I love this module and I think it works great, but I just wanted to bring this to the attention of the developer so that we may review and possibly make a subtle change to the way users are tracked with Google Analytics.

As outlined in the terms and conditions of Google Analytics

http://www.google.com/analytics/en-GB/tos.html

8.1 You will not associate (or permit any third party to associate) any data gathered from Your Website(s) (or such third parties' website(s)) with any personally identifying information from any source as part of Your use (or such third parties' use) of the Service. You will comply with all applicable data protection and privacy laws relating to Your use of the Service and the collection of information from visitors to Your websites. You will have in place in a prominent position on your Website (and will comply with) an appropriate privacy policy. You will also use reasonable endeavours to bring to the attention of website users a statement which in all material respects is as follows:

Right now when I use this module I can track users, by username in Drupal. This is available under dimension: user defined value. While I think its great, Google may not. Instead we could track user by role. For example admin / registered user / guest etc..

Keep up the great work on the module.

Cheers,
Gavin.

CommentFileSizeAuthor
#2 D6_1x_ga_tos_compliance.patch3.48 KBhass
#2 D5_1x_ga_tos_compliance.patch3.47 KBhass
#2 D6_2x_ga_tos_compliance.patch3.57 KBhass

Comments

hass’s picture

hass commented
Title: Tracking Individual Users Against Google Analytics Policy » Tracking Individual Users is against Google Analytics Policy
Category: feature » task

Hmmmmm... there may be users who uses this field... :-(. It's not a default setting and is the admins decision to break the Google rules and we may get *many* complains if we simply disable this feature. But I think we should nevertheless do so... otherwise people can add personal data fields with the profile module... and therefore we cannot deny it in general - only for the default known stuff! We should therefore extend the help text by this link...

hass’s picture

hass commented
Status: Active » Needs review
StatusFileSize
new D6_2x_ga_tos_compliance.patch3.57 KB
new D5_1x_ga_tos_compliance.patch3.47 KB
new D6_1x_ga_tos_compliance.patch3.48 KB

Please review attached patches.

budda’s picture

budda
Primary language English
Location Cheshire
commented

I've used the module to allow a webmaster of an intranet to track the members of staff. They have the usual privacy policy. However I guess that could still be breaking Googles TOS? I guess its a risk people may want to take.

How about making the facility work as it does now, but only if a user explicitly sets a variable in their settings.php - they are agreeing to violating the TOS by doing so.

hass’s picture

hass commented

Yes, you break the TOS and I'm sure your users are not aware about your sites privacy issue. You may ask them... :-). If there is only one IT guy between them - I would expect you will receive some good hate. You should be aware that the uid and username could be saved on servers in US or a country with different laws than yours. This logged usernames may also become a security issue on your site. In general it's a very bad idea to save personal data on foreign servers (especially in US or UK) if it comes to privacy and data protection.

I think we should go with the patches and do not support anything else that could break privacy (or/and the TOS of Google). Maybe some more people are able to vote here.

gav240z’s picture

gav240z commented

While I think some may see a benefit in capturing personal data such as usernames on a website and what pages they viewed. As an overall scheme of things, I think you don't really need to see this information when it comes to improving your website and understanding user trends.

I think tracking members vs non-members should suffice. For example non-members bought 10% less in our e-commerce store than members did etc..

budda’s picture

budda
Primary language English
Location Cheshire
commented

Does Google logging an IP address count as personally identifiable information then? As somebody with a static IP address it could be used to find me via a websites analytics.

Whilst most people don't need to know about a specific user browsing the site, we've got two clients who want to know what speicifc users have been using their subscription service. However, I agree that sticking this data on a foreign server is probably not great.

hass’s picture

hass commented

I think they do for technical reasons, but their policy says the IP will be deleted after 9 months for data protection reasons. Many courts in German decided that IP addresses are not personal data. Dynamic IPs are changing on every new dial-in for example. The real name can only be identified by the ISP if an district attorney or a court requests this data because of criminal act's. But if Google have the IP, you don't have it and they do not show it to you :-). Nevertheless you may have a static IP, you are not able to identify the user behind... if the complete office surf your site you are unable to identify the individual user... it could be one of 10/100/1000/10000 users - however big your company is or your friend's, parents, neighbour, etc.

This sounds very strange... why saving local website subscription stuff in a Google system? It would be much easier and technical better to save this together with the user logged in and the subscription. This would provide much much more detailed information that a google tracking could ever show. Not sure if simple_news already have such a feature build-in, but the newsletter/subscription module should know best who have a subscription and who uses it or not? This stats wouldn't be broken and mangled by a lean statistics system... I would like to have a much more detailed statistic than the google segmentation "hack" can show me :-).

What should we do now? I'd like to get this solved for the upcoming release (therefore very soon).

alexanderpas’s picture

alexanderpas commented

how about tracking roles?

hass’s picture

hass commented

Roles tracking is no problem except you have one role per user.

gav240z’s picture

gav240z commented

Role tracking would be good.

I think it would be great to be able to track a user by custom profile values.

Say for example a user registers and in the user profile I have optional personal data such as

Gender / Age Group

EG: Male | 18-25

pageTracker._setVar("Male | 18-25");

It would be great to place these two variables in the user defined value of Google Analytics.
So you could extract information like so:

Male:18-25 - Bought more of product A or Subscribed to newsletter B
Female 35-45 - Viewed more pages under the topic of hair care

This would provide some demographic information. Of course unregistered visitors would be set to unregistered / guest or whatever anonymous is defined as in Drupal.

Just some ideas :).

@budda - IP addresses are not accessible by Google Analytics account holders. Rather this information along with cookies is used to determine if a visit is unique. It is against Google policy to include IP addresses in any reports. I believe there is some debate about Google Analytics in Germany at the moment http://www.webanalyticsbook.com/google-analytics/google-analytics-under-...

hass’s picture

hass commented

@gav240z: This is already possible with the module.

gav240z’s picture

gav240z commented

Ok I will look further into the modules abilities. Sorry about that.

budda’s picture

budda
Primary language English
Location Cheshire
commented

@gav240z you need to have the core profile.module enabled to do the segmentation.

@hass "subscription" means paid membership to a website, not an email newsletter subscription.

hass’s picture

hass commented

Ok, but this type of subscription also shouldn't be in Google. It should be in your database where you create invoices from... machine readable information. Aside I would use the e-commerce part for this if it must be Google Analytics where this data is collected. You should really protect your subscribers data... not everything that is possible is allowed and good to collect.

Have your personal tax data or credit card data or social number not been lost in UK? Have you heard about the many lost government DVD's with millions of peoples data in UK? I really hope they don't loose and really permanently destroy the bio pictures after 6 months - made on the airports and do not loose them somewhere on DVD in the UK :-(

hass’s picture

hass commented
Status: Needs review » Fixed

Fixed in all branches and versions.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.