GDPR Checklist

[ankane]

Summary

IP masking, anonymity sets, and no more cookies

Checklist

Completed items are on master branch

• [x] Mask IPs with Ahoy.mask_ips = true (side effect: reduces geocoding accuracy)
• [x] Add Ahoy.cookies = false to function server-side without cookies
• [x] Add Ahoy.configure({cookies: false}) to Ahoy.js to function client-side without cookies
• [x] Create readme instructions

IP Masking

Same approach as Google Analytics IP Anonymization

• IPv4 - set last octet to 0
• IPv6 - set last 80 bits to zeros

Anonymity Sets & Cookies

Instead of cookies, use the following formula for visit and visitor tokens.

uuid_v5("visit(or)/#{masked_ip_address}/#{user_agent}")

Visitors with the same masked IP address (see above) and user agent combo will be grouped together into an anonymity set

Note: Visits have an infinite duration - one approach is to add the current date/week to the hash, but this will interfere with active visits during switchover

Readme instructions

Update config/initializers/ahoy.rb to:

class Ahoy::Store < Ahoy::DatabaseStore
  def authenticate(data)
    # do not link visits and users automatically
  end
end

Ahoy.mask_ips = true
Ahoy.cookies = false

If you use JavaScript tracking, set:

ahoy.configure({cookies: false});

Notes

• Encryption: Should already to do this with config.force_ssl
• Data deletion: Data is stored in your data store, so already have full control

Resources

• GDPR Checklist

[rauhryan]

This is great! thank you guys

Just started pulling ahoy into our app and excited to see this coming

Much appreciated and I'll try and help out if I find an opportunity

[ankane]

Just released 2.1.0 with this

[tolhzar]

Note: Visits have an infinite duration - one approach is to add the current date/week to the hash, but this will interfere with active visits during switchover

@ankane is there a way to expire visit or set a duration somehow in that case?

[ACPK]

@ankane - Using Javascript, how would I allow Ahoy to track the user based on the user's answer to a "GDPR-compliant cookies notice"?

We'd also like to be able to automatically it off on certain sections of the site rather than application-wide.

[iamajvillalobos]

With GDPR settings on, can we still get unique visits properly?