search

disconnectme / disconnect-tracking-protection

Canonical repository for the Disconnect services file
Other
647 stars 221 forks source link

Only block analytics subdomain for Coveo to prevent search pages loading issues #358

Closed larosek closed 3 months ago

larosek commented 3 months ago

Domain(s) to review. Separate them by comma.

coveo.com

Rationale for removing, adding, or recategorizing.

Search pages loading is broken

Where domain(s) observed. Separate them by comma.

No response

Additional notes

Hi Coveo is a service provider offering search tools to its customers. We capture analytics data in order to help our platform enhance the search results we provide to our customers. All the data we capture is unique to each customers, we don't share any analytics data between customers.

We also respects users' privacy preferences. When a user opts out of tracking or sends a do not track header with their requests, we won’t collect any analytics data. Our documentation about data tracking can be found here.

Adding the apex domain coveo.com directly in your list is currently breaking some of our customers search pages, preventing them from loading properly. An example can be found here with one of our demo environment. The page does not load because static.cloud.coveo.com is being blocked

To address this, we provide distinct analytics domain to help services such as disconnect.me to properly block any analytics while keeping the functionality of our service intact. These are the subdomains that we use :

Would it be possible to add only these subdomains to your block list? Thank you

spirillen commented 3 months ago

Adding the apex domain coveo.com directly in your list is currently breaking some of our customers search pages, preventing them from loading properly.

Then the site is written very purely and should be considered as broken by webmaster...

disconnectme commented 3 months ago

Thank you for bringing this to our attention. This issue is under review.

Our technical and policy review determined that certain Coveo subdomains do meet our definition of Tracking (See https://disconnect.me/trackerprotection).

Would you be willing to make the following statement in your privacy policy or other public facing data policy and resolve any inconsistencies with current statements: “Nothing in this policy contradicts the following statement: Except for subdomains [LIST OF ALL TRACKING SUBDOMAINS], Coveo’s domain coveo.com does not collect, retain or share any data regarding a particular user or device (including IP addresses and user identifiers) on sites or apps not owned by Coveo.”

Please note, in the event coveo.com is eventually removed from our Services list and replaced by sub-domains, this does not guarantee that this domain will not be included in any other of our lists, or necessarily determine how our upstream partners choose to integrate our lists.

larosek commented 3 months ago

Thank you for taking the time to review our issue. I asked our legal team to look into this request and will get back to you.

In the mean time, would it be possible to have the list of identified domains/sub-domains?

larosek commented 3 months ago

Quick update, I talked with our legal team yesterday. They will come back with an answer very soon.

@spirillen asked us a question in another repo. My colleague posted a detailed list of what endpoints are used for what here.

Like my colleague said in that comment, we really want to be transparent in all of this. I forgot to include our dev and staging endpoints in my request above, sorry for that. He is also adding other endpoints our marketing team are using that I was not aware of.

Mblanchetdeverly commented 3 months ago

@disconnectme We understand that you have determined that certain Coveo subdomains meet your definition of Tracking and have therefore decided to block the entire coveo.com domain.

While we recognize the mission and purpose of your list and your concerns, we believe blocking the entire coveo.com domain also restricts legitimate activities by Coveo that do not fall under your definition of tracking. Coveo’s SaaS platform handles the on-site search for thousands of third party websites (see description below). By blocking the entire coveo.com top-level domain, the main search functionality on all of these sites is fully disabled, including well-known, high-traffic eCommerce sites. We are willing to cooperate and would consider including a statement in our privacy policy as you suggested, but we ask that you first review Coveo’s activities conducted under the coveo.com domain. Based on this review, we would kindly ask that you:

Coveo’s activities:

  1. Activities on our corporate website www.coveo.com, where we collect and process information exclusively for our own purposes, mainly marketing activities. For these activities we:
  1. Activities related to Coveo’s search and relevance platform offered to customers. In this scenario, our customers have access to our SaaS platform and implement a search user interface on their own web properties. Two main components are at play:

Therefore, we believe that none of the activities related to our SaaS offering fall under disconnect’s definition of tracking. If you disagree with this interpretation, we would appreciate an explanation of your rationale and are open to discussing it further. Coveo is committed to user privacy and fully supports privacy-enhancing tools. However, we believe these tools are not intended to disrupt significant functionality and user experience on a large number of websites, as is currently happening.

Thank you for taking the time to consider our request.

spirillen commented 3 months ago

Well, this is a lie...

Comply with all applicable privacy laws and require users to transparently and explicitly opt in to data collection

Respect users’ Do Not Track (DNT) or Global Privacy Control (“Sec-GPC”) preferences

You are right, this isn't done by coveo.com, but you are using fingerprinting scripts from https://a0771a152cbe.f82a6d53.us-east-1.token.awswaf.com/a0771a152cbe/4dcfedf560e6/b6f8a8faf0b8/telemetry (https://github.com/mypdns/matrix/issues/562), and if the browser are prohibiting your from generate a fingerprint, you are not allowed access to your site.

If you like us to trust you, please do tell the hole truth.

So despite I accepted NOT to blacklist you by wildcard, I do so in my personal RPZ zone.

disconnectme commented 3 months ago

Thank you for the additional information. Our technical and policy review determined that subdomains of coveo.com meet our definition of Tracking (See https://disconnect.me/trackerprotection), and that those subdomains are properly classified.   Our technical review revealed Request URLs from coveo.com’s subdomains are present on thousands of 3P sites. We are seeing what appear to be tracking requests (originating 3P domain information, location, and “analytics”) from subdomains including but not limited to the following:

Per https://github.com/mypdns/matrix/issues/561#issuecomment-2168015706, there are also the subdomains specifically used for Coveo’s analytics:

We will remove the coveo.com TLD from our Services list, and we will add the above subdomains to our Services list instead. If blocking one of these subdomains causes breakage, please provide specific examples of the breakage for us to review.

Based on observed breakage when the org.coveo.com and static.cloud.coveo.com subdomains were blocked, these subdomains will be added to our Content category.