Privacy concern to track every user actions in your website?

Question

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database.

So all the user activities will be known and we are using them to create information our CRM so that we know more about our user, e.g. which products they have visited and how often they view that page.

My questions:

• Are there any privacy concern since we identify the user, not just analytics.
• Is it legal in countries such as EU?
• What thing we need to pay attention to the data we gathered?

Answer 1

Without a doubt, you need to disclose these practices in your term of service and privacy policy.

My rule of thumb is that you probably shouldn't collect anything that you wouldn't feel comfortable explaining to your users or disclosing publicly (what if you ended up having to explain it in court?).

Obviously, you need to be very careful (PCI compliance requirements) with recording things like credit card data. It's also smart to be very careful about recording "sensitive" data like ethnicity, sexual orientation, religious beliefs, maybe even age.

Since you tagged this with security, it's also wise to be cautious about what you store (e.g. passwords) in plain text, or even in the same database.