Linux Mint website privacy concerns.

[oldsphere1]

Linux distributions are often alternative operating systems for people looking to escape telemetry from other operating systems (usually Windows 10), and many of these people in this situation come to Linux Mint as an introduction to the Linux family of operating systems. I was therefore surprised to see that the website behind Linux Mint containing Google's Analytics and even using Recaptcha for its forum registration. I also noticed many contradictions within Linux Mint's privacy policy on the main page, notably the "guiding principles" section which implied a protection of the user's privacy despite the truth clearly being otherwise.

My suggestion is to remove any third-party connections to Google as digital privacy has become more important than ever in recent years, and not supporting it is a mistake for many reasons. For reasons why, I advise you look up "why digital privacy matters" on a search engine of your choosing. Some specific websites like "thenewoil.xyz" are also great sources for finding why privacy matters among others.

[xenopeek]

As it says on the main website Linux Mint is free of charge thanks to donations and adverts on the website. Google Analytics is used for ads.

Google reCAPTCHA is used on the forums as one of the measures to reduce how much spam the forum team has to remove manually on the daily. Google reCAPTCHA only needs to be permitted during forum registration (and password reset) and otherwise users can block Google content on the forums if they want. phpBB, the forum software we're using, doesn't currently support better options. There is a request to add hCaptcha which we can consider if/when it gets added to phpBB: https://www.phpbb.com/community/viewtop ... p=15477671.

If you have concerns about the completeness or correctness of the privacy policy I suggest to contact the privacy representative.

[Mick-Cork]

Just a brief interjection here, after looking at the source code for both linuxmint.com and forums.linuxmint.com only linuxmint.com uses Google Analytics as far as I can see, and that's on a limited number of pages as defined in the privacy policy.

They do however deliver Google ads (presumably via AdSense), and as you say xenopeek this helps fund and support LM.

And just for clarity, Google analytics isn't required to serve Google ads.

I'm not sure where things stand re policies and subdomains. Privacy policy requirements vary across jurisdictions and it can be hard to cover all bases. Looking at Google's AdSense advice (https://support.google.com/adsense/answ ... tent?hl=en) it probably wouldn't be a bad idea to add their suggested wording on both the main domain and any subdomain policies where AdSense is used.

On a broader note, Google AdSense and analytics are all over the internet. The only way to avoid them totally is to either not go online at all, or contact a website owner before you actually visit their site and ask them if they use either before visiting (good luck with that!).

Edit, and just to add the blog for 'thenewoil.xyz' uses Matamo analytics to collect user data, and I haven't been able to find any privacy policy on their blog page at all (Oh the irony!)

[DPM]

On a broader note, Google AdSense and analytics are all over the internet. The only way to avoid them totally is to either not go online at all, or contact a website owner before you actually visit their site and ask them if they use either before visiting (good luck with that!).

I'm using a third approach: uBlock Origin with a lot of filter lists plus some custom filters. It's not only a privacy bonus, it also makes the web faster. That's why I don't even see Google Ads on linuxmint.com.

[DAMIEN1307]

And just for clarity, Google analytics isn't required to serve Google ads.

That's why I don't even see Google Ads on linuxmint.com.

This is the only thing that is automatically blocked via Brave Browsers, Brave Shields, that is built into their browser, regarding anything Google in LM forums... In particular it highlights which entity Google is using to serve up these ads in the LM forum...DAMIEN

Code: Select all

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

[Mick-Cork]

On a broader note, Google AdSense and analytics are all over the internet. The only way to avoid them totally is to either not go online at all, or contact a website owner before you actually visit their site and ask them if they use either before visiting (good luck with that!).

I'm using a third approach: uBlock Origin with a lot of filter lists plus some custom filters. It's not only a privacy bonus, it also makes the web faster. That's why I don't even see Google Ads on linuxmint.com.

Yep, same here with uBlock Origin running. I also use the hosts file to block approx 64000 ad sites etc. Wrote a little script that downloads recommended hosts file lists and merges them. Seems to work very well, e.g, I can watch streaming sites without all the dodgy popups appearing.

I'm not sure if any of this stops analytics collection though, suspect maybe not. Either way, I don't think it's possible to avoid everything these days. I just do the best I can and also avoid any sites that appear dodgy.

[absque fenestris]

Apart from registering for the first time, the Mint Forum also works with JavaScript turned off. As far as I know, you can't act much more cautiously on the Internet (Well, yes! Maybe also use a pure text browser ...)

[Aztaroth]

I'm using Steven Black's host file https://raw.githubusercontent.com/Steve ... ster/hosts to create 'sink holes' for as many ad/spywares as possible (a sinkhole is a redirection to IP 0.0.0.0)
I've no problems connecting to Mint's official site and to the forum although in the last update 82.077 (!) ad/spywares are banned.
(No need to mention Google Analytics is in the list)

[Moonstone Man]

My suggestion is to remove any third-party connections to Google ...

So, do you intend to fund the lost revenue out of your own pocket? Or do you intend to make sure that Linux Mint dies from starvation of funds?

Your operating system is free, as in beer. It has to be paid for somehow, and google analytics is nothing that a decent browser add-on won't fix. So you have two choices. Find a decent add-on, or put up your bank account.

Geeze. Some people.

[oldsphere1]

My suggestion is to remove any third-party connections to Google ...

So, do you intend to fund the lost revenue out of your own pocket? Or do you intend to make sure that Linux Mint dies from starvation of funds?

Your operating system is free, as in beer. It has to be paid for somehow, and google analytics is nothing that a decent browser add-on won't fix. So you have two choices. Find a decent add-on, or put up your bank account.

Geeze. Some people.

There are privacy respecting analytics options. I also see no point in insulting me.

[oldsphere1]

Just a brief interjection here, after looking at the source code for both linuxmint.com and forums.linuxmint.com only linuxmint.com uses Google Analytics as far as I can see, and that's on a limited number of pages as defined in the privacy policy.

They do however deliver Google ads (presumably via AdSense), and as you say xenopeek this helps fund and support LM.

And just for clarity, Google analytics isn't required to serve Google ads.

I'm not sure where things stand re policies and subdomains. Privacy policy requirements vary across jurisdictions and it can be hard to cover all bases. Looking at Google's AdSense advice (https://support.google.com/adsense/answ ... tent?hl=en) it probably wouldn't be a bad idea to add their suggested wording on both the main domain and any subdomain policies where AdSense is used.

On a broader note, Google AdSense and analytics are all over the internet. The only way to avoid them totally is to either not go online at all, or contact a website owner before you actually visit their site and ask them if they use either before visiting (good luck with that!).

Edit, and just to add the blog for 'thenewoil.xyz' uses Matamo analytics to collect user data, and I haven't been able to find any privacy policy on their blog page at all (Oh the irony!)

I'm not sure what point you're trying to make by stating that Google AdSense and Analytics are widespread; are you implying it's fruitless to avoid it because of that? I would like clarification.

Matomo Analytics also respects user privacy, see matomo.org.

[Mick-Cork]

I'm not sure what point you're trying to make by stating that Google AdSense and Analytics are widespread; are you implying it's fruitless to avoid it because of that? I would like clarification.

Matomo Analytics also respects user privacy, see matomo.org.

I'm saying AdSense and Analytics are widespread and that it's difficult to avoid them. Not that you shouldn't necessarily try.

My point about thenewoil.xyz is that it uses Matomo analytics on its blog to collect user stats, but that there is no privacy statement on the blog telling users that they do this. I'm pretty sure that's in contravention of privacy regulations. Furthermore, whilst Matomo respects 'do not track' browser settings, their system will still create tracking requests and cookies on users systems unless the site owner adds a particular function (_paq.push(["setDoNotTrack", true]);) in their javascript tracking code. I can't see that on the blog in question.