We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database.

So all the user activities will be known and we are using them to create information our CRM so that we know more about our user, e.g. which products they have visited and how often they view that page.

My questions:

  • Are there any privacy concern since we identify the user, not just analytics.
  • Is it legal in countries such as EU?
  • What thing we need to pay attention to the data we gathered?
  • Do you need this information in general or tied to a specific user's identity? I worked on a case where we used salted-hashes as a user's ID. The data collected (clicks, time on page, etc) were stored against this hashed ID. This data was then sent to the marketing team for analysis. Using this technique, you can get the meta-data you are after without linking it to a specific user. That may or may not fit your usage case but something to consider. Commented Jun 19, 2014 at 19:09

1 Answer 1


Without a doubt, you need to disclose these practices in your term of service and privacy policy.

My rule of thumb is that you probably shouldn't collect anything that you wouldn't feel comfortable explaining to your users or disclosing publicly (what if you ended up having to explain it in court?).

Obviously, you need to be very careful (PCI compliance requirements) with recording things like credit card data. It's also smart to be very careful about recording "sensitive" data like ethnicity, sexual orientation, religious beliefs, maybe even age.

Since you tagged this with security, it's also wise to be cautious about what you store (e.g. passwords) in plain text, or even in the same database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.