Recherche avancée

Sur d’autres sites (5406)

• Understanding Data Processing Agreements and How They Affect GDPR Compliance

  9 octobre 2023, par Erin — GDPR

  The General Data Protection Regulation (GDPR) impacts international organisations that conduct business or handle personal data in the European Union (EU), and they must know how to stay compliant.

  One way of ensuring GDPR compliance is through implementing a data processing agreement (DPA). Most businesses overlook DPAs when considering ways of maintaining user data security. So, what exactly is a DPA’s role in ensuring GDPR compliance ?

  In this article, we’ll discuss DPAs, their advantages, which data protection laws require them and the clauses that make up a DPA. We’ll also discuss the consequences of non-compliance and how you can maintain GDPR compliance using Matomo.

  What is a data processing agreement ?

  A data processing agreement, data protection agreement or data processing addendum is a contractual agreement between a data controller (a company) and a data processor (a third-party service provider.) It defines each party’s rights and obligations regarding data protection.

  A DPA also defines the responsibilities of the controller and the processor and sets out the terms they’ll use for data processing. For instance, when MHP/Team SI sought the services of Matomo (a data processor) to get reliable and compliant web analytics, a DPA helped to outline their responsibilities and liabilities.

  A DPA is one of the basic requirements for GDPR compliance. The GDPR is an EU regulation concerning personal data protection and security. The GDPR is binding on any company that actively collects data from EU residents or citizens, regardless of their location.

  As a business, you need to know what goes into a DPA to identify possible liabilities that may arise if you don’t comply with European data protection laws. For example, having a recurrent security incident can lead to data breaches as you process customer personal data.

  The average data breach cost for 2023 is $4.45 million. This amount includes regulatory fines, containment costs and business losses. As such, a DPA can help you assess the organisational security measures of your data processing methods and define the protocol for reporting a data breach.

  Why is a DPA essential for your business ?

  If your company processes personal data from your customers, such as contact details, you need a DPA to ensure compliance with data security laws like GDPR. You’ll also need a DPA to hire a third party to process your data, e.g., through web analytics or cloud storage.

  But what are the benefits of having a DPA in place ?

  

  A key benefit of signing a DPA is it outlines business terms with a third-party data processor and guarantees compliance with the relevant data privacy laws. A DPA also helps to create an accountability framework between you and your data processor by establishing contractual obligations.

  Additionally, a DPA helps to minimise the risk of unauthorised access to sensitive data. A DPA defines organisational measures that help protect the rights of individuals and safeguard personal data against unauthorised disclosure. Overall, before choosing a data processor, having a DPA ensures that they are capable, compliant and qualified.

  More than 120 countries have already adopted some form of international data protection laws to protect their citizens and their data better. Hence, knowing which laws require a DPA and how you can better ensure compliance is important.

  Which data protection laws require a DPA ?

  Regulatory bodies enact data protection laws to grant consumers greater control over their data and how businesses use it. These laws ensure transparency in data processing and compliance for businesses.

  

  The following are some of the relevant data privacy laws that require you to have a DPA :

  • UK GDPR
  • Brazil LGPD
  • EU GDPR
  • Dubai PDPA
  • Colorado CPA
  • California CCPA/CPRA
  • Virginia VCDPA
  • Connecticut DPA
  • South African POPIA
  • Thailand PDPA

  Companies that don’t adhere to these data protection obligations usually face liabilities such as fines and penalties. With a DPA, you can set clear expectations regarding data processing between you and your customers.

  Review and update any DPAs with third-party processors to ensure compliance with GDPR and the laws we mentioned above. Additionally, confirm that all the relevant clauses are present for compliance with relevant data privacy laws. 

  So, what key data processing clauses should you have in your DPA ? Let’s take a closer look in the next section.

  Key clauses in a data processing agreement

  GDPR provides some general recommendations for what you should state in a DPA.

  

  Here are the elements you should include :

  Data processing specifications

  Your DPA should address the specific business purposes for data processing, the duration of processing and the categories of data under processing. It should also clearly state the party responsible for maintaining GDPR compliance and who the data subjects are, including their location and nationality.

  Your DPA should also address the data processor and controller’s responsibilities concerning data deletion and contract termination.

  Role of processor

  Your DPA should clearly state what your data processor is responsible for and liable for. Some key responsibilities include record keeping, reporting breaches and maintaining data security.

  Other roles of your data processor include providing you with audit opportunities and cooperating with data protection authorities during inquiries. If you decide to end your contract, the data processor is responsible for deleting or returning data, depending on your agreement.

  Role of controller

  Your DPA should inform the responsibilities of the data controller, which typically include issuing processing instructions to the data processor and directing them on how to handle data processing.

  Your DPA should let you define the lawful data processes the data processor should follow and how you’ll uphold the data protection rights of individuals’ sensitive data.

  Organisational and technical specifications

  Your DPA should define specifications such as how third-party processors encrypt, access and test personal data. It should also include specifications on how the data processor and controller will maintain ongoing data security through various factors such as :

  • State of the technology : Do ‌third-party processors have reliable technology, and can they ensure data security within their systems ?
  • Costs of implementation : Does the data controller’s budget allow them to seek third-party services from industry-leading providers who can guarantee a certain level of security ?
  • Variances in users’ personal freedom : Are there privacy policies and opt-out forms for users to express how they want companies to use their sensitive data ?

  Moreover, your DPA should define how you and your data processor will ensure the confidentiality, availability and integrity of data processing services and systems.

  What are the penalties for DPA GDPR non-compliance ?

  Regulators use GDPR’s stiff fines to encourage data controllers and third-party processors to follow‌ best data security practices. One way of maintaining compliance is through drafting up a DPA with your data processor.

  The DPA should clearly outline the necessary legal requirements and include all the relevant clauses mentioned above. Understand what goes into this agreement since data protection authorities can hold your business accountable for a breach — even if a processor’s error caused it.

  Data protection authorities can issue penalties now that the GDPR is in place. For example, according to Article 83 of the GDPR, penalties for data or privacy breaches or non-compliance can amount to up to €20 million or 4% of your annual revenue.

  There are two tiers of fines : tier one and tier two. Violations related to data processors typically attract fines on the tier-one level. Tier one fines can cost your business €10 million or 2% of your company’s global revenue.

  Tier-two fines result from infringement of the right to forget and the right to privacy of your consumer. Tier-two fines can cost your business up to €20 million or 4% of your company’s global revenue.

  GDPR fines make non-compliance an expensive mistake for businesses of all sizes. As such, signing a DPA with any party that acts as a data processor for your business can help you remain GDPR-compliant.

  How a DPA can help your business remain GDPR compliant

  A DPA can help your business define and adhere to lawful data processes.

  

  So, in what other ways can a DPA help you to remain compliant with GDPR ? Let’s take a look !

  1. Assess data processor’s compliance

  Having a DPA helps ensure that the data processor you are working with is GDPR-compliant. You should check if they have a DPA and confirm the processor’s terms of service and legal basis.

  For example, if you want an alternative to Google Analytics that’s GDPR compliant, then you can opt for Matomo. Matomo features a DPA, which you can agree to when you sign up for web analytics services or later.

  2. Establish lawful data processes

  A DPA can also help you review your data processes to ensure they’re GDPR compliant. For example, by defining lawful data processes, you better understand personally identifiable information (PII) and how it relates to data privacy.

  Further, you can allow users to opt out of sharing their data. As such, Matomo can help you to enable Do Not Track preferences on your website.

  

  With this feature, users are given the option to opt in or out of tracking via a toggle in their respective browsers.

  Indeed, establishing lawful data processes helps you define the specific business purposes for collecting and processing personal data. By doing so, you get to notify your users why you need their data and get their consent to process it by including a GDPR-compliant privacy policy on your website.

  3. Anonymise your data

  Global privacy laws like GDPR and ePrivacy mandate companies to display cookie banners or seek consent before tracking visitors’ data. You can either include a cookie consent banner on your site or stop tracking cookies to follow the applicable regulations.

  Further, you can enable cookie-less tracking or easily let users opt out. For example, you can use Matomo without a cookie consent banner, exempting it from many countries’ privacy rules.

  Additionally, through a DPA, you can define organisational measures that define how you’ll anonymise all your users’ data. Matomo can help you anonymise IP addresses, and we recommend that you at least anonymise the last two bytes.

  

  As one of the few web analytics tools you can use to collect data without tracking consent, Matomo also has the French Data Protection Authority (CNIL) approval.

  4. Assess the processor’s bandwidth

  Having a DPA can help you implement data retention policies that show clear retention periods. Such policies are useful when ending a contract with a third-party service provider and determining how they should handle your data.

  A DPA also helps you ensure the processor has the necessary technology to store personal data securely. You can conduct an audit to understand possible vulnerabilities and your data processor’s technological capacity.

  5. Obtain legal counsel

  When drafting a DPA, it’s important to get a consultation on what is needed to ensure complete compliance. Obtaining legal counsel points you in the right direction so you don’t make any mistakes that may lead to non-compliance.

  Conclusion

  Businesses that process users’ data are subject to several DPA contract requirements under GDPR. One of the most important is having DPAs with every third-party provider that helps them perform data processing.

  It’s important to stay updated on GDPR requirements for compliance. As such, Matomo can help you maintain lawful data processes. Matomo gives you complete control over your data and complies with GDPR requirements.

  To get started with Matomo, you can sign up for a 21-day free trial. No credit card required.

  Disclaimer

  We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to GDPR. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns.

• Virginia Consumer Data Protection Act (VCDPA) Guide

  27 septembre 2023, par Erin — Privacy

  Do you run a for-profit organisation in the United States that processes personal and sensitive consumer data ? If so, you may be concerned about the growing number of data privacy laws cropping up from state to state.

  Ever since the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, four other US states — Connecticut, Colorado, Utah and Virginia — have passed their own data privacy laws. Each law uses the CCPA as a foundation but slightly deviates from the formula. This is a problem for US organisations, as they cannot apply the same CCPA compliance framework everywhere else.

  In this article, you’ll learn what makes the Virginia Consumer Data Protection Act (VCDPA) unique and how to ensure compliance.

  What is the VCDPA ?

  Signed by Governor Ralph Northam on 2 March 2021, and brought into effect on 1 January 2023, the VCDPA is a new data privacy law. It gives Virginia residents certain rights regarding how organisations process their personal and sensitive consumer data.

  

  The law contains several provisions, which define :

  • Who must follow the VCDPA
  • Who is exempt from the VCDPA
  • The consumer rights of data subjects
  • Relevant terms, such as “consumers,” “personal data,” “sensitive data” and the “sale of personal data”
  • The rights and responsibilities of data controllers
  • What applicable organisations must do to ensure VCDPA compliance

  These guidelines define the data collection practices that VCDPA-compliant organisations must comply with. The practices are designed to protect the rights of Virginia residents who have their personal or sensitive data collected.

  What are the consumer rights of VCDPA data subjects ?

  There are seven consumer rights that protect residents who fit the definition of “data subjects” under the new Virginia data privacy law. 

  

  A data subject is an “identified or identifiable natural person” who has their information collected. Personally identifiable information includes a person’s name, address, date of birth, religious beliefs, immigration status, status of child protection assessments, ethnic origin and more.

  Below is a detailed breakdown of each VCDPA consumer right :

  1. Right to know, access and confirm personal data : Data subjects have the right to know that their data is being collected, the right to access their data and the right to confirm that the data being collected is accurate and up to date.
  2. Right to delete personal data : Data subjects have the right to request that their collected personal or sensitive consumer data be deleted.
  3. Right to correct inaccurate personal data : Data subjects have the right to request that their collected data be corrected.
  4. Right to data portability : Data subjects have the right to obtain their collected data and, when reasonable and possible, request that their collected data be transferred from one data controller to another.
  5. Right to opt out of data processing activity : Data subjects have the right to opt out of having their personal or sensitive data collected.
  6. Right to opt out of the sale of personal and sensitive consumer data : Data subjects have the right to opt out of having their collected data sold to third parties.

  Right to not be discriminated against for exercising one’s rights : Data subjects have the right to not be discriminated against for exercising their right to not have their personal or sensitive consumer data collected, processed and sold to third parties for targeted advertising or other purposes.

  Who must comply with the VCDPA ?

  The VCDPA applies to for-profit organisations. Specifically, those that operate and offer products or services in the state of Virginia.

  

  Additionally, for-profit organisations that fit under either of these two categories must comply with the VCDPA :

  • Collect and process the personal data of at least 100,000 Virginia residents within a financial year or
  • Collect and process the personal data of at least 25,000 Virginia residents and receive at least 50% of gross revenue by selling personal or sensitive data.

  If a for-profit organisation resides out of the state of Virginia and falls into one of the categories above, they must comply with the VCDPA. Eligibility requirements also apply, regardless of the revenue threshold of the organisation in question. Large organisations can avoid VCDPA compliance if they don’t meet either of the above two eligibility requirements.

  What types of consumer data does the VCDPA protect ?

  The two main types of data that apply to the VCDPA are personal and sensitive data. 

  

  Personal data is either identified or personally identifiable information, such as home address, date of birth or phone number. Information that is publicly available or has been de-identified (dissociated with a natural person or entity) is not considered personal data.

  Sensitive data is a category of personal data. It’s data that’s either the collected data of a known child or data that can be used to form an opinion about a natural person or individual. Examples of sensitive data include information about a person’s ethnicity, religion, political beliefs and sexual orientation. 

  It’s important that VCDPA-compliant organisations understand the difference between the two data types, as failure to do so could result in penalties of up to $7,500 per violation. For instance, if an organisation wants to collect sensitive data (and they have a valid reason to do so), they must first ask for consent from consumers. If the organisation in question fails to do so, then they’ll be in violation of the VCDPA, and may be subject to multiple penalties — equal to however many violations they incur.

  A 5-step VCDPA compliance framework

  Getting up to speed with the terms of the VCDPA can be challenging, especially if this is your first time encountering such a law. That said, even organisations that have experience with data privacy laws should still take the time to understand the VCDPA.

  

  Here’s a simple 5-step VCDPA compliance framework to follow.

  1. Assess data

  First off, take the time to become familiar with the Virginia Consumer Data Protection Act (VCDPA). Then, read the content from the ‘Who does the VCDPA apply to’ section of this article, and use this information to determine if the law applies to your organisation.

  How do you know if you reach the data subject threshold ? Easy. Use a web analytics platform like Matomo to see where your web visitors are, how many of them (from that specific region) are visiting your website and how many of them you’re collecting personal or sensitive data from.

  To do this in Matomo, simply open the dashboard, look at the “Locations” section and use the information on display to see how many Virginia residents are visiting your website.

  

  Using the dashboard will help you determine if the VCDPA applies to your company.

  2. Evaluate your privacy practices

  Review your existing privacy policies and practices and update them to comply with the VCDPA. Ensure your data collection practices protect the confidentiality, integrity and accessibility of your visitors.

  One way to do this is to automatically anonymise visitor IPs, which you can do in Matomo — in fact, the feature is automatically set to default. 

  

  Another great thing about IP anonymisation is that after a visitor leaves your website, any evidence of them ever visiting is gone, and such information cannot be tracked by anyone else. 

  3. Inform data subjects of their rights

  To ensure VCDPA compliance in your organisation, you must inform your data subjects of their rights, including their right to access their data, their right to transfer their data to another controller and their right to opt out of your data collection efforts.

  That last point is one of the most important, and to ensure that you’re ready to respond to consumer rights requests, you should prepare an opt-out form in advance. If a visitor wants to opt out from tracking, they’ll be able to do so quickly and easily. Not only will this help you be VCDPA compliant, but your visitors will also appreciate the fact that you take their privacy seriously.

  

  To create an opt-out form in Matomo, visit the privacy settings section (click on the cog icon in the top menu) and click on the “Users opt-out” menu item under the Privacy section. After creating the form, you can then customise and publish the form as a snippet of HTML code that you can place on the pages of your website.

  4. Review vendor contracts

  Depending on the nature of your organisation, you may have vendor contracts with a third-party business associate. These are individuals or organisations, separate from your own, that contribute to the successful delivery of your products and services.

  You may also engage with third parties that process the data you collect, as is the case for many website owners that use Google Analytics (to which there are many alternatives) to convert visitor data into insights. 

  Financial institutions, such as stock exchange companies, also rely on third-party data for trading. If this is the case for you, then you likely have a Data Processing Agreement (DPA) in place — a legally binding document between you (the data controller, who dictates how and why the collected data is used) and the data processor (who processes the data you provide to them).

  To ensure that your DPA is VCDPA compliant, make sure it contains the following items :

  • Definition of terms
  • Instructions for processing data
  • Limits of use (explain what all parties can and cannot do with the collected data)
  • Physical data security practices (e.g., potential risks, risk of harm and control measures)
  • Data subject rights
  • Consumer request policies (i.e., must respond within 45 days of receipt)
  • Privacy notices and policies

  5. Seek expert legal advice

  To ensure your organisation is fully VCDPA compliant, consider speaking to a data and privacy lawyer. They can help you better understand the specifics of the law, advise you on where you fall short of compliance and what you must do to become VCDPA compliant.

  Data privacy lawyers can also help you draft a meaningful privacy notice, which may be useful in modifying your existing DPAs or creating new ones. If needed, they can also advise you on areas of compliance with other state-specific data protection acts, such as the CCPA and newly released laws in Colorado, Connecticut and Utah.

  How does the VCDPA differ from the CCPA ?

  Although the VCDPA has many similarities to the CCPA, the two laws still have their own approach to applying the law. 

  Here’s a quick breakdown of the main differences that set these laws apart.

  Definition of a consumer

  Under the VCDPA, a consumer is a “natural person who is a Virginia resident acting in an individual or household context.” Meanwhile, under the CCPA, a consumer is a “natural person who is a California resident acting in an individual or household context.” However, the VCDPA omits people in employment contexts, while the CCPA doesn’t. Hence, organisations don’t need to consider employee data.

  Sale of personal data

  The VCDPA defines the “sale of personal data” as an exchange “for monetary consideration” by the data controller to a data processor or third party. This means that, under the VCDPA, an act is only considered a “sale of personal data” if there is monetary value attached to the transaction.

  This contrasts with the CCPA, where that law also counts “other valuable considerations” as a factor when determining if the sale of personal data has occurred.

  Right to opt out

  Just like the CCPA, the VCDPA clearly outlines that organisations must respond to a user request to opt out of tracking. However, unlike the CCPA, the VCDPA does not give organisations any exceptions to such a right. This means that, even if the organisation believes that the request is impractical or hard to pull off, it must comply with the request under any circumstances, even in instances of hardship.

  Ensure VCDPA compliance with Matomo

  The VCDPA, like many other data privacy laws in the US, is designed to enhance the rights of Virginia consumers who have their personal or sensitive data collected and processed. Fortunately, this is where platforms like Matomo can help.

  Matomo is a powerful web analytics platform that has built-in features to help you comply with the VCDPA. These include options like :

  • Cookie-less tracking
  • Creating consumer consent and opt-out forms
  • Giving consumers access to their personal data

  Try out the free 21-day Matomo trial today. No credit card required.

• How to Track Website Visitors : Benefits, Tools and FAQs

  31 août 2023, par Erin — Analytics Tips, Marketing

  Businesses spend a ton of time, money and effort into creating websites that are not only helpful and captivating, but also highly effective at converting visitors. They’ll create content, revise designs, add new pages and change forms, all in the hope of getting visitors to stay on the site and convert into leads or customers.

  When you track website visitors, you can see which of your efforts are moving the needle. While many people are familiar with pageviews as a metric, website visitor tracking can be much more in-depth and insightful.

  In this article, we’ll cover how website visitor tracking works, what you can track, and how this information can improve sales and marketing results. We’ll also explain global privacy concerns and how businesses can choose the right tracking software. 

  What is website visitor tracking ? 

  Website visitor tracking uses software and applications to track and analyse how visitors interact with your website. It’s a vital tool to help businesses understand whether their website design and content are having the desired effect.

  

  Website visitor tracking includes very broad, non-specific data, like how many times visitors have come to your site. But it can also get very specific, with personal information about the user and even recordings of their visit to your site. Site visits, which may include visiting several different pages of the same site, are often referred to as “sessions.”

  Although Google Analytics is the most widely used website visitor tracking software, it isn’t the most comprehensive or powerful. Companies that want a more in-depth understanding of their website may need to consider running a more precise tool alongside Google Analytics, like Matomo.

  As we’ll cover later, website tracking has many important business applications, but it also poses privacy and security concerns, causing some states and countries to impose strict regulations. Privacy laws and your company’s values should also impact what web analytics tool you choose.

  How website tracking works

  Website tracking starts with the collection of data as users interact with the website. Tracking technologies like cookies, JavaScript and pixels are embedded into web pages. These technologies then gather data about user behaviour, session details and user actions, such as pageviews, clicks, form submissions and more.

  More advanced tracking systems assign unique identifiers (such as cookies or visitor IDs) to individual users. This enables tracking of user journeys across multiple sessions and pages. These detailed journeys can often tell a different story and provide different insights than aggregated numbers do. 

  All this collected data is transmitted from the user’s browser to a centralised tracking system, which can be a third-party web analytics tool or a self-hosted solution. The collected data is stored in databases and processed to generate meaningful insights. This process involves organising the data, aggregating metrics, and creating reports.

  Analytics tools process the collected data to generate reports and visualisations that provide insights into user behaviour. Metrics such as pageviews, bounce rates, conversion rates and user paths are analysed. Good web analytics tools are able to present these insights in a user-friendly way. Analysts and marketing professionals then use this knowledge to make informed decisions to improve the user experience (UX).

  Advanced tracking systems allow data segmentation and filtering based on various criteria, such as user demographics, traffic sources, devices and more. This enables deeper analysis of specific user groups. For example, you might find that your conversion rate is much lower when your website is viewed on a mobile device. You can then dig deeper into that segment of data to find out why and experiment with changes that might increase mobile conversions.

  3 types of website tracking and their benefits

  There are three main categories of website tracking, and they each provide different information that can be used by sales, marketing, engineering and others. Here, we cover those three types and how businesses use them to understand customers and create better experiences.

  Website analytics 

  Website analytics is all about understanding the traffic your website receives. This type of tracking allows you to learn how the website performs based on pageviews, real-time traffic, bounce rate and conversions. 

  For example, you would use website analytics to determine how effectively your homepage drives people toward a product or pricing page. You can use pageviews and previous page statistics to learn how many people who land on your homepage read your blog posts. From there, you could use web analytics to determine the conversion rate of the call to action at the end of each article.

  

  User behaviour

  While website analytics focuses on the website’s performance, user behaviour tracking is about monitoring and quantifying user behaviour. One of the most obvious aspects of user behaviour is what they click on, but there are many other actions you can track. 

  The time a user spends on a page can help you determine whether the content on the page is engaging. Some tracking tools can also measure how far down the page a user scrolls, which reveals whether some content is even being seen. 

  Session recordings are another popular tool for analysing user behaviour. They not only show concrete actions, like clicks, but can also show how the user moves throughout the page. Where do they stop ? What do they scroll right past ? This is one example of how user behaviour data can be quantitative or qualitative.

  Visitor information

  Tracking can also include gathering or uncovering information about visitors to your site. This might include demographic information, such as language and location, or details like what device a website visitor is using and on which browser they view your website. 

  This type of data helps your web and marketing teams make better decisions about how to design and format the site. If you know, for example, that the website for your business-to-business (B2B) software is overwhelmingly viewed on desktop computers, that will affect how you structure your pages and choose images. 

  Similarly, if visitor information tells you that you have a significant audience in France, your marketing team might develop new content to appeal to those potential customers.

  Use website visitor tracking to improve marketing, sales and UX 

  Website visitor tracking has various applications for different parts of your business, from marketing to sales and much more. When you understand the impact tracking has on different teams, you can better evaluate your company’s needs and build buy-in among stakeholders.

  Marketing

  At many companies, the marketing team owns and determines what kind of content is on your website. From landing pages to blog posts to the navigation bar, you want to create an experience that drives people toward making a purchase. When marketers can track website visitors, they can get a real look at how visitors respond to and engage with their marketing efforts. Pageviews, conversion rates and time spent on pages help them better understand what your customers care about and what messaging resonates.

  But web analytics can even help marketing teams better understand how their external marketing campaigns are performing. Tracking tools like Matomo reveal your most important traffic sources. The term “traffic source” refers to the content or web property from which someone arrives at your site. 

  For instance, you might notice that an older page got a big boost in traffic this month. You can then check the traffic sources, where you find that an influential LinkedIn user posted a link to the page. This presents an opportunity to adjust the influencer or social media aspects of your marketing strategy.

  

  Beyond traffic sources, Matomo can provide a visual user journey (also known as User Flow), showing which pages visitors tend to view in a session and even in what order they progress. This gives you a bird’s-eye view of the customer journey.

  Sales

  Just like your marketing team, your sales team can benefit from tracking and analysing website visitor information. Data about user behaviour and visitor demographics helps sales representatives better understand the people they’re talking to. Segmented visitor tracking data can even provide clues as to how to appeal to different buyer personas.

  Sales leadership can use web analytics to gauge interest over time, tie visitors to revenue and develop more accurate sales forecasts and goals. 

  

  And it’s not just aggregated website tracking data that your sales team can use to better serve customers. They can also use insights about an individual visitor to tailor their approach. Matomo’s Visits Log report and Visitor Profiles allow you to see which pages a prospect has viewed. This tells your sales team which products and features the prospect is most interested in, leading to more relevant interactions and more effective sales efforts.

  User experience and web development

  The way users interact with and experience your website has a big impact on their impression of your brand and, ultimately, whether they become customers. While marketing often controls much of a website’s content, the backend and technical operation of the site usually falls to a web development or engineering team. Website analytics and tracking inform their work, too.

  Along with data about website traffic and conversion rates, web development teams often monitor bounce rates (the percentage of people who leave your website entirely after landing on a page) and page load time (the time it takes for an individual web page to load for a user). Besides the fact that slow loading times inconvenience visitors, they can also negatively affect your search engine optimization (SEO).

  

  Along with session recordings, user experience teams and web developers may use heatmaps to find out what parts of a page draw a visitor’s attention and where they are most likely to convert or take some other action. They can then use these insights to make a web page more intuitive and useful.

  Visitor tracking and privacy regulations 

  There are different data privacy standards in other parts of the world, which are designed to ensure that businesses collect and use consumer data ethically. The most-discussed of these privacy standards is the General Data Protection Regulation (GDPR), which was instituted by the European Union (EU) but affects businesses worldwide. However, it’s important to note that individual countries or states can have different privacy laws.

  Many privacy laws govern how websites can use cookies to track visitors. With a user’s consent, cookies can help websites identify and remember visitors. However, many web visitors will reject cookie consent banners. When this happens, analysts and marketers can’t collect information from these visitors and have to work with incomplete tracking data. Incomplete data leads to poor decision-making. What’s more, cookie consent banners can create a poor user experience and often annoy web visitors.

  With Matomo’s industry-leading measures to protect user privacy, France’s data protection agency (CNIL) has confirmed that Matomo is exempt from tracking consent in France. Matomo users have peace of mind knowing they can uphold the GDPR and collect data without needing to collect and track cookie consent. Only in Germany and the UK are cookie consent banners still required.

  Choosing user tracking software

  The benefits and value of tracking website visitors are enormous, but not all tracking software is equal. Different tools have different core functionalities. For instance, some focus on user behaviour over traditional web analytics. Others offer detailed website performance data but offer little in the way of visitor information. It’s a good idea to start by identifying your company’s most important tracking goals.

  Along with core features, look for useful tools to experiment with and optimise your website with. For example, Matomo enables A/B testing while many other tools do not.

  

  Along with users of your website, you also need to think about the employees who will be using the tracking software. The interface can have a big impact on the value you get from a tool. Matomo’s session recording functionality, for example, not only provides you with video but with a colour-coded timeline identifying important user actions.

  

  Privacy standards and compliance should also be a part of the conversation. Different tools use different tracking methods, impacting accuracy and security and can even cause legal trouble. You should consider which data privacy laws you are subject to, as well as the privacy expectations of your users.

  

  Some industries have especially high data security standards. Government and healthcare organisations, for example, may require visitor tracking software that is hosted on their premises. While there are many purely cloud-based software-as-a-service (SaaS) tracking tools, Matomo is available both On-Premise (also known as self-hosted) and in the Cloud.

  Frequently asked questions

  Here are answers to some of people’s most common questions about tracking website visitors.

  Can you track who visited your website ?

  In most cases, tracking your website’s traffic is possible. Still, the extent of the tracking depends on the visitor-tracking technology you use and the privacy settings and precautions the visitor uses. For example, some technologies can pinpoint users by IP address. In other cases, you may only have access to anonymized data.

  Is it legal to track someone’s IP address ?

  It is legal for websites and businesses to track someone’s IP address in the sense that they can identify that someone from the same IP address is visiting a page repeatedly. Under the General Data Protection Regulation (GDPR), IP addresses are considered personally identifiable information (PII). The GDPR mandates that websites only log and store a user’s IP address with the user’s consent.

  How do you find where visitors are clicking the most ?

  Heatmap tools are among the most common tools for learning where visitors click the most on your website. Heatmaps use colour-coding to show what parts of a web page users either click on or hover over the most.

  Unique tracking URLs are another way to determine what part of your website gets the most clicks. For example, if you have three links on a page that all go to the same destination, you can use tracking links to determine how many clicks each link generates.

  Matomo also offers a Tag Manager within the platform that lets you manage and unify all your tracking and marketing tags to find out where visitors are clicking.

  What is the best tool for website visitor tracking ?

  Like most tools, the best website visitor tracking tool depends on your needs. Each tool offers different functionalities, user interfaces and different levels of accuracy and privacy. Matomo is a good choice for companies that value privacy, compliance and accuracy.

  Tracking for powerful insights and better performance

  Tracking website visitors is now a well-ingrained part of business operations. From sales reps seeking to understand their leads to marketers honing their ad spend, tracking helps teams do their jobs better.

  Take the time to consider what you want to learn from website tracking and let those priorities guide your choice of visitor tracking software. Whatever your industry or needs, user privacy and compliance must be a priority.

  Find out how much detail and insight Matomo can give you with our free 21-day trial — no credit card required.