Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.
All tracking is bad, from Google or not. I understand the "companies need to make informed decisions" argument but I disagree with it, mainly because tracking software is involuntary and it's in the interest of the tracking software maker and the company using it to make it as stealthy as possible.
PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_usin...
It's going to be hard when your own hands are tied by legislation but your competitor just does as they see fit.
Also them having the resources to drag out any court ruling for years and years ensures there is no level playing field whatsoever.
So yeah, maybe companies should be called out for thinking they are above the law just because they can afford endless legal battles.
Thanks for pointing that. Don't know how many time have met privacy advocates, etc has made a such a strong point against google, and still embedded youtube video or google font on their site. Is there are github page where one can block all google or fb used domains or ips? Would be very useful!
If you want to get extra fancy you need to also worry about Doh and Dot (encrypted DNS) and hardcoded IP's (mainly for actual applications like mobile apps or smart devices). Encrypted DNS is a great thing but companies also use it to bypass things like pihole or NextDNS by hardcoding their DNS IP into an application and then sending all requests to that IP using Doh and Dot so that the end user has no control.
What you can then do is use any kind of edge router / firewall / networking equipment (virtual or physical) to block all the common DNS IP addresses directly and only allow addresses of your choice (such as NextDNS or other). This way when the application tries to make a connection using Doh or Dot to that specific IP address it ensures that it is blocked and everything must fall back to whatever DNS you have setup (which can also be running Doh or Dot for privacy / security). Some home routers have this functionality or you can setup a pfsense box relatively cheaply to achieve this. Unfortunately I have not yet found an easy / cheap solution for mobile devices if anyone has any suggestions.
Edit: Please note that they seem to have removed the link to Google fonts from the website now.
Are you asking for a repo - for software? Or instructions? Or something to do with GitHub Pages? I may be able to help, but I don't quite follow.
Don't shoot the messenger? I think everyone should have the right to voice opinions and point out problems with products, competitors or not. As long as the claims are factual and not FUD and bullshit. (I'm reminded of fud campaigns made e.g. by big corporations against open source, backed by their own shady fudfactory studies)
If a company can -- without lying or twisting facts -- point out that their competitor's product is dangerous/illegal/unsuitable/{whatever is relevant to me}, I'm all open.
Of course, the line between a fud campaign and plain good old information is sometimes very thin.
The competitor that put up this site appears to be a company that provides analytics that are not centrally collected and analyzed to serve ads across the internet. Their entire selling point seems to be that they do not engage in mass surveillance. Equating this to what Google analytics does (if this competitor's claims are accurate) is a false equivalency.
To me, this is no more objectionable than a foam insulation manufacturer capitalizing on asbestos bans.
The primary problem with surveillance capitalism is when your movement across the entire Internet is gobbled up, sliced, and aggregated for the largest bidder.
If you see a title, you have no idea it is from a 1st party or 3rd party until you read the article. Or, you could just come to the comments an diatribe away. That's the internet way, and claiming to be morally better than the internet is the HN way.
It's really hard to make that claim when Google is known for anticompetitive behaviour, including crippling GA competitors [1].
We should probably acknowledge that Google is in the terminal phase where only forced split and divesture will help, and in the meantime, every action from competitors is fair game.
[1]: https://forum.matomo.org/t/adwords-campaign-rejected-for-goo... https://matomo.org/faq/troubleshooting/antivirus-program-or-...
Their product is open source and (assuming the say the truth) keeps the data on the server of the website owner. I would say this is better.
I love that you casually put not being illegal on the same level as a dashboard or a convenience feature.
Then again, even though this is google, I'm not big on localized countries attempt to create laws that dictate the behavior of the internet as a whole, admittedly this is a different issue.
> The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022.
As for the Astria ruling, this is part of it:
> The fact that Google LLC argued that Google Analytics was allegedly provided by Google Ireland Ltd since April 2021 was not considered relevant, as the violation occurred in August 2020.
So it might be illegal to have used GA before April 2021, but it very well might now be legal given that GA is now provided by 'Google Ireland Ltd', which was a move explicitly done by Google to comply with GDPR.
That page explicitly notes that cookies aren't sent and these requests aren't used for the ad machine. Is using Google Fonts at all the issue just on the chance they're using IP address matching for ads/is them having your IP too much of a risk?
Just dump all request logs in a giant Data Lake - seems like promotion material idea. (sarcasm).
Yes, it says this.
> aren't used for the ad machine
No, it doesn't say this.
We'll probably try it anyway, to be honest, but I'm not crazy about this type of advertising.
There is so much room to beat Google Analytics on UX alone. Is this really necessary?
It has been more than 3 and a half years since GDPR was implemented, yet it took concentrated efforts of non-profits and individuals to come to this extremely obvious interpretation that EU–US Privacy Shield is nonsense.
Maybe if EU and member countries actually made any enforcement efforts, a viable competitive space would emerge.
> Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.
Google Analytics is not a good product if it can't legally be used. The competitor in this case is offering a better product because it can legally be used.
This isn't very convincing.
In industries that don't successfully self-regulate we get politicians that force a regulation in order to have good product out compete bad ones. It is especially common with lemon markets where information asymmetry between buyers and sellers is a significant reason of good products being unable to fairly compete with bad ones.
The value of personal information is a notoriously lemon market where the buyer, ie users, are not aware of the actually cost to themselves or to whom they are selling their information. One of the first requirements in GDPR is fixing part of this by forcing companies to disclose to whom the information is sent to. Secondly it partially address the cost aspect by forcing companies to disclose how the information get used and thus what the real cost to the user is. A bit like how banks need to disclose what the interest of a loan actually will be before the consumer signs the contract.
What makes privacy issues an even bigger issue is that the cost is not carried by the party who decide and benefits from the choice of analytic software. This is similar to environmental issues where the cost of a decision is not carried by the company that made it, but rather by those around them. Environmental issues is a typical example where self-regulations do not seem to work, as the end consumer has no information if a certain clothing item is made from child labor or by a eco friendly operation. A regulations job there is to put down some minimum standards that everyone need to follow, including information disclosure so that end users can actually know what they are paying for and how much.
As it is, it's very difficult to tell if something you're using is gathering data that you don't intend to gather (e.g. your hosting provider logging IP addresses for your hand-coded blogging software). I don't want to have even the tiniest possibility of being on the receiving end of one of those theoretically huge GDPR fines just by self-publishing some code and putting it on the internet.
It's just that website creators were defaulting to "just use Google Analytics" because it's convenient and they didn't care about their user's human right to privacy, and were thus externalizing human rights violations onto them.
The government is simply preventing externalization of harm, which even libertarians will agree if the governments job (of course agreeing on what level of spying is harmful is where the debate will be).
> PostHog is what I always wanted a Product Analytics SaaS to be. Private cloud option so GDPR becomes way more manageable, features built based on direct community feedback, focus on simplicity and usefulness over vanity features...Great job people!
Mmm I dream of [Private cloud options] to make [needlessly complicated government legislation] easy!
Yay privacy, I guess? Just add 3 more needlessly complicated middlemen.
I get what you're saying, but i feel like that's probably a sliding scale of how much people actually care about these things vs how much they want to just easily get things done.
For example, right now my personal website serves the following files, just to get Open Sans working:
/fonts/open-sans-latin.woff2
/fonts/open-sans-latin-ext.woff2
/fonts/open-sans-latin-bold.woff2
/fonts/open-sans-latin-ext-bold.woff2
/* latin */
@font-face {
font-family: 'Open Sans';
font-style: normal;
font-weight: normal;
font-display: swap;
src: local('Open Sans'), url(/fonts/open-sans-latin.woff2) format('woff2');
unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
Furthermore, the characters that you'll want to show on your site will also make you write more code, just look at what Google does for Open Sans: https://fonts.googleapis.com/css2?family=Open+Sans&display=s...
Oh, and more styles? Well, be ready to add all of those as well, since most of the fonts out there won't necessarily be variable: https://fonts.google.com/specimen/Open+Sans#standard-styles
In comparison, Google Fonts just lets you choose what you want and copy something like the following:
HTML:
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap" rel="stylesheet">
CSS:
font-family: 'Open Sans', sans-serif;
In my opinion, those sizes should also be readily available in the web UI of Google Fonts, or most other sites that recommend fonts out there!
Now when you start a project in Germany, not only do you have to have an "Imprint" on your site which shows your private address (if you work from home or are a digital nomad) but you also are at a disadvantage because you cannot use all the free tools that startup founders outside of the EU can use.
Has anybody here in Europe considered moving to another country or setting up a company in another country because of this?
How do all the famous indie makers from Europe handle this? I never find any information on their sites with an address and they all use Google Analytics.
Do note that "someone responsible" can be a legal entity! Not only cooperations but also a "Verein" or a similar legal construct.
Also, note that you do not need to list your address, only a "Anschrift", which often times is the same thing as an address, but really just means "If I write this on a letter it has to be delivered to you." So a postal box for example works just fine.
If you are a startup you will have all of these things anyways, I don't know a single startup that isn't also a legal entity. Indie makers is a bit more tricky, but as mentioned before it is pretty easy to get around this requirement via a "Verein" or something similar.
As for free tools not being usable, I honestly don't think it is that big a problem. Google Analytics doesn't work for you? There are other offers out there. Or you could selfhost matomo. Or if you want then you can just go ahead and run an awk script on your Webserver log.
As for not finding information and on the sites of famous European indie makers, I am going to let you on on a secret. The "Impressum" was always intended so that consumers could have a look at who they are dealing with over the internet.
To this day it is still handled like that. If you aren't selling anything or doing anything else that "a classic" company would do it is highly unlikely anyone is going to care whether or not you have an Impressum.
Sure. You can put in a day of work to self host or write your own analytics solution.
But this already puts you at a disadvantage. Because of the time you have to invest and the sub par solutions. Google Analytics is simply better than the alternatives.
And it does not end here. Every website I know uses a multitude of international tools. All of them connecting the visitor to some international servers which provide the service. Cutting European indie makers off from all these tools will put them at a huge disadvantage.
Regarding the Impressum ("imprint"), the information you need to put on your website is already public, since the address of your company is recorded in the commercial register when you incorporate it. It can be annoying to have to use your home address, I agree, but there are plenty of coworking spaces or even just mailbox services that can solve this problem.
Regarding Google Analytics, I don't find it a competitive disadvantage to have to host analytics software that is less detrimental to user privacy.
Are there any other issues or annoyances you ran into that contribute to the impression you stated?
Google Analytics is free for businesses, but not because Google feel line they need to help small business get started.
Also consider that starting a business in countries like Denmark is easier that starting one in the US. Ease of doing business isn’t the only thing holding back EU startups.
That's been the law in the EU since 2001.[1]
1. In addition to other information requirements established by Community law, Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information:
(a) the name of the service provider;
(b) the geographic address at which the service provider is established;
(c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner;
(d) where the service provider is registered in a trade or similar public register, the trade register in which the service provider is entered and his registration number, or equivalent means of identification in that register;
The definition of "service provider" is (b) "any natural or legal person providing an information society service".
This is a basic requirement of European Union trade. It's intended to encourage cross-border trade, by insuring that, if there is a problem, the customer can find the seller. So, anonymous online businesses are illegal in the EU.
[1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
If you're publishing ads, sending people to affiliate links, selling products, whatever, you're operating a business. All businesses should be held to a minimum standard of accountability.
You can use the ones that don't infringe on user privacy.
EU/Germany might not encourage a haphazard hodgepodge of poorly vetted services as squashed into a start-up. And it is a good thing.
Some regulation might have got a bit extreme. Granted. I think they will be revisited as the time goes by. But really, this feels like a reaction to contempt that many businesses have towards protecting their users.
You don't think you're being a wee bit dramatic here, homie?
It needs to be a specific kind of legal service address. Using a post box is illegal and can cost you a lot of money if a competitor finds out.
> new analytics
It's a lot more than that, under Schrems II you can't use any good cloud provider, nor most SaaS.
Aka spyware.
Personally I use the self-host version of plausible, and I remove this cookie banner that is sooo invasive and by the way improve page-size and UX.
I use a virtual server precisely in Germany for less than 3€ a month and had it by my own subdomain like analytics.mydomain.eu
Not using SASS services (e.g. Firebase) just really sucks though.
We still use it (started with it before privacy shield was demolished) but we will have to migrate eventually. Don't know what we'll use exactly, maybe managed kubernetes with some platform for an easier workflow running on it? Idk yet.
And if you already consider Kubernetes, even better. It removes a lot (but not all) of headaches for managing infrastructure. I wish there was better market for quality k8s operators to automate the management tasks for some specialized deployments.
It is open source, the hosted vendors will emerge, so you will be able to buy it, if not yet.
That said, I sympathize. Re-doing already done feature rather than focusing on new things can feel discouraging.
[1] https://supabase.com/docs/oss - no affiliation
Most countries in the world though has governments which ensure basic rights, and if you want to do business in those countries you follow those laws, no matter how it may reduce your profitability
The fact that 'productive folks' have been engaged in a chicken race with the regulators since GDPR came along in 2016 is entirely on them.
The second shoe dropped with Schrems II in 2020, and the race to find plausible technicalities to keep doing the same thing continued. Still no real attempt at fixing the problems.
If they had followed the spirit of the law rather than trying to get away with dubious technicalities, there would be no mad scramble to fix things now when it turned out those technicalities were in fact hopeful thinking at best.
No thanks.
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe...
> PostHog is the only open source product analytics platform where customer data never leaves your infrastructure.
Hosting my own Matomo installation I beg to differ. Matomo is open source and my visitors data never leaves my own server.
Except they only do backend tracking and see https traffic from website frontend tracking reaching my analytics server as it "leaves your infrastructure".
But they at least made one thing obviously clear to me. I would never consider using them in the future.
Also they are wrong factually. Google Analytics is not illegal in Austria. The court made this clear. Transmitting the IP without anonymizeIp is. Also transmitting PII data unencrypted to GA us (but GA does forbid that in their TOS as well).
So not caring about the law when implementing GA and doing it just wrong is forbidden in Austria. Who would have thought. Using it correctly and adhering to data privacy best practices is just fine with GA.
I've only got a machine translation of the ruling (https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...), but it includes:
"The specific IP address used can no longer be determined by the complainant either. However, this is irrelevant, since the UUID in the cookies is already clearly linked to a person."
I've been skeptical of the "just turn on anonymizeIp" approach for this reason; xxx.xxx.xxx.0 plus, say, the user agent, is likely plenty to identify me.
And yes the User ID/cookie ID is PD and one needs consent to transmit that. As one needs consent to store a non essential, non functional cookie.
If I read the ruling correctly (and I might be wrong here) the defendant didn't ask for consent.
There is a BIG issue here which is usually splitting hairs, but in this case is super-relevant.
Google's TOS forbids storing PII. GDPR forbids transferring Personal Data (PD). These are nowhere near the same thing. Pseudonymous identifiers are not PII, but are often PD.
Google Analytics requires a pseudonymous identifier to work (the "client ID," by default randomly generated value stored in a cookie). This may on its own constitute a GDPR violation, despite not counting as PII for Google's ToS or any other American law.
Google would still always get the IP and user-agent though, so maybe that's not enough. Proxying calls to GA and stripping anything which could contribute to a fingerprint should logically make it "legal" everywhere, I would have thought?
That's some very interesting information. So, the real answer to the question of whether it's illegal in Austria or not is a "MAYBE", and it is quite easy to make it legal? If so, that should be on this site.
To back that up:
https://autoriteitpersoonsgegevens.nl/sites/default/files/at...
Above is the official guidance from the dutch privacy authority. It basically documents the best practice since 2018: anonymize IP and how to configure several other privacy-friendly settings in GA.
Exactly one week ago they added an explicit note to the very top of the document. It says that soon GA (as a whole) may no longer be allowed. No matter how you configure it. They go on to explain that they're in the process of investigating two other complaints and will come to a final conclusion early this year.
That's wrong. I can give you 3 other open source selfhosted options off the top of my head: Offen, Counter, Matomo.
Edit: I just saw that their "alternatives to google analytics" page shows posthog's competitors as well and you can submit prs to add further options, fair play!
Self hosted docker and it is not blocked by adblocker (nginx custom js filename).
Only thing I miss at the moment is extensive GA history which is gone now, but Plausible is so much faster and simpler and maybe they implement history import someday.
Either way I replaced it with the correct url
TBH, I personally do not understand how it is legal to provide a single shared service in the face of data localization requirements, especially if other countries were to adopt similar rules. Is it just a matter of having separate shards for each jurisdiction? Or do we need to instance the entire application so that US users don't even see EU users and vice-versa? Most off-the-shelf/FOSS webapps aren't built to be sharded this way, they assume One Big Database that has everything. That would include some of the GA alternatives they list; which, again, is a problem if those apps don't shard users by jurisdiction.
I suppose for now, just hosting everything in the EU is fine, if only because the other jurisdictions with data localization requirements[0] pretty much can't be served with a shared application anyway. I'm imagining that's what the person who built this was figuring it would be used for. But if the US starts demanding data localization, the Internet is fucked.
[0] China, AFAIK
The the demands that tiktok be sold?
A general data localization requirement in US law would mean an end to self-hosting one website and serving two jurisdictions for the majority of web users.
Not... really? The internet (defined as the infrastructure and non-commercial websites) will be fine.
Corporations that collect and monetize data will just have to jump through more hoops (and many already do this because of the GDPR and Europe's general feelings about personal data). So they'll be fine too, even if they gripe a bit about it.
The only folks who would really be hurt would be small developers, because their potential audience will be limited until they take advantage of foreign hosting and segmenting their user's data. In the end, they'll probably be fine to, even if their growth is stunted while they comply with laws (and ultimately, the wishes of their customers).
One of the specific cited concerns with off-site hosting is that it exposes user data to foreign intelligence agencies. This is a valid concern, but it's not unique to the US. It's not like EU member states don't have their own spymasters: they absolutely do, and they are just as atrocious to democratic norms as American ones are. In fact, most EU member states would rather trust the US than each other, that's why their politicians negotiated the Privacy Shield agreement that ultimately got shot down.
If the US were to have a data localization requirement, it would almost certainly be incompatible with the EU's data localization requirement. Then everything I mentioned in my prior comment would apply: the need to shard users at best, and a need to firewall users off from one another at worst.
(edit: demo video url: https://dabbleam.com/jesus/Screen%20record%20from%202022-01-...)
Edit 2: doesn't crash on a fresh Firefox profile. Crashes upon enabling gfx.webrender.all, gfx.webrender.compositor and gfx.webrender.compositor.force-enabled. Very intriguing stuff, I'll file a bug.
Sadly, such nonsense is quite common in modern web design.
I still wish websites would not only respect the disabled autoplay setting but also stop animations completely in that state. But right now it seems crashing video player UIs are the best we can get.
Rule: `-google-analytics-$script,domain=~wordpress.org`
URL: https://isgoogleanalyticsillegal.com/component---src-pages-g...
Edit: Couldn't get this formatted well, but it has google-analytics highlighted in the URL
BTW. your site looks great. I like the running ticker on the side.
Note that the ruling confirms the GDPR, the EU legislation.
Also, enforcement may be very inconsistent, since it is mostly left to each member state to handle.
EDIT: NVM, GDPR is a Regulation, not a Directive, so it's automatically law everywhere in Europe.
Practically this is the number one reason for our nice "attention, do not resits, we are using cookies on your electronic machinery" popups.
For quite a few sites its the only cookie you actually accept.
Its a s**t show really. Every single client ever now needs to have a cookie popup because google is going to punish you in your rankings if you do not use their integrations too.
And if you do use their integrations... you need a popup.... and dont even get me started about "legitimate interest".
But this is the way... I opt out as much as I can and block through the router as well as ublock.
The most interesting thing that i noticed is that if you block third party cookies in safari on your phone, some sites will show you a blank screen. Timescale does this (I have reported this as a bug month ago but never received feedback).
Its an amazing feature by now:
- the page loads and you can see the content
- the page trys to show you the cookie popup
- since i dont have any cookies allowed, the script will just completly blank out my page
welp. welcome to the future. Its not neccesarily better, but I can see them all now, which i guess is at least a step in the right direction.
If true, they don't need to show the popup.
> google is going to punish you in your rankings if you do not use their integrations too.
If you have evidence of this it would be the basis of a massive antitrust case. (I'm not disagreeing and would not be too surprised, but - real evidence is thin unless you include the AMP carousel which is not technically part of "rankings".)
Source/proof?
People don't want to run their own infrastructure anymore. Everything outside of their own business differentiator they want to outsource. Whether they "should" do it debatable and a long conversation with context like business value, cost effectiveness, velocity, and other non-technical things as part of the conversation.
This would be a great advertising moment for an EU based analytics provider. A SaaS.
Just search in your search engine of choice and you will find plenty. Lots of comparison online. Some are more, some are less complete or accurate. With advent of affiliate marketing among vendors, the reviews start resembling VPN market.
Not listing anything specific. My company has a product in this space, but I will spare you self-promotion.
Which of those steps Google does today? All of them, from browser to YouTube to shopping to audience data and sales measurements. This is not a case of "old people ranting about how the old world was simpler and better", it's a case of conflict of interest. But this isn't something new, everyone in the industry has been seeing that for two decades now, it's just something no one cares enough to pick a fight.
BUT most people do not have the same distaste towards this type of marketing so -- don't hate the players, hate the game. If you want things like this to stop then it's probably up to government regulation to curtail it otherwise, for smaller competitors where it's already difficult enough to establish a market position, they would just be hamstringing themselves by not playing to the same emotionally charged marketing style.
If you're a business and you deliberately stay away from marketing like this -- that's great, honestly I'm personally more likely to try your product and I'd like to think I'd do the same in my own work but I really can't blame companies who take this route either.
Worked without any real issues. Didn't have to stop using GA on the frontend, either. Just had to point the frontend GA at our own endpoint.
Theoretically, this would make usage of GA compliant with GDPR, too, I beleive.
The shortsightedness of using remote static assets on your own site is amazing to me.
I had a quick look at PostHog, but it seems to need all of these in addition to the web UI:
- Postgres
- Redis
- ClickHouse
- ZooKeeper
- Kafka
I'm not gonna lie, these tears are delicious.
For example, OneTrust gets it right on their website, but I have never seen a client of theirs get it right. So either OneTrust doesn't use their own software, or all their clients are specifically configuring it in a non-compliant way.
I have yet to hear of any general enforcement of this, despite noyb.eu's reporting of hundreds of websites to regulators.
And how is anyone supposed to build any kind of global data dashboard now? Do you have to have separate sites for EU analytics data vs the rest of the world? How do you do statistics to see where your visitors come from? How much time visitors from which countries, languages, etc., spend on your sites?
they are listing PostHog as a valid alternative that would be GDPR-friendly but as per their terms of use PostHog is based in the US and they would be bound by the same Cloud Act as Google Analytics.
We have the Schrems II ruling that made some countries think they could not use services like Cloudflare and Azure. Still Cloudflare and Azure are widely used within EU. (Germany is an outcast). One should as always be transparent about what data is collected. From the GA projects I been involved in (in EU) GDPR has never been a concern.
lol that is funny. "post hog" is a term that originated from the radical left r/ChapoTrapHouse subreddit.
Are there other tech companies founded by openly anti-capitalist leftists?
Android apps which use push notifications must use the Firebase Cloud Messaging library. I think many app developers don't realize that adding that library also adds and enables analytics.
For example, adding the `firebase_messaging` module [2] to a Flutter app causes the Android build to import [3] the `com.google.firebase:firebase-bom` Java dep which includes `firebase-analytics` [4]. Once the Java library is included in the build, it starts working automatically [0].
To disable Google Analytics in an app:
* Firebase > Docs > Engage > Configure Analytics Data Collection and Usage [5]
* dart > firebase_analytics > FirebaseAnalytics > setAnalyticsCollectionEnabled method [6]
* Be sure to check the logs to make sure your change took effect. See "Firebase Google Group > Disabling analytics for iOS has no effect?" [7]
[0] https://support.google.com/analytics/answer/9353532
[1] https://support.google.com/firebase/answer/9234069
[2] https://pub.dev/packages/firebase_messaging
[3] https://github.com/FirebaseExtended/flutterfire/blob/a9562ba...
[4] https://mvnrepository.com/artifact/com.google.firebase/fireb...
[5] https://firebase.google.com/docs/analytics/configure-data-co...
[6] https://pub.dev/documentation/firebase_analytics/latest/fire...
[7] https://groups.google.com/g/firebase-talk/c/rved9bIBT0g/m/YN...
Shame on PostHog for this. You can do better than PostHog.