Document the purpose of the Developer ID property in code and elsewhere?

Created on 23 April 2024, 2 months ago
Updated 24 April 2024, 2 months ago

Quote from japerry from the security.drupal.org issue:

The developer ID is basically a user agent, identifying to Google that its the official Drupal module. It is well known and supposed to be public.

Problem/Motivation

The developer_id that is set in this module has sparked some good questions that I'm hoping we can document here and in the module code.

What is the entity that this developer account is bound to?

Unknown / No way to find out. Per #9, Google reached out to the developer(s) that pushed the initial commit of the 2.x branch and provided an ID in that private correspondence.

What data is the developer account holder able to see about site(s) that use this module?

Unknown - not documented by Google

No

Do we know how Google will use the aggregate data collected from sites?

Unknown - not documented by Google

What is the risk to site owners should Google choose to close the associated developer account for any reason?

Unknown

What is the impact of a site that was previously not setting a developer ID switching to use this module?

Unknown

πŸ’¬ Support request
Status

Active

Version

2.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @Luke.Leber
  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania
  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania
  • πŸ‡ΊπŸ‡ΈUnited States greggles Denver, Colorado, USA

    It seems good to document this in the README or in the code. Right?

  • πŸ‡ΊπŸ‡ΈUnited States mglaman WI, USA

    It's just an identifier Google provided to attribute the integration. There is no account anyone can access, per the Google Tag docs.

    Are folks thinking module maintainers are getting their analytics?

  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania

    It's something new that's never been seen before on our team and there is precious little information available on this other than one page from Google explaining how, but nothing beyond that.

    The developer ID request form is seemingly bound to a Google account of an individual.

    Matt, can you link to any google.com hosted documentation that confirms what is said in #5 about access policies?

  • πŸ‡ΊπŸ‡ΈUnited States mglaman WI, USA

    Sorry, I thought it had explained it more on that page. I'm not actively on the team which built this anymore, but I'll raise it and see if we can get the Google folks to chime in.

    For the purpose of this issue: They generated the ID and gave it to us. Most of the times these IDs are used to attribute partners and usage of their implementation. Not for aggregated analytics. Basically, Drupal can be actually represented as a platform of users for Google Tag whereas it was unknown what platforms were being used.

    For example, Mangeto has one as well: https://github.com/magento/magento2/blob/e6fc0ca2d4f380951f606f15715c904...

  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania

    There may be some level of difference being that the Magento developer ID is likely under the umbrella of the Adobe Corporation whereas the google_tag module module doesn't really have a well known "legal entity" -- for lack of a better term -- behind it.

    I appreciate anything you can dig up on this. Thanks

  • Status changed to Closed: works as designed 2 months ago
  • πŸ‡ΊπŸ‡ΈUnited States japerry KVUO

    There really isn't anything I can add to what Matt said above. The developer id is generated by google (manually, you submit a form. We didn't do this because Google reached out to us looking to add these features to the official drupal module).

    If it is associated with an account, it isn't one that Acquia, the Drupal Association, or any of the module maintainers owns or manages. All framework level applications are supposed to have this developer_id associated with it. Its in the google site kit, woocommerce, and every other officially supported integration by google.

    https://github.com/woocommerce/woocommerce-google-analytics-integration/...

  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania

    Updated I.S. with answers (best that can be done with known information).

  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania
  • Status changed to Active 2 months ago
  • πŸ‡ΊπŸ‡ΈUnited States greggles Denver, Colorado, USA

    @mglaman -

    Sorry, I thought it had explained it more on that page.

    Which page?

    I agree with the issue summary as written. It would be nice if Google could document this program more to confirm the behavior for some of the unknowns. Since you're in contact with them I assume you're in a good position to negotiate that.

    @japerry this is the second time (between the private issue and this public issue) where you have closed things out prematurely. Please let the conversation unfold before adjusting status.

    Your module users are confused in a way that makes them think your module is malware. That should be a huge warning sign that something in the module can be improved to reduce that concern and instead you cavalierly close it out with a dismissive comment? That is not appropriate collaborative behavior.

  • πŸ‡ΊπŸ‡ΈUnited States Luke.Leber Pennsylvania

    Thanks, @greggles.

    Which page?

    https://developers.google.com/tag-platform/devguides/gtag-integration

    For the record, I wholeheartedly believe that the use of the developer_id property is innocuous here on the part of the module maintainers. I was simply seeking more information on it.

    The Google documentation uses language like "your customers", which implies somewhat of a different relationship with end-users than is traditionally implied by FOSS Drupal modules that have fluid maintainers.

Production build 0.69.0 2024