Throughout this book, we’ll be looking at user activity on the Web. Integrating analytical data with user identity will help your business. But integrating user data also has important moral and legal implications for privacy.

To make sense of what’s happening online, you need to stitch together a huge amount of data: page retrievals, blog mentions, survey results, referring sites, performance metrics, and more. Taken alone, each is just an isolated data point. Taken together, however, they reveal a larger pattern—one you can use to make business decisions. They also show you the activities of individual users.

Collecting data on individuals’ surfing habits and browsing activities is risky and fraught with moral pitfalls. In some jurisdictions, you have a legal obligation to tell visitors what you’re collecting, and in the event of a security breach, to inform them that their data may have been compromised.

As a result, you need to balance your desire for complete web visibility with the risks of collecting personally identifiable information. This means deciding what you’ll collect, how long you’ll store it, whether you’ll store it in aggregate or down to the individual visit, and who gets access to the data. It also means being open about your collection policies and giving visitors a way to opt out in plain, simple terms, not buried away in an obscure Terms of Service document nobody reads.

Being concerned with privacy is more than just knowing the legislation, because legislation is capricious, varies by legislature and jurisdiction, and changes over time. Marketers are so eager to understand their customers that tracking personal identity will likely become commonplace. Ultimately, we will tie together visitors’ activity on our own sites, in communities, on the phone, and in person. Already, retail loyalty cards and call center phone systems can associate a person’s behavior with his or her online profile.

As a web professional, you will need to define what’s acceptable when it comes to tracking users. You can make great decisions and watch websites without needing to look at individual users. Individual visits can sometimes be a distraction from the “big picture” patterns that drive your business anyway. But as we start to extract more from every user’s visit, you’ll need to think about the moral and legal implications of watching web users throughout your monitoring strategy.