37

I just took a look at the Agenda of the SO Flow State conference, and I noticed that it seemed a bit absurdly slow and buggy for such a simple site. So I poked around with the dev tools and noticed that SE is again tracking users without their consent. You also should minify your Javascript, more than 12MB is ridiculous for such a tiny site.

I'm using the following URL for my observations, opened in a private window in Firefox with tracking protection disabled:

https://flowstate.stackoverflow.co/agenda/

This is making requests that are obviously or likely for tracking purposes to the following sites:

  • www.google-analytics.com (tracking for sure, Firefox tells me it would have usually blocked this)
  • syndication.twitter.com (also considered tracking by Firefox)
  • eum-blue-saas.instana.io (not sure what exactly this is, request content looks like it could be for tracking)
  • rum-collector-2.pingdom.net

There is also a cookie set under the events.bizzabo.com domain that contains Google Analytics tracking identifiers.

All this happens while the consent dialog is still displayed, I haven't clicked on anything on that page. And I certainly haven't given any consent.

3
  • bizzabo is for the registration itself. Dunno about the others though. Sep 8 at 20:40
  • @Spevacus you can award the bounty now, unless you wait for more answers? (I want to start another bounty, so if the goal is also draw attention to the post, it won't be changed) Sep 12 at 15:17
  • Note: this has been reverted back to planned due to the possibility that "Request to attend in-person" form still suffer from the things reported in the bug report. Sep 12 at 15:25

1 Answer 1

25
+150

We have added consent to this site.

As was reported, the site for our new customer conference went up without properly working consent tracking. After this report, we did some troubleshooting, identified the issue, and corrected it by enabling our consent provider, OneTrust for this page. We apologize for the mix-up, and will do our best to see that it isn’t repeated.

Update: "Request to attend in-person" button is hidden until consent is provided.

Keeping question as status-planned until I can find out specifics about the rum.collector item.

10
  • 6
    Thank you for the quick response, the first three requests seem to be gone now. The last one to rum-collector-2.pingdom.net is still active, and this one looks a lot like a tracking beacon. Can you clarify what purpose this one serves and whether it is a tracking beacon or not? Sep 8 at 19:31
  • 2
    It isn't a tracking beacon. It is a site performance monitoring service. stackoverflow.com/questions/52066709/…
    – JC007B Staff
    Sep 8 at 19:37
  • 4
    @JC007B From their website, it looks like a SolarWinds tracking beacon called "Real User Monitoring". I can't find clear information about their privacy policy, or applicable DPAs; do you happen to have that on hand? (It doesn't look like they're collecting an unreasonable amount of information, but with language like "Identify how your most valued customers access your website", it's not obvious that they're not.)
    – wizzwizz4
    Sep 8 at 19:42
  • 8
    Stay tuned - chatting with our privacy council now on this.
    – JC007B Staff
    Sep 8 at 19:47
  • 6
    We use the uptime collection feature, not real user monitoring. We don’t have any information on what is collected if a site is using RUM. We're still DDTC'ing (double double triple checking) all this too.
    – JC007B Staff
    Sep 8 at 20:10
  • 3
    @JC007B Really appreciate the transparency here, not to mention the speed of the response!. Is the "uptime collection feature" the thing described on this Pingdom page?
    – wizzwizz4
    Sep 8 at 20:20
  • 3
    Still waiting on answers - haven't forgotten.
    – JC007B Staff
    Sep 9 at 16:45
  • @JC007B looks like the "Request to attend in-person" form still suffer from the things reported in the bug report. Sep 11 at 14:34
  • 3
    @ShadowTheKidWizard raising this to the group and asking for another update.
    – JC007B Staff
    Sep 12 at 12:44
  • 1
    We've tracked the issue back to the 3rd party we're using for the registration; they have a bug request open because they tell us that widgets should not have any tracking if we didn’t add them. Still pursuing a fix.
    – JC007B Staff
    Sep 16 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .