6 ms·

Stop adding email tracking links to phone numbers

140 points by edent 7y ago

deleted 7y ago
[deleted]
duxup 7y ago
Is this common? Or is this a bunch of folks "doing it wrong" and not really getting anything out of it anyway?
- W4ldi 7y ago
  It's most likely a bug. Some dev added tracking to all the href's and just didn't think about phone numbers. The title of the article sounds like they did it on purpose, which i doubt.
  - duxup 7y ago
    Yeah that's what it seems like to me. Just a case of doing it wrong.
  - citrin_ru 7y ago
    I'd argue that it is not a bug - it is a wrong assumption (that all URLs are http/https) based on limited experience. With a typical bug code works not as author intended it to work. Numbers of such bugs can be reduced by testing and better tooling. But software development as an industry creates incentive to be overconfident and not to question own assumptions: developers who don't stop to read documentation/standards/gather information in anther way deliver more features in less time.
- cosmie 7y ago
  It's a process breakdown, either manual or automated. Marketing teams tend to use a tagging worksheet like this[1] when creating new emails. They're just told to put all links through that process, and the topic of tel links don't really come up. I've handed off dozens of link generators like that to marketing and account management folks, and never thoguht to add any checking for tel links in the logic or to surface that edge case in the instructions. So if they're going through the motions they were told to, but don't fully understand why (and don't QA properly) this is what you end up with. Could also be a system using the same logic of surfacing every <a> tag link for tagging before deployment (based on the utm names, there's at least some type of semantic logic to the naming that indicates a person was involved at some level and knew it was a phone number they were tagging). [1] https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3NYt392T6l6Tq9e89Yieg8AM/edit#gid=0 https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3...
  - lxcfan 7y ago
    To add to the parent: Most major marketing automation and email marketing tools are going to add these links automatically in the email builder. Most WYSIWYG email builders built into these tools are pretty painful to begin with, and especially so when content with links is copied from one tool to another. (Think of the poor marketing person being given various blurbs in Word, Gmail, etc. and told to make a functional email out of them while having to use a shitty WYSIWYG.) Beyond that, most marketers I know have absolutely zero input into what email platform they use. Many organizations are stuck using antiquated, broken tools (I'm looking squarely at you, Eloqua) because of complex existing integrations they have set up. I don't see this changing any time soon. Few marketing orgs have the IT budget and/or on-staff knowhow to fix this problem. Nor are they likely to be aware of it. Nor, for that matter, are they likely to prioritize it over the many more pressing things they could be fixing that more directly affect revenue.
draw_down 7y ago
Looks like you notified them of the problem so not sure a blog post was required! But sure, companies should not do this
laurent123456 7y ago
Clickbait title that implies that tracking links are commonly added to phone numbers, while there's probably just that one bug he noticed.
- deleted 7y ago
  [deleted]
bathtub365 7y ago
Is there another example of a company doing this? The title seems to imply that this is a widespread problem.
saagarjha 7y ago
> So, if you're writing link tracking software, please make sure only to add parameter to URls where it makes sense. Also take a moment to consider if you to track what links people are clicking on at all.
- duxup 7y ago
  Internally at least I like to know how the web apps I write are being used. Like if the first thing everyone does is open their "messages" ... maybe give them an option to just do that automatically. Send that info to a third party ... no I'm not down with that.
  - superkuh 7y ago
    So just look at the logs? Why is tracking link crap required?
    - duxup 7y ago
      I'm not sure it is "required".... depending on what you're talking about. I was speaking more generally about what folks think of as "tracking" being a really wide topic that can involve totally innocuous "tracking" that is actually to their benefit, and far worse that is more of a dark pattern.
      - JohnFen 7y ago
        True. But tracking is so common and so widely abused that I think it's entirely reasonable to take the stance of blocking it all anyway.
- gruez 7y ago
  if you want to track whether people are clicking on links, utm parameters are the wrong tool. since they're url parameters, they they really only work for internal links. if you want to track all links, you need to resort to onclick handlers + xhr/fetch or beacons.
egdod 7y ago
Maybe just stop adding tracking links altogether.
- zelphirkalt 7y ago
  Damn, you were faster. I was gonna write: "I can shorten the title: Stop tracking."
- deleted 7y ago
  [deleted]
notwedtm 7y ago
I would argue that it's your phone that is in the wrong. The dialer should know that a `?` is not a valid DTMF tone, and strip all invalid characters. There are plenty of use-cases where having tracking metadata is useful. I can't think of a single one where having a dialer interpret a `?` is.
- hedora 7y ago
  As the article says, the standard for tel: urls specifically forbids the behavior you’re describing.
hedora 7y ago
From one of the comments, this FF add on rewrites links to remove tracking parameters: https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid-and-utm/ https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid... Too bad ssl makes it hard to this at the router level (similarly to Pi Hole, but for HTTPS, not DNS).
- swiley 7y ago
  Not really, just make your own CA and run squid.
  - oarsinsync 7y ago
    Please do not do this. The previous comment does not take into account the huge security hole you're creating by doing this, in particular the importance of ensuring that whatever hosts you're signing certificates from does not get compromised, and the risk to things like online banking and online payments caused by your own personal MITM host being compromised. As frustrating as tracking on the internet may be, you'll be a lot more resentful of your bank when they outright refuse to refund you any of your money, when it becomes clear that you opted to MITM your traffic, and your MITM host got compromised, resulting in the theft of your banking credentials. There are many reasons why you should MITM your hosts, and there are many reasons why companies Bluecoat make large sums of money providing solutions to this problem. It is not a trivial problem and solution. In a much simpler space, "just run an FTP server" does not encompass what Dropbox does.
    - swiley 7y ago
      You also have to make sure the machine your browsing from isn’t compromised. IMO it changes very little unless you’re living with other people.
      - deleted 7y ago
        [deleted]
      - oarsinsync 7y ago
kaizendad 7y ago
As a marketer in a former life, I can't understand why somebody would do this. It's very cheap to get a separate phone number for each inbound channel and there's tons of software that will track which channels are working for you, starting at the low end with an intern and Excel.
- skrebbel 7y ago
  It's just a bug. Somebody made a script that appends tracking codes to every <a href=".."> in the document.
soared 7y ago
For non-marketers here: you aren’t supposed to use utms for internal links anyways. Doing so will break your analytics and there are ways to track button/link clicks without utms.
mikesabat 7y ago
For use cases where one wants to track calls, length or connection, the better way to do this is the click-to-call approach. Have a button that says, "Call Me". If you have the user's number place a call to them and connect it to the destination number. If you don't have the user's number then collect it before placing the call. There are much better tracking benefits and data collection for phone numbers. If one is doing marketing and wants a person to call, there usually isn't much of a difference in conversion rate between a call to action like "Call 800-555-1212" and a form that will call you. Source: An employer powered a metric shit-ton of advocacy call campaigns - like the STOP SOPA & PIPA stuff that took over the internet a few years ago.
JohnFen 7y ago
Tracking links are why I never just click on links anymore. I copy/paste them so I can edit out the spying nonsense.
- hombre_fatal 7y ago
  There are extensions that can help with this. First google result: https://chrome.google.com/webstore/detail/tracking-token-stripper/kcpnkledgcbobhkgimpbmejgockkplob?hl=en https://chrome.google.com/webstore/detail/tracking-token-str... Hooks into chrome.webRequest.onBeforeRequest.addListener(...) to rewrite the request url at request time.
  - Forbo 7y ago
    For Firefox, I've been using the ClearURLs add-on. https://gitlab.com/KevinRoebert/ClearUrls https://gitlab.com/KevinRoebert/ClearUrls Edit: Looks like it's available for Chrome as well.
- cuspycode 7y ago
  I copy and edit, and then paste into a different private browser instance.
  - deleted 7y ago
    [deleted]
  - fsflover 7y ago
    And I open them in a disposable virtual machine on Qubes OS :)
- driverdan 7y ago
  Block trackers and the problem goes away. Very few companies track these types of links on the server, it's all easy to block front end JS.
maerF0x0 7y ago
shhh.. if they figure it out they'll start to provision single use numbers (or LRU style churning) to track specific behaviors.

140 points by edent 7y ago

deleted 7y ago

[deleted]

duxup 7y ago

Is this common? Or is this a bunch of folks "doing it wrong" and not really getting anything out of it anyway?

W4ldi 7y ago
It's most likely a bug. Some dev added tracking to all the href's and just didn't think about phone numbers. The title of the article sounds like they did it on purpose, which i doubt.
- duxup 7y ago
  Yeah that's what it seems like to me. Just a case of doing it wrong.
- citrin_ru 7y ago
  I'd argue that it is not a bug - it is a wrong assumption (that all URLs are http/https) based on limited experience. With a typical bug code works not as author intended it to work. Numbers of such bugs can be reduced by testing and better tooling. But software development as an industry creates incentive to be overconfident and not to question own assumptions: developers who don't stop to read documentation/standards/gather information in anther way deliver more features in less time.
cosmie 7y ago
It's a process breakdown, either manual or automated. Marketing teams tend to use a tagging worksheet like this[1] when creating new emails. They're just told to put all links through that process, and the topic of tel links don't really come up. I've handed off dozens of link generators like that to marketing and account management folks, and never thoguht to add any checking for tel links in the logic or to surface that edge case in the instructions. So if they're going through the motions they were told to, but don't fully understand why (and don't QA properly) this is what you end up with. Could also be a system using the same logic of surfacing every <a> tag link for tagging before deployment (based on the utm names, there's at least some type of semantic logic to the naming that indicates a person was involved at some level and knew it was a phone number they were tagging). [1] https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3NYt392T6l6Tq9e89Yieg8AM/edit#gid=0 https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3...
- lxcfan 7y ago
  To add to the parent: Most major marketing automation and email marketing tools are going to add these links automatically in the email builder. Most WYSIWYG email builders built into these tools are pretty painful to begin with, and especially so when content with links is copied from one tool to another. (Think of the poor marketing person being given various blurbs in Word, Gmail, etc. and told to make a functional email out of them while having to use a shitty WYSIWYG.) Beyond that, most marketers I know have absolutely zero input into what email platform they use. Many organizations are stuck using antiquated, broken tools (I'm looking squarely at you, Eloqua) because of complex existing integrations they have set up. I don't see this changing any time soon. Few marketing orgs have the IT budget and/or on-staff knowhow to fix this problem. Nor are they likely to be aware of it. Nor, for that matter, are they likely to prioritize it over the many more pressing things they could be fixing that more directly affect revenue.

draw_down 7y ago

Looks like you notified them of the problem so not sure a blog post was required! But sure, companies should not do this

laurent123456 7y ago

Clickbait title that implies that tracking links are commonly added to phone numbers, while there's probably just that one bug he noticed.

deleted 7y ago
[deleted]

bathtub365 7y ago

Is there another example of a company doing this? The title seems to imply that this is a widespread problem.

saagarjha 7y ago

> So, if you're writing link tracking software, please make sure only to add parameter to URls where it makes sense. Also take a moment to consider if you to track what links people are clicking on at all.

duxup 7y ago
Internally at least I like to know how the web apps I write are being used. Like if the first thing everyone does is open their "messages" ... maybe give them an option to just do that automatically. Send that info to a third party ... no I'm not down with that.
- superkuh 7y ago
  So just look at the logs? Why is tracking link crap required?
  - duxup 7y ago
    I'm not sure it is "required".... depending on what you're talking about. I was speaking more generally about what folks think of as "tracking" being a really wide topic that can involve totally innocuous "tracking" that is actually to their benefit, and far worse that is more of a dark pattern.
    - JohnFen 7y ago
      True. But tracking is so common and so widely abused that I think it's entirely reasonable to take the stance of blocking it all anyway.
gruez 7y ago
if you want to track whether people are clicking on links, utm parameters are the wrong tool. since they're url parameters, they they really only work for internal links. if you want to track all links, you need to resort to onclick handlers + xhr/fetch or beacons.

egdod 7y ago

Maybe just stop adding tracking links altogether.

zelphirkalt 7y ago
Damn, you were faster. I was gonna write: "I can shorten the title: Stop tracking."
deleted 7y ago
[deleted]

notwedtm 7y ago

I would argue that it's your phone that is in the wrong. The dialer should know that a `?` is not a valid DTMF tone, and strip all invalid characters. There are plenty of use-cases where having tracking metadata is useful. I can't think of a single one where having a dialer interpret a `?` is.

hedora 7y ago
As the article says, the standard for tel: urls specifically forbids the behavior you’re describing.

hedora 7y ago

From one of the comments, this FF add on rewrites links to remove tracking parameters: https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid-and-utm/ https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid... Too bad ssl makes it hard to this at the router level (similarly to Pi Hole, but for HTTPS, not DNS).

swiley 7y ago
Not really, just make your own CA and run squid.
- oarsinsync 7y ago
  Please do not do this. The previous comment does not take into account the huge security hole you're creating by doing this, in particular the importance of ensuring that whatever hosts you're signing certificates from does not get compromised, and the risk to things like online banking and online payments caused by your own personal MITM host being compromised. As frustrating as tracking on the internet may be, you'll be a lot more resentful of your bank when they outright refuse to refund you any of your money, when it becomes clear that you opted to MITM your traffic, and your MITM host got compromised, resulting in the theft of your banking credentials. There are many reasons why you should MITM your hosts, and there are many reasons why companies Bluecoat make large sums of money providing solutions to this problem. It is not a trivial problem and solution. In a much simpler space, "just run an FTP server" does not encompass what Dropbox does.
  - swiley 7y ago
    You also have to make sure the machine your browsing from isn’t compromised. IMO it changes very little unless you’re living with other people.
    - deleted 7y ago
      [deleted]
    - oarsinsync 7y ago

kaizendad 7y ago

As a marketer in a former life, I can't understand why somebody would do this. It's very cheap to get a separate phone number for each inbound channel and there's tons of software that will track which channels are working for you, starting at the low end with an intern and Excel.

skrebbel 7y ago
It's just a bug. Somebody made a script that appends tracking codes to every <a href=".."> in the document.

soared 7y ago

For non-marketers here: you aren’t supposed to use utms for internal links anyways. Doing so will break your analytics and there are ways to track button/link clicks without utms.

mikesabat 7y ago

For use cases where one wants to track calls, length or connection, the better way to do this is the click-to-call approach. Have a button that says, "Call Me". If you have the user's number place a call to them and connect it to the destination number. If you don't have the user's number then collect it before placing the call. There are much better tracking benefits and data collection for phone numbers. If one is doing marketing and wants a person to call, there usually isn't much of a difference in conversion rate between a call to action like "Call 800-555-1212" and a form that will call you. Source: An employer powered a metric shit-ton of advocacy call campaigns - like the STOP SOPA & PIPA stuff that took over the internet a few years ago.

JohnFen 7y ago

Tracking links are why I never just click on links anymore. I copy/paste them so I can edit out the spying nonsense.

hombre_fatal 7y ago
There are extensions that can help with this. First google result: https://chrome.google.com/webstore/detail/tracking-token-stripper/kcpnkledgcbobhkgimpbmejgockkplob?hl=en https://chrome.google.com/webstore/detail/tracking-token-str... Hooks into chrome.webRequest.onBeforeRequest.addListener(...) to rewrite the request url at request time.
- Forbo 7y ago
  For Firefox, I've been using the ClearURLs add-on. https://gitlab.com/KevinRoebert/ClearUrls https://gitlab.com/KevinRoebert/ClearUrls Edit: Looks like it's available for Chrome as well.
cuspycode 7y ago
I copy and edit, and then paste into a different private browser instance.
- deleted 7y ago
  [deleted]
- fsflover 7y ago
  And I open them in a disposable virtual machine on Qubes OS :)
driverdan 7y ago
Block trackers and the problem goes away. Very few companies track these types of links on the server, it's all easy to block front end JS.

maerF0x0 7y ago

shhh.. if they figure it out they'll start to provision single use numbers (or LRU style churning) to track specific behaviors.