(The following blog post is contributed by Eric T. Peterson, Founder and Senior Partner at Web Analytics Demystified, Inc. Comments on this post can be left with this blog or . Thanks to John, Adam, Judah, and others for their review of this post.)

Following up on last week’s thread about how the web analytics industry is on the cusp of becoming our own worst enemy as the tide of public opinion increasingly turns against online and behavioral analytics I wanted to make good on my offer to help the Web Analytics Association. I fully support the efforts of the Association to create a solid community for web analytics professionals around the world and have long been a contributor to their work, be it turning the Web Analytics Forum (at Yahoo! Groups) over to WAA management, opening the doors for WAA participation in Web Analytics Wednesday, and providing other “behind the scenes” support when asked.

To continue to support the Association I wanted to follow-up on something my partner John Lovett recently proposed. In a message to the WAA’s Standards Committee John suggested something he and I talked a few weeks back: the development of a “Web Analysts Code of Ethics.” In John’s words:

[A Code of Ethics] would allow web analysts and the companies * we * work for to wear white hats and gain the trust of consumers. It would also be a starting point for an education campaign on the benefits of digital measurement tracking.

I could not agree more. So, I figured I would start the conversation by drafting a document for review and comment by the Web Analytics Association Standards Committee, the WAA Board of Directors, and all web analytics practitioners everywhere – WAA members or not.

The following is a “1.0” version of a “Web Analysts Code of Ethics.” As you read this please take the time to consider A) whether you agree with the proposed statement, B) if not, why you disagree with the proposed statement, and C) what you think is missing, and D) whether you believe as a working web analysts you would have the ability (and be willing) to adhere to this type of code. Any and all feedback is welcome and encouraged!

Web Analysts Code of Ethics (1.0, drafted September 8, 2010)

As a professional web analyst and as a member of the global web analytics community I hereby agree to the following code of behavior regarding consumer data collected on any digital property I work on, with, or for:

1. I hold consumer data privacy in the highest regard and will do everything in my power to keep that data safe, secure, and private. To this end I will never knowingly transfer, release, or otherwise distribute data gathered through digital channels without express permission from the consumer(s) who generated the data;
2. I understand that the average consumer expects their online activity to be anonymous and I will work to keep it that way. Regardless of whether I have the ability to co-mingle personally identifiable and anonymous data, I will never connect the two unless A) customers have been directly appraised of this effort in advance and B) I am confident in my company’s ability to protect that data and keep it safe;
3. I will work diligently to ensure that my management team is well aware of the types of data we collect and the risks to consumers associated with those data. Part of my job is knowing what technology we have deployed and ensuring that others in my company, especially my senior leadership, are aware of how that technology could be used in a way that can be perceived of as invasive;
4. I will make every effort to help others in my organization understand why consumer data privacy is important. Recognizing that in my role I am rarely on the front-lines, I believe that the time it takes to make my co-workers aware of our commitment to data privacy is time well spent;
5. I will do my best to use tracking- and browser-based technologies in the way they were designed and not “hack” them to gather information simply because it is possible. Despite clear documentation regarding the possibilities, I will not use Flash, the browser cache, HTML5, or any other technology to “spy”, “reset”, or otherwise circumvent consumer control over their browsing experience;
6. I will work diligently with my company’s legal team to ensure that our privacy policy is up-to-date and provides an accurate and truthful reflection of our collection, use, and policy towards digitally-collected data. Whenever a new measurement technology is deployed I will assume the responsibility for starting the conversation with our legal team about the need to update our privacy policy;
7. I will pay close attention to the list of individuals inside my company and out that have access to any digitally-collected data falling under my domain. Given the ease with which access to digital data collectors can be shared I will work diligently to ensure that access lists are up-to-date and that anyone with access to these systems understands how that data can and cannot be used;
8. If anyone asks I will be transparent, honest, and forthright regarding the data we collect and how it is used to improve the overall consumer and customer experience online. I will, however, only share this information with express permission from my management team if the information will or might leave the confines of our organization;
9. I will work to enforce a cookie and user identification policy that is appropriate and respectful of the consumer experience in the environment I work in. If persistent cookies are not required I will suggest an expiration date. If user IDs could be used to track back to a known individual I will recommend reasonable obfuscation. I will advocate for first-party cookies (as opposed to third-party cookies) whenever possible;
10. Provided it exists I will reference the work of my industry Association whenever anyone has a question about this Code of Ethics, the industry I work in, or the work I do. I recognize that we are far stronger as a community than any one individual could ever be, and I believe that consistency in voice is important to communicating effectively about the work that I do.

What would you add? What would you change? Would you be willing to sign this document? More importantly, would you be willing to work (and live) by it?

I know this is new, and many of you will see the effort as irrelevant, but I would encourage you all to think “big picture” about how your life would change if, for example, the use of tracking cookies required explicit consumer “opt-in” or if third-party cookies for tracking purposes were banned by your government.

On behalf of Web Analytics Demystified and the Web Analytics Association, we welcome your thoughts.

Comments

[Rudi Shumpert]

Eric,

Thank you for helping to start this process and thanks to the WAA for getting behind this from the start as well!!

My only question at this point is where do I sign? And after I sign, where do I get a web badge to display to show others I stand behind this?

Again, great work. I look forward to seeing this evolve and provide a great basis for all professionals in our industry to gain and keep the confidence of not only folks inside, but outside of our community as well.

-Rudi Shumpert
-@rrs_atl

[Michele Hinojosa]

I would not only be willing to sign this, but also to sign a further addition to #1 or #8 (as appropriate) to explicitly pledge to use web analytics data for the benefit of a visitors' experience. While web data is obviously also used to further business goals, another primary objective balanced with this should be to take the data that our visitors allows us to capture and trust us with, and to use it for their benefit. I would certainly commit to always remaining cognizant of that obligation and balancing it fairly against business objectives.

This is also an excellent prompt for me to check in with our legal team and ensure that our privacy policy is accurate and truthful, and to keep conscious of this expectation of me in the future.

I am excited for this step for our community, and want to know what I can do to help.

[Ed]

Eric,

As a board member, I want to thank you for your great work to spearhead this effort. As a Certified Web Analyst, I am willing to sign this document wherenever it is finalized and published.

Regards,
Ed

[vanscoy]

Thanks, Eric. Where do I sign? ;)

[Vincent Granville]

I would add:

Anytime I produce statistics about web site visitors (e.g. a user, visit, page view count or engagement), I must break it down into multiple categories:

- fake users (Botnets, etc.): explain the methodology used to detect these clicks
- low quality users
- high quality users

If possible, break it down per country / education / gender / income levels.

Explain statistical methodology and define metrics used in BI reports. Aggregate data that has no statistical significance into one bucket.

[THomas Bosilytics Bosilevac]

As a web analytics manager and consultant, this is just as much a checklist of duties as it is a Code of Ethics. VERY, VERY thorough and well done.

At a time in the industry where ethics is about the only thing keeping us away from hacking the browser DOM to obtain what some people may call "freaky", this was needed yesterday. If anything to keep us honest ... and keep the playing field even.

My favorite part about this draft is the large responsibility it puts on the professional to not only adopt but to educate their organization on best ethical practices. As a manager for a pretty large intranet that collects a lot of PII ... the difference of CAN and SHOULD is a political debate I manage often.

One thing I might add along that note:
I will work diligently to assure a common baseline of measurement methodology within my organization to assure all individuals may work under the same data definitions and be scored accordingly.

[John Lovett]

Eric, as your business partner and a WAA board member, I commend this effort at what I believe to be a giant step for the web analytics industry. I hope that readers will commit to this code and I will work with the Standards Committee to see it through.

The WAA members and the industry at large have my commitment, that we will work diligently to define the ways and means by which individuals can endorse this Code of Ethics, so stay tuned.

In the meantime, help us to ensure that it meets your approval by leaving comments.

Looking forward,
John Lovett

[Robert Prior]

A great draft for a code and like Rudi one that I want to comply with and to demonstrate I follow with an official badge from WAA or whichever body oversees compliance.

[Kelly McClean]

Hi Eric,

Having just conducted an exercise reviewing the collection and use of PII at my own company this is very timely and something I would not hesitate to sign.

I also support Rudi's idea of a logo that can be displayed on sites that have signed (linking to the published code on the WAA). Presumably signatories would be reviewed annually to ensure continued compliance?

Kelly McClean

[Stephan]

It's a good foundation. What I think is missing - It's all elaborate, sophisticated and lacks a good, simplified keyword structure to make it easily accessible to non-experts. You're approaching the realm of Information Security here, and just as IS uses keywords like Confidentiality, Integrity, Authenticity, Non-repudation... that anyone can refer to, you need to equally identify the 3, 4, or 5 key concepts as front-line keywords, and then fit the small print into each of these concepts. So that it can be both concise / straight-to-the-point / accessible, and also elaborate enough for the practitioners.

Whether I would have the ability to adhere to it... Oh well, it's already an excruciating quest to convince all layers of management that Web Analytics holds any practical value beyond techno geeks (their perception here naturally - not mine). So if I also want to brief them about the potential Consumer PR risk, I might as well find another job. So in short: 1, 2, 5, 6, 7, 8, 9, 10 are fine and a great foundation. But 3 and 4 are like nailing WA to the ground in continuation of all the "What's holding back WA?" discussions.

Thanks for your valued contribution. Best regards.

[Steve Jackson]

I would sign this.
I would get vendors to sign this.
I would ask my clients to think about this.
All in all a very good idea.

[angie]

All I can say to this is: Bravo, Eric, well done!

[Jon]

This looks like a good start - and we look forward to seeing it develop. I think if individual developers were signed up it would carry weight not only for the visitors to the end sites, but also the clients looking to have those sites developed - who may have concerns about accountability/liability once their site goes live.
A logo/stamp/link linking to a page which confirmed whether you were signed up or not would be a nice idea. It could just sit non-obtrusively in the website's footer.

[Jim Novo]

I realize this effort is targeted to consumer privacy issues and the like. But while we're doing a code of ethics, shouldn't we include business ethics as well? "I will always report the same business truths to all stakeholders; I will not intentionally misrepresent or torture the data to favor a specific business outcome."

[Mike Levin]

A Code of Ethics will be huge positive step in the advancement of Web Analytics on many fronts. Elected officials will take note that the WA industry is taking action for "self-regulation" which should help their understanding of web analytics and, in turn, possibly cause them to favorably amend their positions on any legislation affecting the industry.
Thank you to Eric Peterson and John Lovett for taking the initiative, writing the first draft and playing an important role in making this happen.. It should also be noted that the WAA Board of Directors took swift action to approve and promulgate the Code to gain input from everyone in the industry. This is a great example of everyone working together on behalf of the industry.
I urge everyone to provide your comments and then make it a key part of your business practice once it is finalized.
Mike Levin, Executive Director, Web Analytics Association.

[Keith MacD]

Very nice and a great step in the right direction.

This draft seems to speak mostly to data collection and personal privacy however there's a second side to what web analysts do: using the data to tell a story.

It seems to me there should be a section about not misrepresenting the data (telling one story when we know the data indicate another is more likely) and about not misrepresenting the data collection method (ex. noting that "internal" tools like Omniture don't count work & home computers as the same unique person).

There's a whole set of ethics around using the data we collect that shouldn't be ignored - a code of ethics for analysts as opposed to a code of ethics for organisations.

My thoughts are driven by the recent Columbia Journalism School report "Confusion Online" which reignites an old debate and appears to do our industry no favours: http://ow.ly/2DsYD

Thanks for starting the ball rolling!

Keith

[Adam Jenkins]

Eric,
Thank you for taking the time to put this together. I am certainly willing to sign as well as adhere to the policies outlined in the agreement. I appreciate your efforts in providing ethical standards to our industry.

ARJ

[Jim Sterne]

Rudi said: Where do I get a web badge to display to show others I stand behind this?

I say: Hear, hear! Let's have a Contest! The winning design earns gets a free pass to eMetrics. Who would like to donate an upload and voting platform?

Vincent said: Aggregate data that has no statistical significance into one bucket.
Thomas said: ...assure a common baseline of measurement methodology within my organization to assure all individuals may work under the same data definitions and be scored accordingly.
Jim Novo said: ...report the same business truths to all stakeholders; I will not intentionally misrepresent or torture the data to favor a specific business outcome.

Aren't these data use issues rather than a privacy and data protection issues? Aren't they best practices rather than ethical considerations?

Mike said: the WAA Board took swift action.

I say: The WAA Board has never moved faster on anything - ever - not even choosing a place for lunch. John Lovett said, "Here's what Eric is thinking about doing" and the Board said "Yowzer! Any opposed? No? All right!!"

Eric - In #10 you said, "...we are far stronger as a community than any one individual could ever be."
I say, "Thank you," deeply, extensively and continuously.

But, of course, never being able to leave well enough alone, I have a couple of comment/questions.:

#1 includes, "I will never knowingly transfer, release, or otherwise distribute data gathered through digital channels without express permission from the consumer(s) who generated the data."

That feels over the top to me unless we narrow it to "personal data" or "personally identifiable data" or something. Express permission may be too difficult to obtain on general behavioral data. Is "implied consent" good enough for some data and "express permission" required for other types?

I'm pretty confused by #8. It says, "If anyone asks I will be transparent, honest, and forthright regarding the data we collect and how it is used to improve the overall consumer and customer experience online."

How transparent and forthright do I have to be? Do I have to provide detailed descriptions of my recommendation engine algorithm? Do I need to publish my competitive edge process for data analysis? This feels like a pledge to reveal intellectual property so I am don't quite understand the intent. Can this be made clearer?

At the risk of repetition: Great Stuff!
Thank you, thank you, thank you.

[Jason Thompson]

This is spot on Eric.

I think a critical component of this is visibility of the Code itself and that visibility has to reach far beyond the measure community.

For us to provide this with the proper visibility that it deserves, we all need to get past the "it's not my job" mentality and become advocates for our industry.

This Code provides us a framework so that we can all speak with one collective voice.

[Juli]

I like Jim Novo's last line: "I will not intentionally misrepresent or torture the data to favor a specific business outcome." I think it is worthy of its own point, that I will promise to present the data accurately and without an agenda. The goal of a successful web analytics presentation is to slice the information into relevant correlations and yet do it in a way that the data speaks for itself, not because you can explain what it means to a not-technical audience.

[Jim Cain]

Hi All,

Both the original post and the comments have been a great read. Once we end up with a final version of the code, I will be pleased to have all our analysts sign on the line.

Sooner or later (most likely sooner), the perceived value to executives of WA is going to go through the roof. While this is great for analysts, it also means we are going to be asked some hard questions about what we can do, and should do, with all this business critical data we have been collecting. Being proactive on writing our own standards will let us answer the hard questions as they come up - and make sure we are respecting our site visitors as well as our bosses.

We had a meeting first thing this morning to talk about this post, and our thoughts are on the Napkyn blog. Let us know what feedback and support we can give to the process.

Cheers.

Jim

[Todd]

Looks like a good start. Is there a distinction between B2C and B2B web analytics, specifically with regard to #2? I know most B2B marketing automation platforms track website usage at the individual level, so Salespeople can see exactly who is on their site and what they are doing for followup. How is that reconciled?

[M. Edward (Ed) Borasky]

Very interesting. I'll have to read it in more detail, but I'm wondering if Eric Schmidt (CEO of Google) or Mark Zuckerberg (CEO of Facebook) would sign this? ;-)

[Ned Kumar]

Eric,
This is a great draft and can definitely be the foundation to build on. Just a couple of observations.

We need to define certain boundaries. An analyst and the firm might adhere to these, but would they also be responsible for the ethics of the agencies they deal with? Also, are we talking about just PII or any customer data?

We might need to (just a thought) flush a bit more on where the "ethical" boundaries/ responsibilities end and the "proprietary" boundaries start (in terms of data, processes, methodologies etc. that might fall into firm-specific intellectual property).

While I agree with the need for education, senior leadership buy-in, and legal review, I am not convinced on how this should be championed. Or flipping it around, if we want the web analyst to take on these responsibilities, then we also need to redefine the skill set needed to make a good web analyst.

My reason for saying this is because too often both legal and Senior Management are risk-averse. So approaching them and telling them this and that is invasive or a concern vis-a-vis privacy issue without laying the groundwork and using the proper communication style is a sure way for them to clamp down on what you can do. In other words, the web analyst & our community at large has the unenviable job of furthering our field into new realms while keeping the ethical/privacy aspects in perspective. It can and should be done, but some thought has to go into it before going to senior leadership or legal.

Great work Eric.

Best,
Ned

[Adam Greco]

Eric,

I think this is a huge step in the right direction. I like the idea of drawing a "line in the sand" and getting our community to rally around what we agree should and should not be done in our industry. It is much better to proactively control our own destiny than to let regulators do it for us! Something about an ounce of prevention is better than a pound of cure... Anxious to hear the next steps...

Adam Greco

[Pritesh Patel]

Great material here Eric and one which will help settle some corps perception of spying....I mean web analytics and promote the ethical side to it.

I agree with Todd regarding B2B use, I have known companies use 'Service Providers' reports to tap into companies as part of the profiling/scoping process. It works but where is the 'code' to treat this data as intelligence only?

Otherwise, super stuff!

Pritesh

[Steve Fernandez]

This is an excellent start for anyone to adopt. It reads well and simply enough for anyone outside of the trade circles to read; which is the real point. It needs to be understandable by those we provide our services to. And, this accomplishes just that objective.

It reads well enough that it could almost be used for any situation dealing with sensitive data; like medical records, etc.

[Eric T. Peterson]

Wow, I am amazed at the strength and quality of response from all of the commentors above! It is clear that we have hit a chord and are onto somthing which is awesome. Next steps are to coordinate the comments into a reasonable revision and present a 2.0 version of this proposed code.

Before we do that it would be great to hear even more views on the code, perhaps even some opposing views? There are so many passionate, intelligent folks in our community ... it would be great to hear even more folks weigh in!

John and I are in transit to Europe but I am hoping to dig deeper into the comments soon. Keep 'em coming and thanks for all of your support pf this idea.

Eric T. Peterson
Web Analytics Demystified
http://www.webanalyticsdemystified.com

[Peter Adams]

Nice work Eric! I really like this and think it's going to really help guide practitioners to act responsibly.

My only comment is that we should be mindful of the distinction between a company's data usage/privacy policy and the ethical actions of analysts.

I'm particularly thinking about point #2 as the way it reads might be a sticking point for practitioners that are afraid that it could put them at odds with their current of future corporate privacy policies. Personally, I think that point #6 is enough and that you could lose #2 altogether by strengthening #6 even further.

My reasoning is that, if disclosed and done responsibly, there are plenty of legitimate reasons to link usage behavior to PII as other commenters have noted. I'd hate to see the WAA take a position that casts judgement on those practices when it could take the lead in outlining exactly how to do so responsibly.

But I don't think that we should try to tackle that through this code of ethics as those issues are largely linked to corporate/company wide policy decisions.

If this code of ethics is about the analysts/practitioner then I think it makes sense for their to be a parallel WAA effort to develop a "data usage" code for companies to sign/adopt.

That initiative could put the WAA in a position to provide all stakeholders with a standard, easy way to distinguish between companies that properly disclose data usages/practices and those that do not.

It could also tie in with a company's use of P3P compact policy headers so it could be policed.

It might even be smart for the WAA to develop a set of "plain english" data usage policy pages that companies can just link to - much like rights holders do with creative commons licenses. That would sure beat everyone trying to parse the legalese of everyone's data usage/privacy policies - which I personally think is 50% of the problem.

Hope that helps. Thanks again for taking the lead on this important effort.

Peter

[Josh]

I would sign this. These are practices that every web analysts should live up to. Considering that these points will be of interest to consumers as well as analysts, I think it could be made a little more clear to people not familiar with cookies, PII, or html5 and other ways to hack. While it's a pretty straightforward list of promises, it still might not answer three questions many consumers may have about spying concerns:

1. What information are you collecting about me and how is it collected
2. What are you doing with it and why
3. How are you ensuring this information stays private

Just a thought.

[Chris Hoofnagle]

This is a great start, and I really like this effort.

I would add two things:

1) Consumers should be able to opt out of tracking for analytics. The current NAI opt out only stops targeted ad delivery, meaning that the consumer is still tracked. This is a worst-case-scenario privacy outcome: you are still being followed but you do not receive the putative benefit of the tracking. It's really strange that analytics experts think it is okay to track people even when they affirmatively take action to stop it. For example, this behavior should be out of bounds:

http://www.google.com/support/forum/p/Google+Analytics/thread?tid=05e7121884032c9a&hl=en

2) With regards to "anonymity," analytics companies should not use the term at all unless they promise not to reidentify, bump up, or otherwise enhance data to make it identifiable. Thus, I would change #2 to say something like:

I understand that the average consumer expects their online activity to be anonymous and I will work to keep it that way. Regardless of whether I have the ability to co-mingle personally identifiable and anonymous data, I will never connect the two unless A) I HAVE NOT MADE THE REPRESENTATION THAT DATA ARE ANONYMOUS customers have been directly appraised of this effort in advance and B) I am confident in my company’s ability to protect that data and keep it safe; C) I HAVE CLEARLY STATED THAT OUR POLICY IS TO COLLECT DATA AND CONNECT IT TO OTHER INFORMATION TO LEARN MORE ABOUT THE USER

[VaBeachKevin]

Can you give me a little more clarification on number 5? I For the record I am not totally opposed to certain methods that allow me to se things in your browser history. so long as it is done appropriately. For example for a first time visitor to my site, had they previously been at my competitors site or was I their first choice, etc.

[Christopher Berry]

My contribution:

http://christopherberry.ca/2010/09/a-code-of-ethics/

[Bryan Cristina]

Looks good.

I would suggest being supporting of adding a way to have visitors block or opt-out to tracking if that is their desire. Not that I love the paranoia surrounding such a decision, but we can't expect people to feel comfortable with our business if we're not going to be sensitive to their unfortunate misunderstandings.

[Eric Beane]

Great Idea and thanks Eric for taking the lead and putting this together. Maybe you can print it out and bring it to X Change next week for some initial autographs from all of us.

[joe_was_taken]

Perhaps an elaboration on the term 'data'?

Besides that, I like it more each time I read it.

[Charles Thrasher]

I think the logical place to postiion the WAA's ethical guidelines for practioners would be within the Standards Committee, an ethical standard comparable to our technical standards, giving equal weight to both. As we respond to questions about our ethical standards we'll inevitably deal with the resulting technical implications.

I suppose a case might be made for two separate committees addressing each issue independently but I think there's greater impact with treating the ethical and technical issues as two sides of the same coin.

[Bill Bruno]

Eric,

Great job on this, definitely headed in the right direction. I like Jim Novo's comment about adding in something that says one will never knowingly provide incorrect data to justify claims/projects, etc. Also, I would be looking for more clarification around the "hacks" as there are quite a few adjustments you can make to tagging in general, and if it's not the standard deployment doesn't that by nature make it a "hack"? I'm 100% behind this initiative, and think it's a great first step towards educating people outside our industry.

[Aaron Fossum]

Thanks to the WAA board for the quick action, Eric and John for leadership and to the community for great comments! Here are my thoughts:

I found the 10 points to be comprehensive but I would rewrite point #10:

#10: I will help spread and enforce these standards across the Internet. I recognize that we are far stronger as a community than one individual, and I believe that consistency in voice is important to communicating effectively about the work that I do. I will support the Web Analytics Association's efforts to safeguard consumer privacy by providing feedback, referencing this Code and other Association publications, and by advocating for adherance to these standards. When I observe a violation of these standards outside my organization, I will make reasonable efforts to notify the appropriate site owner. I will provide site feedback directly and privately to the website using any email links or feedback forms that are provided. I will provide the site owner with a link to this code.

I think this adds some teeth to the code, without being without requiring an unrealistic amount of effort or being unnecessarily harsh. This will help those outside the analytics industry believe in the code and the industry's ability to enforce it.

Consider this food for thought: If we want Association membership/certification to carry the weight of the Bar or CPAs, etc, our policies should carry some weight of enforcement. If member organizations are found to be in gross violation of these standards, we have some kind of remedial action. This isn't intended to be nasty, but instead to earn credibility for the Association. To continue the analogy, getting disbarred is pretty rare and is only done in pretty extreme circumstances and according to a strictly defined code versus loosely defined guidelines. It would look bad if we had our "WAA Privacy" badge on a bunch of sites making rampant use of FSO's...

My additional feedback is more nit-picky:

#6: add "clear and understandable" to "accurate and truthful". Most privacy policies I see are overly complicated. I believe consumers would be more comfortable if they could easily understand the privacy policy. I think woot.com does a pretty good job: http://bit.ly/wootprivacy.

#8: I would strike "if anyone asks". As previous comments suggest, we may need a tighter definition of what "transparent" means, but I think we can leave it to reasonable interpretation. "If anyone asks" almost sounds contrary to "forthright". Naturally, we're not going to publish obscure details unless asked, but I think there is a reasonable interpretation of "transparent and forthright" without requiring "if anyone asks".

There are certainly other ethical considerations we face as a community, as noted by other comments. We might consider a separate code of ethics around data presentation and interpretation as well, but this is a good start on the issue of privacy ethics.

In all, this is a great start! I think some of the language could be refined, either by a small committee, or maybe "Flash Mob" style using a shared (and tracked) editor.

Cheers!
Aaron

[Eric T. Peterson]

Your collective response continues to AMAZE me and I am delighted that industry heavy-weights like Jim Sterne, Jim Novo, Bill Bruno and others have weighed in. Thanks to EVERYONE who has commented so far and keep the comments coming.

I'm still overseas but have an action item to look for a platform that will allow us all to collaborate on the 2.0 version of the document. Need to be able to automatically log changes and who suggested/recommended those changes ... a Wiki I guess. Anyone have any suggestions for a platform?

Once again, I am humbled by our communities response to my suggestion.

Eric T. Peterson
Web Analytics Demystified, Inc.
http://www.webanalyticsdemystified.com

[Kevin]

The only piece I would add would be in relation to 3rd party analysts, which I posted a piece on yesterday. The important piece (IMHO) being:

I will respect the privacy of each of my clients, and use my knowledge of their business goals, objectives, and methods to further only their cause. I will not leverage any gained experience in a way that unduly compromises a client, current, past or future, or jeopardizes their ability to maintain a competitive edge due to my work with them.

[Jim]

Eric,
I posted this on the Standards committee as well. I believe this is moving in the right direction.
Thanks
Jim
---------------------------------------
All

In our profession, we have classes, certifications, organizations, and programs that create the foundation of our exciting careers, but this has not been enough to quell the "concerns” over what we do or how we do it. This can be attributed to both a general misunderstanding as well as the greatly publicized events that negatively impacted the perception of our profession. These two contribute to the objections on what data we collect, how we secure the data, and what value it brings to our customers. So allow me to indulge for a moment.

What contributes to the misperception of the analytics field? The very few vendors, consultants, agencies, and individuals who may be fantastic at web development, but they have very little experience with analytics. It seems like a "natural” fit for them, but it is far from it. Some give elaborate sales pitches, bring on MBA team members, and promise to provide true insight into the customer’s web behavior. What the company receives is a quarterly report on page views, visits, and time spent. Not that those metrics are not valuable, to a degree, but where is the analysis, the options, the business direction? Where can the company make changes to reap a higher ROI or what can the company do to distribute their information more efficiently? It is this type of under-delivery that damages our reputations and actually embarrasses true analytic practitioners.

Another related item that has received much attention even at the Congressional level is Personally Identifiable Information (PII). There have been well publicized instances where companies’ data warehouses have been compromised, either by mistake or by hacking. This data cannot only bring financial consequences to the individuals, corporations, or government entities, but humiliation and embarrassment. Obviously, the data stored must be secure, but the people who have access, manage, and translate it, must be held accountable for the highest levels of data integrity.

The old adage "one happy customer tells three friends, one unhappy customer tells ten,” no longer applies in our world. With the web, social media, and mobile outlets, one unhappy customer has access to thousands or millions of people who could one day become one of our potential clients. Our image and our professional integrity must be preserved.

With all that said, I am in full agreement of the proposal to have a Code of Ethics, I will sign the final copy anywhere, anytime, and believe it is a step in the right direction. However, may I play devils advocate and ask, is this going to be enough? How will it be managed and controlled?

Before I rested my hands on the keyboard, I could hear the "nays” on my next few thoughts, but I wanted to put it out there for discussion. Consider for a moment, offering a license to practice web analytics. Logistics aside, would a company prefer to hire a licensed agency with certified professionals or some kind of combination thereof? Maybe it is a bit over the top, but I do believe we may need a multifaceted approach. I envision many other committees involved with specific objectives to support the effort. I will brand it a Web Analytics Revolution (WAR); hopefully that acronym has not been taken.

In any case, I have many more ideas, but before I share them, I would like to get your feedback. If you would rather speak to me directly feel free to call 703-856-2600 or I can be reached at jimparker33@aol.com.

Sincerely,

Jim

[Judah]

Hi Eric,

As one of the early reviewers of the WACOE, you already incorporated my input prior to publication, but here's my "imho":

1) "Express permission" needs to be defined.

2) Re: #6. Large companies, especially Internet-based companies, have too many technologies for a web analyst to "assume the responsibility for "starting" the conversation. Does this extend to tools for behavioral measurement deployed by agencies or by other teams, like, media teams or marketing teams in control of ad technologies? What about local market teams and their own marketing technology relationships across 60+ different countries? The conversation should have already been started when the legal contracts to deploy these technologies were negotiated with Procurement prior to deployment (before the web analyst may even be aware of the potential for deployment).

3) Re: #7. Large companies have too many systems for a web analyst to "pay close attention" to the list of individuals who have access. Expecting a web analyst to do so across all systems that contain customer, transactional, or behavioral data is unrealistic. In fact, Data Governance teams and teams in IT already do this access-checking and ACL purging as a best practice. Of course, for tools that the Web Analyst has control over, I agree.

4) Web Analysts are not the Privacy team, the Fraud team, nor the Compliance team. At the risk of sounding like I don't want to do extra work, I think it's unrealistic and a mistake to make the web analyst accountable for everything related to privacy that occurs everywhere by anybody in a company, especially in large, globally-distributed company. I agree, of course, we should have a seat at the table and do our best, but not be the singular "front line" - just part of a larger cross-functional, globally distributed team that is collectively together on the front line protecting customer and consumer privacy.

Again, as with most things in Web Analytics, it's a lot easier (but still hard ;) when talking about small companies. Things, as you know, get inordinately more complex at larger companies. And while I realize my experience, as we've discussed many times before :), isn't the normal case and the WA work I do tends to be more bleeding edge than simply adding GA tags to a site, it's worth ensuring use-cases for companies of all sizes are accommodated and realistically represented in the WACOE.

See you at X Change!

Judah

[Elizabeth]

I think the biggest criticism we would hear about the Code of Ethics is that personally identifiable information will continue to be used and shared as long as notification is given in the site privacy policy. Does anyone actually read those? I think the general public will continue to be suspicious of the entire industry unless the message is clearly articulated that in the vast majority of cases the data is used at the aggregate level, and only where expressly communicated (ie, not hidden in a privacy policy) is it used to tie back to the individual visitor.

[Helen Faber]

Pleased to see that the WAA is drafting a Code of Ethics. Agreed that this is a BIG step in the right direction. Also like the idea of those of us that are members, and agree with the Code of Ethics, that we can post a badge on our website with a link to the web page.

Helen Faber

[Brian Clifton]

Nice work Eric and I certainly support this initial effort - in principal. However, I do echo Judah's concerns (2 comments above).

Here's my 2 cents:
------------------------
Rather than aiming this at the web analyst as an individual, why not target the company/organisation collecting the information on their website i.e. its a commitment as an entity to protect its visitor's data. For example, as an addition to their Terms of Service or Privacy Policy.

A very large CAVEAT though is what happens when these ethics are broken?

I am guessing the WAA does not wish to police data collection policies of either its members or organisations? That begs the question, if there is no policing of this, what's the point...?

(btw, In theory I would support a policing approach. However I realise it would be totally impractical...)

Best regards, Brian
Advanced-Web-Metrics.com

[Dave Rogers]

This is great work, Eric and John, and I am also happy to see so many in the community jump in with thoughts. Obviously, it is something that is touching a chord with many of us, and probably also because we are able to see both sides of this, as analysts and also as consumers online.

I am glad Judah chimed in. In the large organizations that I have worked in, it would be impossible for me to carry out this agenda and feel confident that I could be successful doing so. I have had, on many occasions, to talk privately with junior analysts in other functional areas when I notice some mishandling of personal information. In one such example, I had to describe why we could not use responses to survey data to target individuals when subjects were told the results would be analyzed in aggregate and anonymously, This conversation was not taken well, and although I felt I had an obligation to protect 'my' consumers, it almost started a battle between the web ana and the market research team, who were more experienced in traditional data collection methods.

I like the proactive idea of working toward our own guidelines, but a few things I've read in the comments above seem out of scope. Again, I agree that a COE is a great idea and I am all for it, but I think we need to think more about how to implement realistically.

It might further my career by being on top of a needed solution for an issue in the org... or it could be detrimental as I am walking around policing everyone all the time. What we are stating above is no small task and would take a considerable amount of time to manage in a large enterprise org- especially for those not in senior management. I've been in meetings often in which I don't think we are putting our best foot forward in respect to consumer privacy, but I know that I have to play a little bit of politics to educate them and get those people to agree with me, but it doesn't always work. In terms of the COE, in this case, would I have done my job? Is the specific role to 'try' to change minds or am I successful only after the org, as a whole gets a passing grade? I think we need to re-work the wording to address the concept of being aware and involved in creating change and not that of being responsible for change. Also, of course this COE is always going to be in action, meaning we might only be able to move the needle every so often, but not win every fight. Am I then able to call myself ethical? I would hope so.

One roadblock we may have as a group to get this out, is that there are many sides to this issue; what one experiences and expects from partner/vendor side is quite different from that of a small org, then that of a large org, and as mentioned above, B2B probably has different concerns, or ways they use personal consumer data, then B2C. We know about these different needs by different players in our industry of course, and have been able to develop great conferences and such that address each of us, so let’s use this background to better anticipate acceptable guidelines for all.

[Nick M. Necsulescu]

Hi Eric,

I agree with the rest, in that this is a great step forward. I also agree with Jim Novo that it might be worthwhile to include a business ethics statement. It would provide additional credibility to the entire code. Since # 8, touches on this subject, it could be expanded to include such a statement within it.

Great job on the Code of Ethics document!

Nick

[Simrit Nikore]

I will ask first "how would I want my information and my identity to be treated?" and then act in treating others with the same regard, rights, and respect.