advantage for the part of your audience that needs the 101 introduction for that someone to be you.
Hello from the competition :-) It looks nice. I like how the main value proposition is actually clearly written out and basically can't not be not read. What I'd like is a live demo where you can quickly see what you get.
Just added it to my page, was super easy. It doesn't count the same user reloading the page as a single event though. This can be done without PII so yeah, I'd love to see that to be honest
Can you elaborate more? Is this in web analytics, funnels or cohort retention? Are you doing basic page views or custom events? Feel free to DM or email [email protected] and we can get this sorted out for you!
Just basic page views by throwing the script in and that's it. Nothing fancy
I've been using Beam for a week now - big fan. Analytics are simple enough for my personal projects, and I'm able to add custom event tracking as well which is really nice.
Oh this looks fantastic, thanks for making it!
* Does this mean my site won’t need a cookie alert banner? If no banner, that’s awesome.
* what happens if my hobby site gets an unexpected surge in traffic? Will I get an unexpected bill or will analytics disable and I get to choose whether or not to upgrade ?
Thanks!
> Does this mean my site won’t need a cookie alert banner?
Correct
> what happens if my hobby site gets an unexpected surge in traffic?
Nope. You don't even need to put in CC to sign up. You'll only get billed if you explicitly upgrade. That being said if you are consistently over for many months, we may cut off data ingestion and dashboard access!
Correct
> what happens if my hobby site gets an unexpected surge in traffic?
Nope. You don't even need to put in CC to sign up. You'll only get billed if you explicitly upgrade. That being said if you are consistently over for many months, we may cut off data ingestion and dashboard access!
Wow this is simply not true, Microsoft Clarity is free forever and has better analytics. I recommend it to any founder or builder because it comes with free unlimited heatmap.
https://clarity.microsoft.com/pricing
https://clarity.microsoft.com/pricing
Hmm but is leaving your data with Microsoft much better than with Google? I'd say no.
As a former user of both (for work), I agree and would never use either for my own projects when I can easily set up a self-hosted cookieless matomo instance.
Otoh, my former compliance officer much preferred using MS's product since it explicitly states that it's GDPR and CCPA compliant, while regulator and court decisions against google analytics were piling up in one of the markets we served (EU).
Otoh, my former compliance officer much preferred using MS's product since it explicitly states that it's GDPR and CCPA compliant, while regulator and court decisions against google analytics were piling up in one of the markets we served (EU).
There is also the ePrivacy Directive. From what at the moment seems to me (it changes), it is in principle possible to make a GDPR compliant web analytics SaaS. But it might not be possible to avoid compliance banners given the current ePrivacy Directive. But most people don't know that thing exists.
I have used google analytics, clarity, and fathom for work, and self-hosted matomo for personal projects. Clarity was the worst in terms of traffic analytics. It's more of a poor hotjar alternative than anything.
Have you tried UXWizz? Self-hosted, but also comes with heatmaps and recordings compared to Motomo.
I wouldn't use it just because plausible's design is so shamelessly copied.
What is the problem with Google Analytics? Did it start charging?
Very interesting! Hate the switch to GA4.. Will give this a try!
Why use this when we can go straight with true open source projects for that at way more generous and give you basically everything for free without restrictions. Where all they are selling is some official hosting.
Can I skip the cookie consent pop up if I use Beam?
How would you compare yourself to PostHog?
I've been using Beam Analytics for quite some time and just love it for its neat UI as well as for a generous free tier.
I, too, pay for tailwind UI :P
[deleted]
> GDPR compliant.
The simple fact of sending PII such as IP addresses to a third-party for something that can trivially be done via analyzing existing server logs (without introducing a third-party) already puts this on shaky grounds from a GDPR point of view regardless of everything else.
The simple fact of sending PII such as IP addresses to a third-party for something that can trivially be done via analyzing existing server logs (without introducing a third-party) already puts this on shaky grounds from a GDPR point of view regardless of everything else.
People sometimes mix the terms and occasionally confuse the terminology, as they often associate GDPR with the concept of "not needing a consent banner."
So, yes, you don't need to ask for consent to collect IP addresses to use in analytical purposes or logging.
Consent (Article 6 (1)a [0]) is indeed one of the conditions that can be used to comply with the GDPR requirement that processing must be lawful. Still, there are other conditions available to the controller to ensure lawful processing. There are alternatives (before the list of conditions, it says that "at least one of the following" must be satisfied). Logging IP addresses for security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices.
The GDPR mandates that the entire data processing cycle maintain a high standard of data protection. This implies that personal data transfers to non-European nations are allowed only if they ensure an adequate level of data protection. Otherwise, contractual agreements (SCCs) between data exporters and importers may translate GDPR's provisions into an enforceable agreement with the foreign importer, ensuring their processing aligns with GDPR.
The US had an adequacy decision termed "Privacy Shield," which was revoked due to concerns surrounding the rule of law vis-a-vis US mass surveillance laws. Due to similar reasons, contracts with US-based data importers may also be invalid. Additionally, using EU-based services from US-controlled companies is increasingly becoming worrisome.
Beam's approach relies on a weaker variant, which leverages a hash function to derive a pseudo-random ID from user-identifying information, such as the IP address. Although Beam's technique circumvents the need for a large lookup table, an unscrupulous server operator could log the daily key and use it to recover the original data from hashed IDs.
The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom.
Disclaimer: Consult with your legal; I am just a product guy. Explored the field to do a similar product a while ago.
[0] https://gdpr-info.eu/art-6-gdpr/
The GDPR mandates that the entire data processing cycle maintain a high standard of data protection. This implies that personal data transfers to non-European nations are allowed only if they ensure an adequate level of data protection. Otherwise, contractual agreements (SCCs) between data exporters and importers may translate GDPR's provisions into an enforceable agreement with the foreign importer, ensuring their processing aligns with GDPR.
The US had an adequacy decision termed "Privacy Shield," which was revoked due to concerns surrounding the rule of law vis-a-vis US mass surveillance laws. Due to similar reasons, contracts with US-based data importers may also be invalid. Additionally, using EU-based services from US-controlled companies is increasingly becoming worrisome.
Beam's approach relies on a weaker variant, which leverages a hash function to derive a pseudo-random ID from user-identifying information, such as the IP address. Although Beam's technique circumvents the need for a large lookup table, an unscrupulous server operator could log the daily key and use it to recover the original data from hashed IDs.
The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom.
Disclaimer: Consult with your legal; I am just a product guy. Explored the field to do a similar product a while ago.
[0] https://gdpr-info.eu/art-6-gdpr/
> an unscrupulous server operator could log the daily key and use it to recover the original data from hashed IDs.
> The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom.
This is where the technical compliance meets legal compliance. There is always a risk of breach and malicious actors circumventing even the most advanced technical solutions.
It is not full proof, but having SIGNED Data Processing Agreement can go a long way in case of such a violation. It won't help with technical lapses, but can save your business, by pointing at the legal obligation of your data processor for them to take some heat.
Having a partner from a country with a compatible legal system helps a lot in the execution of such an agreement. We no longer deal with non-EU/EEA entities and avoid anyone who uses US-cloud for data processing. The risk is just not worth it. Not to mention, this simplifies Transfer Impact Assessment.
> The flaw in this approach is that it still hinges on identifying data. While it serves as a good compliance and security measure, it doesn't alter anything significant from GDPR's standpoint. The same applies to competitive solutions like Plausible or Fathom.
This is where the technical compliance meets legal compliance. There is always a risk of breach and malicious actors circumventing even the most advanced technical solutions.
It is not full proof, but having SIGNED Data Processing Agreement can go a long way in case of such a violation. It won't help with technical lapses, but can save your business, by pointing at the legal obligation of your data processor for them to take some heat.
Having a partner from a country with a compatible legal system helps a lot in the execution of such an agreement. We no longer deal with non-EU/EEA entities and avoid anyone who uses US-cloud for data processing. The risk is just not worth it. Not to mention, this simplifies Transfer Impact Assessment.
As an indie hacker, the new Google Analytics (GA4) coming motivated me to look for a straightforward alternative that would also be affordable. I had a few basic product requirements and didn’t want to spend too much to replace a free product. There are a lot of great Google Analytics alternatives out there, but the pricing didn’t seem right. As someone who likes to just build things, many of which aren’t businesses yet, it didn’t make sense to pay for options like Plausible and Fathom out of the gate.
So I joined with a friend to build Beam Analytics. Beam gives you all the standard web analytics. It also comes with easy to create funnels so you can see how users move through your site. And we have a great proxy for cohort retention that doesn’t need you to log any data with us. It’s cookie-less and GDPR compliant.
The free tier is 100k page views per month so hopefully you’ll give it a try. There’s also a Wordpress integration to make integrating with WordPress sites as easy as a single click - https://wordpress.org/plugins/beam-analytics/.
Appreciate your feedback. You can also email us at hi (at) beamanalytics.io or DM me on twitter @TheBuilderJR.