We Built Our Analytics in a Day and Shipped Zero Trackers
A first-party analytics solution built in under a day, using a ~2KB beacon, Cloudflare Workers, and our own database.
The Problem with Third-Party Scripts
As a company selling secure systems, we've always been mindful of the third-party scripts we use on our website. However, when it came to analytics, we found ourselves in a familiar conundrum. Do we use a third-party script, potentially compromising our security posture, or do we build our own solution? We chose the latter.
No Trackers to Remove
Contrary to popular narrative, our site never ran Google Analytics, a tag manager, or a session recorder. There was no tracker to remove and no consent banner to delete. Instead, we had a blank slate, and we chose to build our own first-party analytics solution from scratch.
The Solution
Our analytics solution consists of a ~2KB beacon that sends page view events and data-cta click events to our Cloudflare Worker intake. We store these events in a single database table that we own. To ensure compliance with Global Privacy Control (GPC), we've implemented a per-tab sessionStorage ID, which means we never collect any personally identifiable information.
Why No Consent Banner?
Some may argue that, without a third-party tracker, we should display a consent banner to users. Not so. By honouring GPC, we're not collecting any data that would require consent. Our first-party analytics solution is designed to be transparent and compliant, without the need for a consent banner.
The Real Engineering Gotcha
One of the most interesting challenges we faced was with the `navigator.sendBeacon` API. This API allows us to send a request to our Cloudflare Worker intake, but it has a limitation: it cannot preflight, which means it's subject to CORS (Cross-Origin Resource Sharing) restrictions. When we tried to send an `application/json` Blob using `navigator.sendBeacon`, we encountered a CORS-blocked response. The solution? Switching to a `text/plain` response, which bypasses the CORS restrictions.
Why This Matters
For a company selling secure systems, running zero third-party scripts is not a compromise – it's the product argument. By building our own first-party analytics solution, we've demonstrated our commitment to security and transparency. Our customers can trust that we're not compromising their security posture for the sake of convenience.
Take a Look
If you're interested in learning more about our first-party analytics solution, or if you'd like to know how we can help you build a similar solution for your business, please visit our website at https://pharoahtechnology.co.uk/products/. Alternatively, feel free to reply or enquire, and we'll be happy to discuss your needs.