Official KISSmetrics Response to Data Collection Practices

http://blog.kissmetrics.com/official-kissmetrics-response-to-data-collection-practices/

by joshuacc • 15 years ago

58 44 15 years ago

blog.kissmetrics.com

rhizome5• 15 years ago

They don't deny recreating cookies.

dangrossman2• 15 years ago

Is that illegal now?

nostromo• 15 years ago

No, but unethical for most applications, don't you think?

rhizome5• 15 years ago

Who cares? It's still lame and violates the Law of Demeter.

richcollins• 15 years ago

These articles are based entirely on a paper by Ashkan Soltani, who works closely with the lawyers who filed these cases, and who published his paper on the same day that the first lawsuit was filed.

plinio_silva• 15 years ago

So what? Does that automatically make everything he exposed false?

ericd4• 15 years ago

It makes his objectivity suspect.

bbatsell• 15 years ago

Their explanation of the universal cookie ID issue is rather silly. If you're a client of Kissmetrics, your visitors have a cookie scoped to your domain with the visitor's universal Kissmetrics ID. All of the database segregation in the world won't prevent any two or more Kissmetrics clients from collating visitor data on that universal ID, sent in every header on every pageview. Whether any clients are actually doing that, I have no clue. But claiming that permuting that universal ID into client-specific ones rendered when the clients view data actually protects visitors from said collation is just wrong.

See Wired's screenshot here: http://www.wired.com/images_blogs/epicenter/2011/07/Screen-S...

rubeng2• 15 years ago

I don't see what's silly about the explanation considering it's about efficiency and performance. As a KISSmetrics customer I can tell you the focus is on funnels and key data; not on an internal cookie ID so that we can collude with other companies.

rhizome5• 15 years ago

So you'd decline to collude with another company who approached you? What if they offered to pay?

moe• 15 years ago

Why would kissmetrics want to provide a way for their customers to link users by the means of that cookie id?

To me this seems like an oversight rather than malicious intent.

LokiSnake• 15 years ago

But it's a huge oversight and the kind of thing the designers would have come across when designing the system. They decided to use the shared id, either with the assumption that no clients will ever collaborate and share data or they just don't take privacy seriously enough. Not necessarily malicious, but way too careless in privacy related matters.

jforman4• 15 years ago

If the report "significantly distorts our technology and business practices," why are they making such significant changes to their technology and business practices as a result?

jedberg4• 15 years ago

To assuage folks who don't understand technology and will assume they are guilty until they "make big changes".

jforman4• 15 years ago

I understand technology, and I'm pretty skeezed out by their use of Etags...

Also, if they truly think they're innocent, why wouldn't they just educate their userbase? Seems odd to make such drastic architectural changes just because of a perceptual problem.

rsingel2• 15 years ago

Jeremy, sorry but you are mistaken.

The report -- http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1898390 -- was technically correct. In fact, it's KISSmetrics that's distorting what the report said.

Shah writes "Mr. Soltani’s paper speculates that KISSmetrics tracks customers across websites based on his observation of a shared identifier on different customer websites."

Soltani's paper and my story about it said nothing of the sort.

Both point out that KISSmetrics technology gives a user the same unique ID on different sites, a technological choice that would allow its clients to compare their databases -- independent of KISSmetrics -- and share data about users.

I find the recent blog post odd, because on Friday, Shah told me it was accurate and that the techniques were legal.

pbreit• 15 years ago

Ideally they'd be able to say "we messed up, we're making the necessary changes" but can't do that with a lawsuit pending.

I don't see any good reasons why they can't simply use cookies and acknowledge that some folks will delete them.

jedberg4• 15 years ago

I know Hiten personally, and I know that Kissmetrics operates in a most ethical fashion.

I would trust them over most any analytics company any day.

It's a shame that this meritless lawsuit even exists.

Flam• 15 years ago

Heck, if jedberg trusts them then I'm convinced. (no sarcasm)

AndyNemmity• 15 years ago

I just started using Kissmetrics, and it's odd that this was the most reassuring thing I've read from this.

mtogo• 15 years ago

Trying to prevent the deletion of cookies used to uniquely identify and track their customers' users is ethical?

qeorge• 15 years ago

Yeah as far as I'm concerned, the cross-site tracking thing is a straw man.

They used evercookie-ish methods to track people who don't want to be tracked. That's unethical, full stop.

cHalgan2• 15 years ago

Can you please reconcile something to me: Kissmetrics operates in a most ethical fashion but they prevent deletion of cookies in order to track my browsing? Do they think I'm stupid?

Or let me ask the other way: Is it ethical to prevent deletion of cookies in order to track my browsing and intentionally hide the fact that they are doing that?

earl• 15 years ago

What Kiss does is explicitly violating user intent -- ethical people assume that when cookies go away, the user is making a decision.

From the paper summary : "The cache cookie method used ETags, and is capable of unique tracking even where all cookies are blocked by the user and “Private Browsing Mode” is enabled." Resuscitating cookies the user has cleared is simply wrong.

And you have an expansive definition of "ethical".

mrkurt2• 15 years ago

Cookies disappear all the time for reasons that have nothing to do with users nuking them. Users rarely delete their cookies, a vanishing cookie isn't an obvious indicator of privacy concerns.

I should caveat this by saying that I wouldn't use an evercookie, though. While most vanishing cookies aren't privacy related, it's clear that a few are. We avoid all sorts of behaviors on the web to keep from treading on a few toes.

jcc80• 15 years ago

I don't know anyone at the company, but I do read their blog, follow on twitter, etc. and think they're probably great guys. But this tweet just said it all for me:

"Consumers who wish to opt out of all KISSmetrics tracking can use the free tools http://adblockplus.org & https://easylist.adblockplus.org/

It's completely absurd that people have to download anything to not be tracked - whether the data is anonymous, not shared between clients, etc. As mentioned, they are purposely defeating user intent. What about the next company after KISSmetrics that isn't as "ethical" w/ user data? That's why this type of thing needs to be stopped dead.

EDIT: little more clarity

jeremymims• 15 years ago

Hiten is a standup guy, a friend to startups everywhere, and a class act all around. I look forward to him kicking their asses in court.

slowpoke• 15 years ago

  Mr. Soltani also claims that it is somehow improper to use
  any technology other than browser cookies to track website
  activity. In fact, countless online companies, including
  other major analytics providers, use a variety of different
  technologies to provide these services, including the
  persistent technologies Mr. Soltani targets in his paper.

That's not a justification for doing it too. It's merely a lame excuse for unethical behavior.

Also, I don't care if the guys at KISSmetrics are nice, kitten-loving jolly good fellows - that has absolutely zero relevance to the case at hand.

Official KISSmetrics Response to Data Collection Practices

Related Stories