The “we estimated your age from account signals” bit is the polite version. Australia made the big platforms do this in December, and the regulator’s first report found some of them letting under-16s retry the age check until they passed. So the kids get infinite continues and the adults get checked too.

France tried to ban social media for under-15s this summer and its Constitutional Council struck it down for exactly that reason: to check the kids you have to check everyone, and the law had no privacy guarantees for the adults. Discord just skipped the court part.

We run a small site with no cookies, no analytics and nothing third-party. Just our own server logs. Two things worth knowing if you are thinking of going that way.

The good part is the obvious one: you own the numbers, and nobody gets a copy of your readers.

The part nobody warns you about is that raw logs lie. We counted 786 visitors in a week. Filtering the bots that declare themselves brought it to 411. Counting only the ones that actually load the stylesheet and the images, which a browser does and a script does not, brought it to 192. More than half of what looked like an audience was machines.

The referrers were worse. 29 of those visitors claimed to arrive from Google. 25 of them came from a single Alibaba Cloud range and not one of them requested an image. Forged referrers, presumably so the domain shows up in somebody’s stats.

None of that is an argument for handing your traffic data to an analytics company. It is an argument for writing your filter down in code and keeping it, so that this week’s number means the same thing as next week’s. Ours was a grep that changed every week, which is the same as having no number at all.