6 ms·

How to track users for analytics in a privacy-first, cookie-less future

65 points by mattjstar 5y ago

oncethere 5y ago
Is it hard in practice to figure out who the anonymous ids are? I'm used to just having Segment identify calls.
- mattjstar 5y ago
  Good question, the idea in the post is once you know who the user is you make sure they load a page with a unique identifier on it that you can use to identify them. As an example, think of a Shopify check out flow. Every user has a unique checkout url. Once they purchase you can use that checkout ID in your warehouse to join with the page view that had the anonymous Id on it. So you’ll have a page view with the anonymous Id with a url with a unique checkout Id that you can use to join to the ultimate identified user (assuming all your page view and Shopify data are in one place, your data warehouse). Let me know if I understood your question!
  - OzCrimson 5y ago
    Matt, I'm curious to know why? If a person has jumped through hoops to say they don't want to be tracked, why look for ways to still do it? It's like putting up curtains to keep people from looking in my window, but then you realize you can still see inside if you crouch down really low and look through the 1/8" space between the bottom of the curtain and the window sill. This puts me in a difficult position of supporting legislation that might be overly harsh like the Do Not Call list back in the 1990s. It pretty much killed off telemarketing for a while. Sad, but the public got fed up with an entire industry that showed it had no regard for the public. I've got friends who are in marketing and ad-tech and I care about them, their business and success. But when I want to withdraw my consent to be tracked, I want that same level of care and respect.
    - ahmedelsama 5y ago
      This is really great. I think it is about what and how one is being tracked. I think people are trying to stop companies from tracking them everywhere but if I am interacting with a single company, I know they are tracking some things. Foe example, if I buy off of an e-Comm website then they should have tracked my order so I can go back to it. This extends to support. I hate submitting a support ticket to just be told to go view the docs that I already viewed, or try things I have already done. As a customer, I want you to know I did that and to help me. All this is trying to do is allow company to understand their customer within their own platform and own data. This is not trying to fingerprint users or track everything they do on all websites like Facebook and other platforms. I hope this clears up the motivation. In short, it is to resolve issues in using the data that a company has internally and is not about creeping on users across the internet.
      - OzCrimson 5y ago
        Ok. Thank you. This does help. I can appreciate that.
mattjstar 5y ago
Author here - we've been able to identify anonymous users pretty consistently once they convert to becoming users. This talks about our approach and how to do it, while still following all the rules around tracking cookies, etc…
- Y-bar 5y ago
  Why do you talk about consent with regards to cookies only? GDPR deals with so much more with regards to tracking and identifiable information. For example this quote from the article: "Add a unique identifier to all urls on your site when you know who the user is." I don't see how our legal would allow us to do this with European customers without explicit opt-in consent since this kind of tracking and data processing cannot be deemed a legitimate requirement for the core function of the service. If the same service can be given to the visitor without the unique identifier in the URL, then I see no way to avoid asking for consent. https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ https://gdpr.eu/recital-30-online-identifiers-for-profiling-...
  - cedricd 5y ago
    The identifier on the urls isn't meant to identify the actual user I think. If you look at the examples given they're more like identifiers to something else -- an order id or subscription id. Wouldn't tracking something like an order (but not the user directly) be ok with GDPR?
    - garciasn 5y ago
      A company may store both customer data and order data and keep them under GDPR, because a particular customer provided it knowingly. The important piece is when a customer asks to be removed, the company must remove their customer data (e.g. their name and address) but the order information can remain orphaned in order to do analyses on revenue, orders, etc. The right to be forgotten is ONLY about customer data, not related anonymized identifiers that tie back to the previous customer's order history.
ahmedelsama 5y ago
Identity Resolution via warehouse is the future!!! I love this!
er4hn 5y ago
So the overall concept of "shove a tracker value into the URL and collate all interactions" makes sense - but how do you track if a user is sharing a URL? Let's say that I'm on a desktop browsing a shopping site. I'm on shopping.site/product/coolthing.html?tracker=12345. I share this with my friend on a mobile device because it looks like something of interest to them. Now how do you handle the other person having the same tracker as the initial person? You end up with a scenario where two different people, with different interests, are browsing the site. Even if they convert you have situations along the lines of: no conversions, person A converts, person B converts, both convert. How do you handle this? With cookies the sharing of the URL would avoid this scenario since cookies would be separated between people.
- mattjstar 5y ago
  This could in theory happen, but in my examples I'm adding the url right after someone converted -- paid for a subscription or completed an order. Those are unlikely to be shared with someone else (ideally). It's arguably more likely that the user will share it with themselves on another device, in which case the overall approach will work well. I should also point out that the url tracker isn't meant to be persisted across page views. It's only done once at the moment that the user identifies themselves to your service.
  - er4hn 5y ago
    Then I'm a little lost. I had thought a big part of this (your "Stitch anonymous data to users once they convert" picture and around it) was to be able to backtrack anonymous users once they identify themselves. Even if they identify themselves via ordering something, is it an unusual workflow to share a link after? For example "I got this new coffee, I'm excited, here's the link to what I ordered my friend!"
    - ahmedelsama 5y ago
      Well your tracking a user via the Anonymous id. Once you see a link (checkout url, order link, form submission, etc) you create a link. Now you have a list of cookies, their linked email at a moment in time. Then you create a table that has the cookie and who it maps to from a timestamp to a timestamp. This is then used to update the past and future identities. Think multi-user, multi-device in time. So in the example you gave, the user who opens that links becomes tied to that cookie from the time they open the order to the next linked event. This is really critical because it will continue to stitch the users identity over time. If link sharing is happening a lot, you can choose to not use that linkage foe identity resolution. Does this help clarify the approach?
korethr 5y ago
I'm mildly surprised cookie consent banners are only at 20%, given how often I come across banners who's only option is "Yes, I consent"
- mjevans 5y ago
  I block the entire element, and if moderate actions aren't enough will frequently just move on to other search results.
- zild3d 5y ago
  I've found more often than not they can just be ignored?
  - slig 5y ago
    Me too. If I ignore or decline, then the next pageview will show the same banner. It's nuts, but I guess it's new normal.
    - AstralStorm 5y ago
      Then fight fire with fire. Remove the banner. Ultimately, the site is not allowed to collect data without your consent, but many sites illegally set cookies or store your data in logs before you consent, or even if you decline. With cookies, it is easy to detect bad actors, but not so much with logging.
vec 5y ago
> If you're unable to set a consistent cookie across your user's many sessions (especially for a high retention business like e-commerce), or your javascript conversion events (Google Tag Manager for example) are being blocked, your user's historical behavior will be extremely difficult to stitch together over time. Yes, that is in fact the point. Look, I know there are strong financial incentives to build individual user profiles and doing it this way may not violate the letter of the law, but it sure as hell violates the spirit. If we ask a user if they're willing to be tracked and they do everything in their power to tell us no then I'm not sure how comfortable we should be doing it anyway.
- cedricd 5y ago
  Yeah, this advice looks targeted to companies that benefit hugely from targeting their users. If I'm reading correctly it's basically saying 'once a user has identified themselves to you, then you can go back and figure out the steps they took before that' As a person, if a company knows what I did right before I bought their product (say in that session) I think I'm ok with that. If they follow me onto other websites or other devices then that feels a lot more invasive.
a13n 5y ago
I mean at the end of the day whether you store it in the cookie or the URL it’s still persistent key value storage for tracking purposes, so I don’t see why the EU’s stance would be any different. It’s effectively still a cookie. Some activities and cookies are allowed by GDPR without requesting consent, and anonymous analytics (even google analytics) is included in this, so you don’t actually even need a cookie banner to do what you’re trying to do here... I think from a legal standpoint this is no better than cookies, it doesn’t change whether you need consent or not.
- ahmedelsama 5y ago
  Honestly putting the cookie as a param is pretty clever. The challenge with cookies is there are often many cookies that point to one person. Imbedded browsers, multiple devices, cookies being refreshed by browsers. So seeing the full journey requires stitching all the cookies
- ahmedelsama 5y ago
  In addition, if you are using Saas products like Shopify, you already have unique urls for carts and orders so you can also use that without any additional engineering.
bgrgndzz 5y ago
Well you can still track unique users without collecting PII. The information sent with every web request by default is still pretty useful. That's how we do it at https://www.hockeystack.com https://www.hockeystack.com, no need for all this work.
cjg 5y ago
"Step 3 - Attribute anonymous page views to the user!" - not GDPR compliant without consent for that.
mjevans 5y ago
An International GDPR seems increasingly necessary. Stop trying to right size, hide prices, etc; just give straight good deals and sell good products at good prices.
- wanderindev 5y ago
  How is a company supposed to determine what 'good' prices are though? Should they just be covering their costs? Should they just be covering their costs + x%? Sure they could base it off what the rest of the market is doing but where is the market establishing their prices? I don't disagree that price gouging occurs in many markets - and I agree that an international GDPR would be beneficial to people - but good pricing also doesn't just occur naturally it's a product of experimentation.
  - qxga 5y ago
    Good prices are what consumers determine are good prices. Sometimes that's razor-thin margins. Sometimes it lets you get away with high margins.
bouzouk 5y ago
We do it a bit differently (French company). Since the only cookie that is endangered is the « third party cookie », it is very much ok to store anonymous session information in a first party cookie for all anonymous visitors. So we store page views and utm there, and capture this data in the datawarehouse when (and only when) there is a conversion. This is also working with returning visitors (who most likely kept the first party cookie).
- ahmedelsama 5y ago
  Love it! This is super similar but we allow many different layers of conversions. So anytime we bridge systems you can connect the user. This is critical with the many browsers, devices and so on. In e-commerce we see that emails have such high conversion rates but they are often opened on the phone then the user buys on the browser without clicking. These situations are captured by doing the many layers of identity resolutions
- culturedsystems 5y ago
  Note that you still need to get consent for the cookie in this case, as the cookie is being used for something which isn't strictly necessary to provide the service.
  - xyzzy_plugh 5y ago
    If the cookie is never used until a later date e.g. conversion, when the user clicks through an agreement, do you still need consent? Edit: I honestly have no idea, I haven't read the regulations and I'm curious if any experts know. Seems sleazy regardless!
    - AstralStorm 5y ago
      What does it mean? Even a session cookie is used at a later date, e.g. 5 minutes later. The law does not specify minimum retention time.
  - wdb 5y ago
    What if the cookie is also used for feature toggles?
FridayoLeary 5y ago
Will privacy be the future? I feel browser tracking will simply become less relevant in the future. I can't explain why. I'm sure of one thing though: the government will know more about us.
- OzCrimson 5y ago
  I think of this stuff separately. 1. The government can always use the excuse of "public safety." However, 2. A company that's selling brooms shouldn't have all kinds of access to tracking people. The public doesn't benefit from that.
- HWR_14 5y ago
  The government barely knew enough about us to make a website that could connect people to healthcare. Forgive me for being more concerned about what Google can feed into DeepMind Person Predictor in 2026 to know about me.
gentleman11 5y ago
> Said another way, our customers are able to stitch historical anonymous data to 95% of their converted users–this is even in the last few weeks after all the Apple device and browser privacy updates. When companies talk about how they anonymize data before uploading it to the cloud, so it can’t be traced back to you, they should get sued. It is so easy to connect data to their sources with just a little bit more information
treerunner 5y ago
The reality is that the people doing the tracking are the real users. What a boring relationship to the network - tracking and spying, and grifting.
ashneo76 5y ago
Rephrase: how to track someone even after they have not given you the consent to. And how wait to for their one mistake to retrace all their steps and then identify their history without their consent --------- Track me on your website alright. Tracking me everywhere without my consent? You're a creep and nothing less
randomperson_24 5y ago
Isn't this even more creepy?
- ashneo76 5y ago
  Yes. It is.
haskellandchill 5y ago
How to... um no you don't you use APIs that have OAUTH type interactions for data sharing permissions with explicit user consent for everything. Just do it. It's the right thing, it's what people want, and it's a clean technical solution.
kcartlidge 5y ago
This is so wrong. All data that is collected whilst a user is anonymous was done so under the condition of anonymity. Breaking that anonymity by assigning unknown-user data to the now-known user is retroactively changing that user's consent without getting their agreement. Like saying "I know you chose not to be tracked, but now we've had some interaction with you we don't think you meant it". But on what basis? Not only is this morally/ethically incorrect, it is probably illegal as it is a clear violation of data collection laws. Consent was not given for those prior activities to be tracked. Current consent does not change that. Edit: Even the suggestion that the stitching together of the data could use the non-PII that was obtained does not get around the fact that permission was not given and by joining the sessions/activity that way you would in fact be de-anonymising (non-PII gets associated with PII).

65 points by mattjstar 5y ago

oncethere 5y ago

Is it hard in practice to figure out who the anonymous ids are? I'm used to just having Segment identify calls.

mattjstar 5y ago
Good question, the idea in the post is once you know who the user is you make sure they load a page with a unique identifier on it that you can use to identify them. As an example, think of a Shopify check out flow. Every user has a unique checkout url. Once they purchase you can use that checkout ID in your warehouse to join with the page view that had the anonymous Id on it. So you’ll have a page view with the anonymous Id with a url with a unique checkout Id that you can use to join to the ultimate identified user (assuming all your page view and Shopify data are in one place, your data warehouse). Let me know if I understood your question!
- OzCrimson 5y ago
  Matt, I'm curious to know why? If a person has jumped through hoops to say they don't want to be tracked, why look for ways to still do it? It's like putting up curtains to keep people from looking in my window, but then you realize you can still see inside if you crouch down really low and look through the 1/8" space between the bottom of the curtain and the window sill. This puts me in a difficult position of supporting legislation that might be overly harsh like the Do Not Call list back in the 1990s. It pretty much killed off telemarketing for a while. Sad, but the public got fed up with an entire industry that showed it had no regard for the public. I've got friends who are in marketing and ad-tech and I care about them, their business and success. But when I want to withdraw my consent to be tracked, I want that same level of care and respect.
  - ahmedelsama 5y ago
    This is really great. I think it is about what and how one is being tracked. I think people are trying to stop companies from tracking them everywhere but if I am interacting with a single company, I know they are tracking some things. Foe example, if I buy off of an e-Comm website then they should have tracked my order so I can go back to it. This extends to support. I hate submitting a support ticket to just be told to go view the docs that I already viewed, or try things I have already done. As a customer, I want you to know I did that and to help me. All this is trying to do is allow company to understand their customer within their own platform and own data. This is not trying to fingerprint users or track everything they do on all websites like Facebook and other platforms. I hope this clears up the motivation. In short, it is to resolve issues in using the data that a company has internally and is not about creeping on users across the internet.
    - OzCrimson 5y ago
      Ok. Thank you. This does help. I can appreciate that.

mattjstar 5y ago

Author here - we've been able to identify anonymous users pretty consistently once they convert to becoming users. This talks about our approach and how to do it, while still following all the rules around tracking cookies, etc…

Y-bar 5y ago
Why do you talk about consent with regards to cookies only? GDPR deals with so much more with regards to tracking and identifiable information. For example this quote from the article: "Add a unique identifier to all urls on your site when you know who the user is." I don't see how our legal would allow us to do this with European customers without explicit opt-in consent since this kind of tracking and data processing cannot be deemed a legitimate requirement for the core function of the service. If the same service can be given to the visitor without the unique identifier in the URL, then I see no way to avoid asking for consent. https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ https://gdpr.eu/recital-30-online-identifiers-for-profiling-...
- cedricd 5y ago
  The identifier on the urls isn't meant to identify the actual user I think. If you look at the examples given they're more like identifiers to something else -- an order id or subscription id. Wouldn't tracking something like an order (but not the user directly) be ok with GDPR?
  - garciasn 5y ago
    A company may store both customer data and order data and keep them under GDPR, because a particular customer provided it knowingly. The important piece is when a customer asks to be removed, the company must remove their customer data (e.g. their name and address) but the order information can remain orphaned in order to do analyses on revenue, orders, etc. The right to be forgotten is ONLY about customer data, not related anonymized identifiers that tie back to the previous customer's order history.

ahmedelsama 5y ago

Identity Resolution via warehouse is the future!!! I love this!

er4hn 5y ago

So the overall concept of "shove a tracker value into the URL and collate all interactions" makes sense - but how do you track if a user is sharing a URL? Let's say that I'm on a desktop browsing a shopping site. I'm on shopping.site/product/coolthing.html?tracker=12345. I share this with my friend on a mobile device because it looks like something of interest to them. Now how do you handle the other person having the same tracker as the initial person? You end up with a scenario where two different people, with different interests, are browsing the site. Even if they convert you have situations along the lines of: no conversions, person A converts, person B converts, both convert. How do you handle this? With cookies the sharing of the URL would avoid this scenario since cookies would be separated between people.

mattjstar 5y ago
This could in theory happen, but in my examples I'm adding the url right after someone converted -- paid for a subscription or completed an order. Those are unlikely to be shared with someone else (ideally). It's arguably more likely that the user will share it with themselves on another device, in which case the overall approach will work well. I should also point out that the url tracker isn't meant to be persisted across page views. It's only done once at the moment that the user identifies themselves to your service.
- er4hn 5y ago
  Then I'm a little lost. I had thought a big part of this (your "Stitch anonymous data to users once they convert" picture and around it) was to be able to backtrack anonymous users once they identify themselves. Even if they identify themselves via ordering something, is it an unusual workflow to share a link after? For example "I got this new coffee, I'm excited, here's the link to what I ordered my friend!"
  - ahmedelsama 5y ago
    Well your tracking a user via the Anonymous id. Once you see a link (checkout url, order link, form submission, etc) you create a link. Now you have a list of cookies, their linked email at a moment in time. Then you create a table that has the cookie and who it maps to from a timestamp to a timestamp. This is then used to update the past and future identities. Think multi-user, multi-device in time. So in the example you gave, the user who opens that links becomes tied to that cookie from the time they open the order to the next linked event. This is really critical because it will continue to stitch the users identity over time. If link sharing is happening a lot, you can choose to not use that linkage foe identity resolution. Does this help clarify the approach?

korethr 5y ago

I'm mildly surprised cookie consent banners are only at 20%, given how often I come across banners who's only option is "Yes, I consent"

mjevans 5y ago
I block the entire element, and if moderate actions aren't enough will frequently just move on to other search results.
zild3d 5y ago
I've found more often than not they can just be ignored?
- slig 5y ago
  Me too. If I ignore or decline, then the next pageview will show the same banner. It's nuts, but I guess it's new normal.
  - AstralStorm 5y ago
    Then fight fire with fire. Remove the banner. Ultimately, the site is not allowed to collect data without your consent, but many sites illegally set cookies or store your data in logs before you consent, or even if you decline. With cookies, it is easy to detect bad actors, but not so much with logging.

vec 5y ago

> If you're unable to set a consistent cookie across your user's many sessions (especially for a high retention business like e-commerce), or your javascript conversion events (Google Tag Manager for example) are being blocked, your user's historical behavior will be extremely difficult to stitch together over time. Yes, that is in fact the point. Look, I know there are strong financial incentives to build individual user profiles and doing it this way may not violate the letter of the law, but it sure as hell violates the spirit. If we ask a user if they're willing to be tracked and they do everything in their power to tell us no then I'm not sure how comfortable we should be doing it anyway.

cedricd 5y ago
Yeah, this advice looks targeted to companies that benefit hugely from targeting their users. If I'm reading correctly it's basically saying 'once a user has identified themselves to you, then you can go back and figure out the steps they took before that' As a person, if a company knows what I did right before I bought their product (say in that session) I think I'm ok with that. If they follow me onto other websites or other devices then that feels a lot more invasive.

a13n 5y ago

I mean at the end of the day whether you store it in the cookie or the URL it’s still persistent key value storage for tracking purposes, so I don’t see why the EU’s stance would be any different. It’s effectively still a cookie. Some activities and cookies are allowed by GDPR without requesting consent, and anonymous analytics (even google analytics) is included in this, so you don’t actually even need a cookie banner to do what you’re trying to do here... I think from a legal standpoint this is no better than cookies, it doesn’t change whether you need consent or not.

ahmedelsama 5y ago
Honestly putting the cookie as a param is pretty clever. The challenge with cookies is there are often many cookies that point to one person. Imbedded browsers, multiple devices, cookies being refreshed by browsers. So seeing the full journey requires stitching all the cookies
ahmedelsama 5y ago
In addition, if you are using Saas products like Shopify, you already have unique urls for carts and orders so you can also use that without any additional engineering.

bgrgndzz 5y ago

Well you can still track unique users without collecting PII. The information sent with every web request by default is still pretty useful. That's how we do it at https://www.hockeystack.com https://www.hockeystack.com, no need for all this work.

cjg 5y ago

"Step 3 - Attribute anonymous page views to the user!" - not GDPR compliant without consent for that.

mjevans 5y ago

An International GDPR seems increasingly necessary. Stop trying to right size, hide prices, etc; just give straight good deals and sell good products at good prices.

wanderindev 5y ago
How is a company supposed to determine what 'good' prices are though? Should they just be covering their costs? Should they just be covering their costs + x%? Sure they could base it off what the rest of the market is doing but where is the market establishing their prices? I don't disagree that price gouging occurs in many markets - and I agree that an international GDPR would be beneficial to people - but good pricing also doesn't just occur naturally it's a product of experimentation.
- qxga 5y ago
  Good prices are what consumers determine are good prices. Sometimes that's razor-thin margins. Sometimes it lets you get away with high margins.

bouzouk 5y ago

We do it a bit differently (French company). Since the only cookie that is endangered is the « third party cookie », it is very much ok to store anonymous session information in a first party cookie for all anonymous visitors. So we store page views and utm there, and capture this data in the datawarehouse when (and only when) there is a conversion. This is also working with returning visitors (who most likely kept the first party cookie).

ahmedelsama 5y ago
Love it! This is super similar but we allow many different layers of conversions. So anytime we bridge systems you can connect the user. This is critical with the many browsers, devices and so on. In e-commerce we see that emails have such high conversion rates but they are often opened on the phone then the user buys on the browser without clicking. These situations are captured by doing the many layers of identity resolutions
culturedsystems 5y ago
Note that you still need to get consent for the cookie in this case, as the cookie is being used for something which isn't strictly necessary to provide the service.
- xyzzy_plugh 5y ago
  If the cookie is never used until a later date e.g. conversion, when the user clicks through an agreement, do you still need consent? Edit: I honestly have no idea, I haven't read the regulations and I'm curious if any experts know. Seems sleazy regardless!
  - AstralStorm 5y ago
    What does it mean? Even a session cookie is used at a later date, e.g. 5 minutes later. The law does not specify minimum retention time.
- wdb 5y ago
  What if the cookie is also used for feature toggles?

FridayoLeary 5y ago

Will privacy be the future? I feel browser tracking will simply become less relevant in the future. I can't explain why. I'm sure of one thing though: the government will know more about us.

OzCrimson 5y ago
I think of this stuff separately. 1. The government can always use the excuse of "public safety." However, 2. A company that's selling brooms shouldn't have all kinds of access to tracking people. The public doesn't benefit from that.
HWR_14 5y ago
The government barely knew enough about us to make a website that could connect people to healthcare. Forgive me for being more concerned about what Google can feed into DeepMind Person Predictor in 2026 to know about me.

gentleman11 5y ago

> Said another way, our customers are able to stitch historical anonymous data to 95% of their converted users–this is even in the last few weeks after all the Apple device and browser privacy updates. When companies talk about how they anonymize data before uploading it to the cloud, so it can’t be traced back to you, they should get sued. It is so easy to connect data to their sources with just a little bit more information

treerunner 5y ago

The reality is that the people doing the tracking are the real users. What a boring relationship to the network - tracking and spying, and grifting.

ashneo76 5y ago

Rephrase: how to track someone even after they have not given you the consent to. And how wait to for their one mistake to retrace all their steps and then identify their history without their consent --------- Track me on your website alright. Tracking me everywhere without my consent? You're a creep and nothing less

randomperson_24 5y ago

Isn't this even more creepy?

ashneo76 5y ago
Yes. It is.

haskellandchill 5y ago

How to... um no you don't you use APIs that have OAUTH type interactions for data sharing permissions with explicit user consent for everything. Just do it. It's the right thing, it's what people want, and it's a clean technical solution.

kcartlidge 5y ago

This is so wrong. All data that is collected whilst a user is anonymous was done so under the condition of anonymity. Breaking that anonymity by assigning unknown-user data to the now-known user is retroactively changing that user's consent without getting their agreement. Like saying "I know you chose not to be tracked, but now we've had some interaction with you we don't think you meant it". But on what basis? Not only is this morally/ethically incorrect, it is probably illegal as it is a clear violation of data collection laws. Consent was not given for those prior activities to be tracked. Current consent does not change that. Edit: Even the suggestion that the stitching together of the data could use the non-PII that was obtained does not get around the fact that permission was not given and by joining the sessions/activity that way you would in fact be de-anonymising (non-PII gets associated with PII).