04. USAGE ANALYSIS AND TRACKING DATA

Explains usage analysis, tracking data and tracking tools.

1.1 What is “usage analysis”?

It’s when data collected from users and generated by their interactions with your platform are analyzed based on specific objectives like assessing the platform’s effectiveness, quantifying usage with statistical reports, personalizing the user experience or optimizing marketing efforts.

Different data will be harnessed based on the analysis to be performed: personal information provided by the user, data from user interactions with the platform or other data collected by web analytics tools like Google Analytics or Flurry.

1.2 What are “tracking data”?

These are data that track user activity through time and across platforms, thus enabling in-depth analysis. For example, by analyzing a user’s browsing history, content can be personalized according to their preferences. Tracking data are collected through the device’s unique identifier or via tracking (monitoring) tools. Below are the most common:

  • Cookies (also called web cookies, browser cookies or HTTP cookies): small encrypted text files placed by a website on a user’s hard drive that let the website identify the user and track the browsing history. A given website can have different kinds of cookies. First-party cookies come directly from the publisher’s domain, whereas third-party cookies come from other domain sources (g. an advertising network or web analytics service) and are embedded in the actual page the user is visiting.
  • Web beacons (also known as web bugs, pixel tags or clear GIFs): typically a transparent graphic image coded into a web page. Web beacons monitor the user’s journey through a single website or series of sites and can be used in combination with cookies.

The device’s unique identifier and the tracking tool both have a persistent identifier that identifies a user through time and across platforms.

Apart from the United States, usage and user activity analyses are fairly unregulated. In general, the explanation provided in your privacy policy on how you use the data collected, including tracking data, is sufficient. The use of tracking tools is restricted by law in certain countries.

CAREFUL!! Click here for information on profiling for behavioural advertising.

CANADA

Personal Information Protection and Electronic Documents Act (PIPEDA)

Federal statute defining the rules for the personal information handling practices of private-sector organizations in the course of commercial activities. You must obtain valid or meaningful consent to collect, use or share personal information, regardless of the collection technology used.

Canada’s Anti-Spam Legislation (CASL)

Federal law establishing the regulatory framework for the sending of commercial electronic messages and the installation of computer programs as part of business activities. It is prohibited to install software on a user’s computer system without obtaining their consent. However, you do not need consent to install a cookie, HTML code or Java Scripts.

Additional information:

Office of the Privacy Commissioner of Canada: Securing Personal Information: A Self-Assessment Tool for Organizations

Canada’s Anti-Spam Legislation

UNITED STATES

Children’s Online Privacy Protection Act (COPPA)

Federal law to protect personal information about children collected online. COPPA applies to products that collect personal information from U.S. children aged under 13, including collection by companies based outside the U.S.

You are responsible for all personal information collected through your platform, including any collection by third parties. Because of this, you must choose services that comply with COPPA. For example, on mobile platforms, the SuperAwesome advertising network and analytics tools Flurry and PreEmptive Solutions are COPPA-compatible.

If the persistent identifier is the only personal information collected and is needed to support the platform’s internal operations, you do not have to seek verifiable parental consent. COPPA defines “internal operations” as the activities necessary for:

  • Maintaining or analyzing the functioning of the site or service
  • Performing network communications
  • Authenticating users or personalizing content
  • Issuing and/or capping the frequency of contextual advertisements
  • Protecting the user’s security or integrity
  • Ensuring legal or regulatory compliance
  • Fulfilling a request from a child

If you and/or a third party use a persistent identifier for purposes other than to support internal operations — for instance, for behavioural advertising, you must obtain verifiable parental consent prior to collection and provide a clear explanation of your practices in the privacy policy.

Additional information:

Federal Trade Commission: COPPA Rule: A Six-Step Compliance Plan for Your Business

FRANCE & THE EUROPEAN UNION

Directive on Protection of personal data and Directive on Privacy and Electronic Communications

These directives frame privacy protection for residents of the European Union and cover companies that do business in one or more EU Member States. France’s Act on Information Technology, Data Files and Civil Liberties is based on these directives.

Tracking tools are authorized provided you obtain the user’s consent and offer them the option to refuse. Information on the installation of tracking tools along with the right to refuse should be offered the first time the user connects and cover future use. You are also responsible for the collection of information by third-party cookies.

Cookies that facilitate navigation (e.g. user authentication, content personalization, shopping carts) constitute an exception: they do not require consent.

Additional information:

European Agency for Fundamental Rights, Handbook on European Data Protection Law

Act on Information Technology, Data Files and Civil Liberties

AUSTRALIA

Privacy Act

Federal law, general in scope, on the protection of personal information as it pertains to companies that do business in Australia.

If you collect personal information using a tracking tool, you must inform the user — a notice on the home page is sufficient — and explain what the information is used for in the privacy policy. Consent is not required.

Additional information : Office of the Australian Information Commissioner, The Privacy Act

Amazon Appstore

The app distribution agreement states that Amazon reserves the right to “modify and add to your Apps so that we can collect analytics.”

Additional information : Amazon Appstore App Distribution Agreement

The Digital Advertising Alliance of Canada

This organization advises its members not to use tracking tools or any other means to gather data liable to be used for behavioural advertising with children known to be under 13 years of age.

Additional information on Canadian self-regulatory principles for online behavioural advertising

  • If your practices involve the collection of personal information and/or tracking data, explain how they apply to usage and activity analyses in your privacy policy.
  • Provide users with clear notification if your platform uses tracking tools.
  • A banner on the home page specifying that the site uses cookies, providing a clickable link

to the privacy policy and specifying that continued navigation will be taken as the user’s

consent to the use of cookies.

  • Offer parents the right to refuse consent to the use tracking tools.
  • The means used to communicate with parents and offer the right to refuse consent should be as user-friendly as possible.
  • Be transparent regarding your use of tracking tools: on your privacy policy, describe your information collection practices and provide the names of third-party operators who use tracking tools through your platform.
  • Keep the number of tracking tools on your platform to a minimum.
  • If you accept plug-ins (additional software), verify whether they incorporate tracking technologies. If so, draw up agreements to restrict the collection of tracking data.
  • Periodically review the terms and conditions of service and the privacy policies of any third parties on your platform to ensure that their practices meet your requirements.
  • Careful!!! If you use tracking data for the purposes of profiling and/or behavioural advertising, be sure to consult our backgrounder on this topic.

Bibliography.