Web analytics needs best-practice guidelines

A code of practice is urgently required to cover privacy issues and to professionalise the website analytics industry, according to UK specialist Site Intelligence.

As the industry for measuring website traffic has developed, issues have surfaced surrounding the Data Protection Act (DPA) and the use of cookies – small text files on a user’s browser and hard drive that uniquely identify them.

Some clients of website analytics companies do not adhere to the DPA and have no explicit indication that their website visitors are having data collected on them. The varying use of cookies also includes some methods that can compromise the security of customer data, such as financial data.

Site Intelligence director John Woods believes the website analytics industry should self- regulate in the same way that solicitors or marketers have their own set of industry standards.

He recommends the following guidelines for website analytics companies.

Analytics organisations should take responsibility for ensuring the services they provide are consistent with their clients’ privacy policies and do not conflict with the DPA and other relevant legislation and industry guidelines;

Analytics organisations and their clients should explain clearly on their websites what they do to collect and analyse their users’ browsing and buying data, and how to contact them to resolve any concerns;

The website operator, rather than the website analytics company, should “own” the visitor data unless a specific opt-in is given;

If an analytics company combines visitor data from many sites (for example, using third-party cookies), both the analytics company and its clients should make this clear in the privacy policy and provide a further opt-out for the aggregation of data;

Website analytics tools that might be confused with “spyware”, such as Java plug-ins, should not be used unless there is a specific business requirement, and in any case should be clearly signposted and explained in the website’s privacy policy.

“Website analytics has been accepted as an integral part of online business, but it has its own set of issues because of the technology used,” says Woods. “Website analytics done properly need not give rise to any privacy or security concerns, but too many companies are careless in the way they implement and document website measurement systems. This risks causing needless worry to the internet-using public.”

He says it is up to website analytics companies to debate and expand on his proposed guidelines, suggesting the Emetrics Summit, to be held in London on May 24 to 26, as the ideal forum.