How privacy options work

support
1

I was happy to see the privacy options in 0.41, but I would like to know how they work.
I enabled some of them, but I didn’t see any changes in the generated code regarding Google Analytics for example.

Does the template have to support these options to see any changes?
I use a custom template based on an oldish one which was created long before this feature introduced.

For instance, the twitter button is my own addition and I hardcoded the “privacy” options (e.g. do not track) to the template based on Twitter API.

Am I right when I think that these options do not solve automagically all of the privacy “problems” if the template does not support them?

Thanks in advance.

2

Have you read https://gohugo.io/about/hugo-and-gdpr/ ?

You don’t really need to do something in the template for the privacy options to take effect.

In the case of Google Analytics for example you could use something like in your Hugo project’s config:

[privacy.googleAnalytics]
disabled = false
respectDoNotTrack = true
anonymizeIP = true
useSessionStorage = true

With the above a visitor’s IP will be anonymized before it is sent to Google’s server’s and the Google Analytics cookies will be moved to Session Storage.

Also note that above options will not work with the new Google Tag Manager. They’re meant for analytics.js

Regarding Twitter the privacy options are meant for embedded Tweets not for the Twitter button.

You shouldn’t really use any of the Social Media buttons that are offered by the various networks as these track users. Instead have a look at http://sharingbuttons.io/

3

If you look in the partials folder of my theme at https://github.com/TotallyInformation/hugo-theme-twenty-sixteen, you will see follow-me-icons.html and sharing-icons.html which implement static buttons for a number of services.

4

What will anonymize the visitors IP? We are talking about a static site where static html files are put into the www folder of the webserver.

I imagine this feature that puts some options into the code. Have a look at the code of the Tweet button:

<a class="twitter-share-button"
            href="https://twitter.com/share"
            data-text="{{.Title}}"
            data-url="{{.Permalink}}"
            data-hashtags="SomeHashtag"
            data-lang="hu"
            data-dnt="true"
            data-related="some-twitter-account">
        Tweet
        </a>

Twitter docs
But as I do not see any changes in the code enabling any of these options I suspect the theme support is required.

Thanks for the sharing buttons info, I will use instead, but this does not change my curiosity about how these options work.

5

That setting is relevant to GA and it masks the last octet of a visitor’s IP. See.here for a description of how it works.

6

Enabling any of Hugo’s privacy options modifies the Google Analytics tracking script.

Also when enabling simple mode for embedded Tweets, Instagram photos and Vimeo videos non JS versions of the embeds are built.

All relevant info is in the Docs Page I linked to above.

7

How exactly could Hugo change the script itself when it is not present at compile time?

The GA part from the template:

{{with .Site.Params.googleAnalyticsUserID }}
<script>
    (function(i, s, o, g, r, a, m) {
        i['GoogleAnalyticsObject'] = r;
        i[r] = i[r] || function() {
            (i[r].q = i[r].q || []).push(arguments)
        }, i[r].l = 1 * new Date();
        a = s.createElement(o),
            m = s.getElementsByTagName(o)[0];
        a.async = 1;
        a.src = g;
        m.parentNode.insertBefore(a, m)
    })(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
    ga('create', '{{.}}', 'auto');
    ga('send', 'pageview');
</script>
{{end}}

But at last, I get to understand what is happening here and I believe my suggestion was right. The &aip=1 parameter enables the IP anonimization.

Hugo could add the ga('set', 'anonymizeIp', true); line to the GA script, but it is not happening in my case, I think my template simply not supports this feature.

8

Hugo uses an internal template for Google Analytics.

The Privacy Options work with the Hugo internal templates and shortcodes only.

9

I understand. Also, I guess I’ve just realized what was my mistake in this thread. I constantly used the word ‘template’, where I should use ‘theme’.

My theme is based on an old one, which has a Google Analytics snippet I posted above. It doesn’t come from the internal template, it comes from the theme code, therefore it doesn’t respect the privacy options.

This theme does not even use the googleAnalytics key to specify the GA ID, but the googleAnalyticsUserID from the [params] block.

With your help about internal templates and Google Analytics API, I managed to validate the effect of the (not working) privacy options. Thank you for your time and help!

In summary, this requires theme updates, otherwise it will not work.
In my opinion, a warning should be placed in the GDPR/Privacy page of the docs about theme support.

10

You could make a pull request in the docs repo for that.