Measuring Success » Privacy and Accuracy

Organic search terms blocked by Google

Brian Clifton — Wed, 19 Oct 2011 10:38:30 +0000

An odd announcement form the GA product team was made last night that affects all users of web analytics tools:

When a signed in user visits your site from an organic Google search, Google Analytics will no longer report the query terms that the user searched on to reach your site. – Full announcement

That’s a BIG change! Essentially marketers will no longer be able to view the keywords used by visitors that come from Google organic search in their web analytics reports (the fact they came from a Google organic search is still shown). The rational for this, as the announcement explains, is to protect the privacy of users who are logged into their Google account.

What’s my view?

As you know, I am a big fan of user privacy and putting the end-user experience first, so on the one hand this is a good approach. However, this does appear to be a little over zealous.

Oddly, paid search is treated differently…

A dichotomy form the announcement is that Adwords traffic is not affected by this. It appears strange to me that Google considers privacy important for organic searches, but not for paid searches.

What’s the impact?

This impacts Google Analytics users and users of *any* web analytics tool.

And I suggest the impact is very large. Although users who are not logged into Google are unaffected, there are approximately 300m GMail users globally, and anyone who is active with Google services (Google’s whole raison d’etre!) will fall under this catch-all setting. It means a valuable piece of information for optimising your website – both for content and traffic acquisition – is going to be missing form your reports. I find that peculiar coming from a company that focuses heavily on keyword relevance when ranking websites in its organic results. Surely, should be helping website owners with this info…

The following video illustrates the significant impact this is starting to have for the period 10-Oct 2011 – 08-Dec 2011 (idea taken from Michael Whitaker‘s similar observations):

Your thoughts

This is going to be a major talking point I am sure and I would love to hear your feedback. The comments on the announcement itself are very negative (I particularly like the first one – “where’s the -1” – joking a side, I do think a -1 button would be great to have in search results).

For me, I really do not think this has been thought through fully by Google (something I have noticed happening more often at G in general). I agree the user should have the option to keep their search terms private – the option to switch this on/off in the account settings would make sense. However, at present keywords are removed whenever a visitor is logged in to their Google account – with no choice for the user (I don’t consider logging out a viable option). Thats got to be a bad thing, no?

Related posts (automatically generated):

© Brian Clifton for Measuring Success, 2011. | Permalink | 25 comments | Add to del.icio.us
Post tags: google search, privacy

Google Analytics and the new EU privacy law #2

Brian Clifton — Thu, 16 Jun 2011 13:00:42 +0000

Lots of interesting discussion sparked by my last post on the new EU privacy law, so I thought it worth while to follow up and clarify a few points that were raised:

The new EU law came into affect on 25th May and is applicable to all EU member countries – right now
Its up to the individual member states to enforce the law in their countries
As a website owner, you need to obey the law in the country/countries you operate from. So if you have an office in the UK and France, you need to comply with both UK and FR law – hopefully these will be very similar. Hosting your website in Barbados does not change this…
The law is applicable to all websites – commercial and non-commercial.
The reality is that no one (the regulatory bodies for each EU country) is ready yet and so more thought and discussion is going on – so people are not going to be prosecuted just yet.
The UK have announced a 12 month grace period to allow site owners to sort themselves out. That means time for you to understand the new privacy law, audit your website for tracking capabilities (such as cookie collection), and adjusting your site accordingly. That means changing what information is collected, how it is collected, and how the practice is communicated to the visitor.
The law is there to protect visitor privacy – that means no 3rd party techniques (sharing information with other organisations) and no personal information such as name, email address etc. being collected, UNLESS the explicit consent of the individual is given.
The wording of the law is *not* technology specific. That is, although we discuss this in terms cookies, as all the major web analytics vendors use these for visitor tracking, this law still applies should an alternative technology be developed.

As you read the above list, you realise the difficulty for the authorities, such as the UK’s ICO, who are trying to word this in a legal or even guideline document. Behavioural targeting and the abuse of private information is what this law is about – and I am happy that its here. The people that work at the ICO and other authorities are smart people that work in the digital world as much as we do. Benign, anonymous, aggregate reports – such as that provided by GA is not the target of this law.

What you should do as a website owner

Don’t panic. Follow point 6 now and get a full understanding of what information you are collecting. Ensure your privacy statement is up to date and accurate – keep it simple, not full of legal jargon. There is an example privacy statement in my book, Chapter 3. Funnily enough this was the original ICO’s privacy statement (they have been using GA since 2006).

If you wish to perform behavioural targeting or collect personal information, then get explicit consent from your visitors. If your audit reveals you are benignly tracking visitors anonymously and in aggregate (as per Google Analytics), then you are going to be fine*.

*You must complete an audit in order to show this – thats the ICO guidance and I agree. Simply saying “we use GA so we are fine” is not good enough. I just worked with a Google Analytics client today and discovered they were inadvertently collecting visitor email addresses (it came from the confirmation link sent out for an opt-in subscription).

As always, please add your thoughts with a comment.

Related posts (automatically generated):

© Brian Clifton for Measuring Success, 2011. | Permalink | 12 comments | Add to del.icio.us
Post tags: eu, privacy, privacy law

Google Analytics and the new EU privacy law

Brian Clifton — Fri, 20 May 2011 10:26:09 +0000

Following new EU laws aimed at protecting the privacy of online users, there has been much said about the death of web tracking as we know it. At present the wording of the law is stating that visitors to your website must explicitly consent to having cookies stored on their computers. As pretty much all web analytics tools rely on cookies for visitor tracking, there are clearly implications for anyone that uses these on their site. [ Update 16-Jun: see follow up post summarising this discussion ]

This law has been brought into place due to the failure of our industry to self regulate privacy properly. The EU law makers are targeting the surreptitious tracking of individuals that has been going on for many years. That is:

Sharing cookie information collected on one website with another 3rd party website via 3rd party cookies.
Identifying anonymous visitors – either by using data from a 3rd party cookie were personal information was entered, or back-filling previous visit data when a visitor later creates an account or makes a purchase.
Tracking visitors even though they have set their browser privacy settings to block tracking cookies (used by Flash Shared Objects).

If you are using 3rd party cookies and/or Flash Shared Objects, this law is very much targeting you. Essentially you will need to provide explicit consent to continue doing this (or use any other similar technology). This law forces perpetrators of such tracking to either stop doing so, or suffer a poor user experience and declining web business by having to use pop-ups to gain visitor consent. Either way is a good thing for the web.

The impact on Google Analytics users

Google Analytics uses 1st party cookies to anonymously and in aggregate report on visits to your website. This is very much at the opposite end of the spectrum to who this law is targeting. For Google Analytics users, complying with the ToS (and not using the other techniques described above), there is no great issue here – you already respect your visitors privacy…!

I will agree the wording of the ICO document is “awkward” and gives rise to ambiguity. Essentially, they do not wish to name the technologies this law applies to (3rd party cookies, Flash Shared Objects) as these can of course change. It is the method of invasive tracking they are quite rightly trying to stop, so I expect the wording of the document to be refined over time.

The ability to block 1st party cookies is built into every web browser (10+ years for IE), so I feel this para applies:

“(3A) For the purposes of paragraph (2), consent may be signified by a
subscriber who amends or sets controls on the internet browser which
the subscriber uses or by using another application or programme to
signify consent”.

The ICO document asks you (as the web site owner) to ask yourself – Is tracking the performance of your website strictly necessary? That’s straightforward to answer – Yes! In the same way tracking the performance of your business is strictly necessary.

The keywords for Google Analytics are: anonymously, in aggregate, and via 1st Party cookies.

I would be interested in your view on the EU privacy law and its impact on GA. Please add your thoughts via a comment. There is also a follow up post from me clarifying some points raised here.

Related posts (automatically generated):

© Brian Clifton for Measuring Success, 2011. | Permalink | 43 comments | Add to del.icio.us
Post tags: cookie, cookies, eu, law, PII, privacy, privacy law

The FTC Privacy report “Do Not Track” – a missed opportunity

Brian Clifton — Fri, 11 Feb 2011 06:42:02 +0000

As readers of this blog will know, I am a strong advocate of online privacy… That may sound strange coming from a web analytics evangelist. However, if we as an industry do not sort these privacy issues out, there is a real danger that web analytics as we know it today will disappear completely.

So, following the recent excellent post from Phil Kemelor on The FTC Privacy Report, “Do Not Track” Options and Web Analytics, I wanted to also add my take here…

Disappointment

I was disappointed with the FTC Privacy report for only tackling the issue of Personally Identifiable Information (PII). To my knowledge, all developed countries have good data protection laws on this already. Essentially, this means, “you” can only store PII data with the explicit person’s permission, and you must reveal this to the person concerned should they request it. See for example the UK Data Protection Act.

What I was hoping for from the FTC, was a position on non-PII data collection. That is, collecting data that does not DIRECTLY identify the individual. I emphasise directly, because with so many web data points available from an anonymous user, it is possible for an organisation to “triangulate” non-PII data and build up a pretty sophisticated profile of the person – ultimately identifying them.

A classic case of this happening was the AOL data scandal of 2006. This involved the release of a large volume of “anonymised” search query data, intended for research purposes, that NYT journalists (and others) were able to analyse and subsequently identify people with.

Track in Aggregate

I think (hope!) web users are pretty savvy when it comes to sharing their PII data on the web – in the same way you wouldn’t share your PII with a stranger in the street.

Tracking individuals as “individuals” on the web (as opposed to in aggregate), even when anonymous, poses a greater privacy threat – as it is unregulated. As more people realise this, we could reach a critical mass of people blocking vendor tools such as Omniture, Google Analytics, Coremetrics etc., to the point where the data is so unrepresentative that it is meaningless.

The answer is to only* track your web visitors in aggregate - that is, looking at metrics that represent a segment/group, rather than an individual. In that way, an individual can never be identified. Yes, this is a compromise. Individual data is much more interesting to marketers – “we could target a potential customer with laser-like precision“. But in reality this rarely happens – after all, the visitor is still anonymous, which means there is still a lot of guess work to be done with your laser.

IF (and its a big if), all web analytics reporting was conducted in aggregate, I feel the privacy fear many people have with web analytics, would all but disappear – safe guarding our industry long into the future. That’s a very large up-side compared to the very small down-side of not having individual visitor level data.

As always, I would be interested in your comments on this subject…

*If a visitor is an existing customer, subscriber or previously given you their PII, then of course tracking them as an individual makes sense – so long as they “identify” themselves each session i.e. log in.

Related from arrticle from Vicky Brock of the WAA:

http://waablog.webanalyticsassociation.com/2011/02/privacy-debate-not-just-about-advertising-marketing.html

Related posts (automatically generated):

© Brian Clifton for Measuring Success, 2011. | Permalink | 4 comments | Add to del.icio.us
Post tags: cookie, eu, ftc, law, PII, privacy

Five Predictions For Web Analytics in 2011

Brian Clifton — Tue, 09 Nov 2010 17:23:19 +0000

Predicting the future invariably means you will be wrong most of the time. However, it is an interesting process to go through as even getting just one prediction right can have a significant impact – to me personally, my business or my client’s business. So I was honoured when Daniel Waisberg asked me to look into my crystal ball for what may happen in the world of web analytics in 2011.

Here’s the summary of my predictions:

Privacy – A Threat To The Web Analytics Industry
Optimisation Rather Than Reporting
Predictive Analytics Will Remain Niche
Accessing The Web Will Be Different – So Will Its Measurement
WebTrends Will No Longer Exist

Read the full article, and join the discussion, at online-behaviour.com

To see what I have predicted before, have a look at “Phase 4″ from me in the following article – Google Analytics Four Years On (Apr 2009).

Related posts (automatically generated):

© Brian Clifton for Measuring Success, 2010. | Permalink | 4 comments | Add to del.icio.us
Post tags: 2011, 4 years, future, history, predictions, privacy