Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the introduction of this tool, I'm going to be asked what the security implications are.

Does using Google Analytics pose any security concerns? Are there any PCI compliance issues that it might introduce? And if there are no unreasonable concerns, how can I document this? I have searched Google Analytics website, and have found a privacy statement, but not a specific statement of what information their tool collects, or how it is stored.

share|improve this question
    
You should also consider using Piwik Web Analytics, which is free and open-source. You have to self-host it but with https and your own server you don't need to trust or share your data with a third-party (insert NSA joke here). I've moved completely off GA and I find Piwik far outperforms GA and is worth the extra setup effort. –  Tom Brossman Jul 17 '13 at 8:57

1 Answer 1

To use Google Analytics, you have to insert a JavaScript snippet into the page that is served by Google. This gives Google the technical opportunity have this JavaScript do anything to your page or with your visitors. You certainly have to trust Google. You also have to then trust that this code isn't altered in transit. You have to trust that Google secures its infrastructure.

share|improve this answer
    
Thanks Stephen. I'm familiar with the technical aspects of how it works. I'm looking more for some policy or documentation from Google so that I have answers when these security questions come up. I need a way to document, from Google, what they actually do collect. –  BigDave Jul 17 '13 at 14:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.