9

http://www.luckyorange.com/index.php

While I know that tools like this might be tremendously useful for me as a site owner, as a user I would find it really creepy if a site recorded all my mouse movements, clicks and key presses.

  • Is it legal to use such a service?
  • Do you think it is ethical at least in certain situations (usability testing while the site is still in development and all subjects are informed about the recording, beta testing, etc)?
2
  • Legal in which country? By the end of May 2012 every EU country will need to get permission from the user to store cookies, which is what tends to be used with this sort of tool. May 9, 2012 at 9:13
  • Well I know I use lucky orange to make my site experience better. It helps to see what people are doing, and why they are leaving, so I can give them a better experience.
    – user94716
    Nov 9, 2018 at 22:46

2 Answers 2

10

As the Creator of Lucky Orange I'm a bit biased. The goal of the tool is to help figure out problem areas on your site so you can fix them and IMPROVE your customer's experience. That being said you are required to tell your visitors that you perform this kind of tracking in your privacy policy. We are working on creating a wizard to help generate that for you, but in the meantime you still need to tell your visitors how you are tracking them.

Lucky Orange will let you turn off certain features for improved privacy. You can:

  • Disable Mouse Tracking
  • Disable Mouse Clicking
  • Disable Key Logging
  • Disable Scroll Logging

It's also worth noting that certain fields are NEVER logged such as password fields or fields that "look" like credit card data. As well, you can mark any input field as "Sensitive" by adding the classname "LuckySensitive" to it and then that data is never sent to our servers.

2
  • Thank you for taking the time to answer personally. All of this is quite reassuring, especially the fact that I can mark fields as sensitive. May 9, 2012 at 19:10
  • Also, anyone can OPT OUT of lucky orange tracking on our privacy policy page here luckyorange.com/privacy.php
    – crickeys
    May 9, 2012 at 21:44
4

http://www.briangruber.com/ is where it's from, and I don't think there's any problem AS LONG AS you tell your visitors so in a Privacy Policy. I personally don't think it's ethical, but there are no laws against it to my knowledge. http://www.luckyorange.com/privacy.php

7
  • Why don't you think it's ethical? Unless there's a bug in the user's browser, only the mouse and keyboard activity for the site itself should be captured. And if a site's programmers so chose, they could send any info or data they're already capturing to any other site or service anyways. May 10, 2012 at 20:33
  • 1
    Because I've personally written a JavaScript keylogger before for testing, and unless the user is actively aware they are being monitored then it should not be implemented. I think if people did know then you would lose a lot of visitors. Europeans especially value their privacy in this sense.
    – ionFish
    May 10, 2012 at 20:36
  • But the keylogger would only work when a user is actively browsing a page running that code. That seems like expecting privacy in public – what would users reasonably type while looking at a particular webpage that they wouldn't want to share? I get that they may accidentally type the wrong password or something else not pertinent to the particular page they're viewing, but they already do that even if the particular key strokes aren't being recorded. May 10, 2012 at 21:53
  • 1
    The keylogger in JavaScript has the potential to be injected into a page if an attacker can change the source code, and then collect everyone's passwords to the site's login form. I don't think it's ethical to have the power to see what people click on (mouse strokes) or what they may type into the boxes, without clearly telling them. If I found out that a site I visit daily (nytimes.com) did that, then I would be hysterical.
    – ionFish
    May 11, 2012 at 1:15
  • Why would you be "hysterical", or even upset, if nytimes.com, or any site, was recording your keyboard and mouse activity? What are you doing while viewing pages on that site, or any site, that you wouldn't want to share? Do you type all of your passwords? Do you make embarrassing figures with the movements of your mouse? Are you obviously a slow reader based on your keyboard and mouse activity? I think you imagine that someone is actually replaying the recorded activity so as to "see" how you are interacting with a page – that's ridiculous! May 11, 2012 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.