[BNM] Piwik Vs Google Analytics

[Andy Smith]

2009/4/2 Danny Hope <danny.hope at gmail.com>:
> Do you consider Google's decisions around people's private date as a
> responsibility of site owners?

I think your main responsibility, if you decide to use Google
Analytics, is to inform visitors that you're using it and that
information on their visits is being collected by Google. In fact the
GA terms of service require this, and include a sample paragraph you
can put in your privacy policy. In principle people who object to GA
can then decide not to use your site, although they will probably have
been tracked a little before they get to the privacy policy.

It's also possible for visitors to block Google Analytics, so strictly
speaking you're not forcing anyone to give information to Google if
they want to read your site. Visitors who do this won't appear in your
GA reports (along with visitors with no JavaScript and/or cookies) so
you might want to consider how many of your visitors you expect to
block GA and how much it affects the accuracy and usefulness of the
reports.

Still, I think for most sites, most visitors won't give much thought
to privacy, won't read the privacy policy, and wouldn't know how to
block Google Analytics even if they're concerned about privacy. You
might say these users deserve what they get, but I think it's
unrealistic to expect people to put much effort into assessing the
privacy implications of every site they visit. Particularly if you
have a mostly passive site which visitors just read and maybe comment
on, rather than something where users sign up for accounts and
explicitly provide personal information, I think a lot of visitors
would be shocked at the amount of information on them that's available
to Google if you use GA, if it was made clear to them. Consider this:
if you explicitly asked each visitor whether they want you to give
information about them to Google, and explained what Google could do
with their information (besides passing a summary back to you as the
site owner, which you could collect in less intrusive ways), how many
would say yes? I think most people wouldn't take up this offer if it
was presented to them explicitly, so it's nice not to hide the choice
and rely on your visitors' ignorance to collect statistics.


> In other words, if I use Google Analytics on a site and then Google
> decide to do something nasty with visitors' data, is that something
> for which I should take partial blame?

Clearly most of the blame would lie with Google, but site owners who
use Google Analytics would have an enabling role, since if they didn't
use the service Google wouldn't have the data to do nasty things with.


> On another note, how would you feel about a site's statistics being
> completely open, for anyone to see? I've been thinking allowing
> completely open access to Google Analytics and Piwik results for the
> UX Brighton site, thus enabling people to do a side-by-side comparison
> of the two systems. Is this something visitors should be warned about?
> Is it just the right of any 'webmaster' to do that?

I think this is fine as long as it's just a summary/statistical report
and doesn't contain information that can be used to identify
individual users. Having publicly-available statistics is fairly
common, although maybe less so now than it used to be, now that Google
Analytics is so popular. Being common doesn't make it right, but in
this case I don't think publishing aggregated statistics violates any
individual visitors' privacy, unless you have so few visitors that you
can glean information about individuals by looking at the reports. My
concern with Google Analytics isn't really the information that's
available in the reports, but the additional information that could be
extracted from the raw data that Google collects, and the possibility
of cross-referencing with other sites that use GA and other Google
services to build profiles of visitors that go beyond their visits to
one site.

Should you tell visitors that you're publishing statistics? I think
so, but the need is less compelling than if you were publsihing or
using individually identifiable information, or passing that
information to third parties. Certainly I think any website privacy
policy should mention that information on visits is logged and
analysed for statistical purposes, and if this analysis is publicly
available you might as well say where it is.

Andy