Visitor activity tracking for B2B

My first response was “why do you need to track visitors at all?” but there are plenty of valid reasons. I guess I’d personally draw the line at cross-site tracking. If you want to use analytics to see how exactly people are using your site or how they’re navigating around, that’s a legit reason.

As for homegrown vs using a prebuilt system, I’m of two minds:

On the one hand, larger tracking “packages” (for lack of a better term) can track so much more than just what you’re after, so I think using one of those would be a bit overkill if you just need simple analytics. There’s also the fact that they’ll probably use it for cross-site tracking and advertising purposes, even if you aren’t.

On the other hand, building one yourself means that a) you have to maintain it and b) you’re on the hook if something goes wrong. It also means your visitors are trusting you with their data. Are you trustworthy?^(/s)

It depends on what your goals are. Do you just need aggregated web traffic analytics? Do you need to track individual users across a single visit / session to your site? Do you need to track the same user across many visits to your site (at this point you’ll need cookies)? Are you going to use to information you are gathering to try and target ads to specific users across the web?

The more questions you are answering “yes” to, the more invasive of technology you will need. As a privacy-conscious user, I would prefer for companies to stick to tracking me across one browser session and to avoid cross-site tracking.

I would avoid building your own solution. You should be able to find solutions for anything typical that you want to do, at all levels of privacy consideration. It’s hard to provide recommendations without knowing your goals (and which are must-haves and which you would be willing to give up to be more privacy-conscious).

It sounds like all you want to do is see what people are doing on the site yes?

In that case privacy concerns aren't as relevant as you might think. Standard request logging, which is already happening at virtually every site on the internet, already covers the majority of what you need. Essentially you need an identifier (ip address for guests, session ID for logged in users), the URI requested, and a timestamp. After that it's pretty simple code to construct a particular visitors path through the site. If you want to know what they requested via a form (like a search box) then you maybe need POST request logging too, though only if the results landing page doesn't include the term in the URL.

The only other thing you might consider adding is a JS beacon of some sort so you can more accurately tell when a session or pageview ends. With JS you can of course track other things, like scrolling and mouse/pointer activity, but that's not likely to be useful in your case.

The privacy concerns come in not from collecting basic visitor data, that's table stakes, but from storing it in a non-anonymized way for a long period of time. Especially if it can be linked to additional PII. You fix that by not storing it for very long. That way it limits the impact of a breach, and your ability to share the data with others. If you really want to influence the privacy practices of the company, get it in writing in a published data retention policy.

Note that you can store aggregate stats with identifiers stripped for as long as you want, no privacy concerns there.

The other potential privacy issue is profile building for use in marketing. If you're collecting data about users and then uploading it to, say, Google Ads for targeting purposes... well it may be legal but it means you don't actually care about privacy, you're funneling data to the digital overlords. Even if it's pseudo-anonymous, they have enough additional data to link it to individuals if they want to.

It's actually pretty easy to make a practical case against that: The minute you share data with a 3rd party you move into a new category under laws like the GDPR. Your liability goes up and the number of rules you have to conform to (and build for) under a host of laws in various jurisdictions go up too. A public privacy policy that excludes sharing data with third parties sidesteps all of that. And you don't lose much as long as you're not relying on third parties for things like analytics. The truth is ad targeting based on uploaded user data isn't really that effective. They push it because of an insatiable hunger for data, not because it's better than context or behavioral targeting in most cases.

If time allows, it's simple enough to build that it's worth considering rolling your own. You'll learn a lot!