3 ms·
I was in charge of building this kind of product for another analytics company, this technology is called session replay, and it is used for many use cases, lik
by polote 8y ago
I was in charge of building this kind of product for another analytics company, this technology is called session replay, and it is used for many use cases, like : UX improvement/ support/ bug detections ...
Most of vendors record keyboard inputs and thus can record password as well as credit card information, there was an affair about it a few years ago [1]. To not have this issue, most of vendors provide a way to not record those information. It requires manual tagging of the website on the element that contains critical content.
But many of session replays vendors have many clients, and don't force or don't verify that all the critical information are masked. This is not GDPR compliant, because when the GDPR apply you need to consent of the user to record his PII, and you are not even allowed to record information like password, sexual orientation, credit card even if you have the consent.
Two things:
- Nowadays on the web most of payment pages are not hosted on the client website, so those analytics tools are not included (but we still have many websites that don't use third party for that)
- This data is not (most of the time) recorded in a structured way, data of inputs is recorded as some element of an HTML, and thus it is not super easy to extract the information at scale
[1] https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-credentials-password-leaks-to-mixpanel-and-session-replay-companies/ https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-c...
- codetrotter 8y ago> you are not even allowed to record information like password, sexual orientation, credit card even if you have the consent Wait, why can’t a website record my sexual orientation with my consent? How will dating sites work then? Or is there a difference between asking about sexual orientation and asking me about what gender I would like to see / what I am looking for? If there is a difference then what’s the point of not allowing sexual orientation to be stored? From a practical point of view the question phrased like what I am interested in / looking for gives about the same information don’t it?
- polote 8y agoIt is the difference between personal data and sensitive data, I'm not expert of the subject, but on this article https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/ they say > Paragraph 1 shall not apply if one of the following applies: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes But I was talking about third party that collect information, not the website itself, I was only working on third party so I don't know what websites are allowed to do
- codetrotter 8y ago> But I was talking about third party that collect information, not the website itself, I was only working on third party so I don't know what websites are allowed to do Ah, I see.