Articles

How to Get GDPR and Customer Communications Right

,

The General Data Protection Regulation (GDPR) was big news for companies when it came into effect in 2018. It aimed to put more controls on how organizations manage the personal data of their EU-based users. Since the law’s enactment in 2018, some US states, such as California and Virginia, followed suit and passed their own data privacy laws for their respective residents. Companies that do business in those regions now have to ensure they comply with these legal requirements.

This post is the third in a series about what developers need to keep in mind when sorting out security and compliance for their application. The first article in this series covered how to build security for user communications, the second was about compliance certifications and regulations for SaaS apps, and this one is all about GDPR and customer communications. GDPR and similar regulations cover all communications from a company to its customers and prospects, including marketing and transactional notifications. If you are considering sending notifications to the users of your SaaS application, whether via email, push, or a Slack bot, you need to keep GDPR in mind when building your service.

Source de l’article sur DZONE

/par

Key and Surface Tracking Comes to Chrome

,

This week Google announced further details of its plan to remove cookies from ad tracking. The strategy, which the ad giant expects to be fully implemented by 2022, has come about due to increasingly stringent privacy laws in a growing number of territories around the globe.

Google’s first step was the announcement in January of FLoC (Federated Learning of Cohorts). Google itself is still testing and fine-tuning the system, but in essence, Google will replace 3rd-party cookies in Chrome with groups of anonymized users.

Critics of the plan have questioned whether users will be genuinely anonymous or whether Google will be tracking individuals to group them properly. The answer came earlier this week in a low-key announcement of KaST.

What is KaST?

KaST (Key and Surface Tracking) is the first iteration of Google’s new tracking technology. It works entirely without cookies and is fully device-agnostic.

The technology behind KaST is surprisingly old. It was first trialed in 1987 as a simple process for auditing the input of stenographers. Although the latest version of the technology draws heavily on voice recognition software algorithms, the original version of KaST — software named TAAA (Typist Account Accuracy Audit) — predates modern voice recognition by at least two years.

KaST uses…biomechanical and cognitive patterns, identifying individual users based on their keystrokes.

Just as your voice has a unique, identifiable modulation — anyone who uses telephone banking will be familiar with speaking their password — so too does your biomechanical input.

When you type on a keyboard or a touchscreen, the force, speed, and accuracy with which you hit characters are dependent on two things: your cognitive process and the unique biomechanics of your hands (the bones, ligaments, and muscles).

For example, when I type WordPress, I almost always type it as WordPRess (with a capitalized R). That is one facet of my combined biomechanical and cognitive process.

KaST uses keyboards and touch screens to track combined biomechanical and cognitive patterns, identifying individual users based on their keystrokes.

Mobile Approaches to KaST

KaST is heavily reliant on BMaC (Bio-Mechanical and Cognitive) input. Although Google hasn’t released any data to support the accuracy of KaST, BMaC is known to be surprisingly accurate.

Reports suggest that the KaST algorithm is 89.7% effective for character strings of 12 characters or more, leaping to 97.6% for 19 characters or more on a single device. That makes it too inaccurate for high-end processes like security but well within the necessary margin of error for a non-critical process like serving ads.

Google will be able to identify you on any machine, on any device, in any context, as soon as you type 19 characters or more

When switching to a touch-screen device, the accuracy plummets to just 87.8%. This may be one reason Google has been low-key in its trumpeting of the new technology so far.

According to TechBeat, initial trials of the tri-axis position of a device (X, Y, and Z rotation) were abandoned as inaccurate. Still, even without those additional tracking signals, Google claims KaST on mobile will achieve ~94% accuracy by the 1st quarter of 2022.

What Does KaST Mean for Users?

Much like many of the algorithms that govern our daily lives, KaST will be largely invisible to most of us. Unlike cookies that can be legislated for and removed from a local machine, your BMaC is as inescapable as your DNA.

Where privacy concerns really grow is that your BMaC follows you from device to device. How you type at home is identical to how you type at work. Your personal and professional profiles are now instantly connectable; Google will be able to identify you on any machine, on any device, in any context, as soon as you type 19 characters or more.

KaST Prompts Pre-M1 MacBook Rush

Within 24 hours of KaST’s announcement, Apple stores were reporting rush orders of pre-M1 MacBook Pros. With some stores reportedly selling out late on Wednesday.

The rush came in the wake of a Reddit post — that has since been removed — that claimed that the notoriously bad butterfly keyboard on pre-M1 MacBook Pros circumvented KaST because the inaccuracy of the keystrokes, and the tendency of the keys to stick introduced a random element that disguised the end-user from the KaST algorithm.

Although the Reddit post is unsubstantiated, it transpires that M1 Mac owners may not be the lucky ones after all.

Should You Worry About KaST?

Advocates maintain that KaST — and Google’s wider FLoC strategy — are beneficial to users and the web as a whole. They claim that identifying users without 3rd party cookies does more to protect privacy than hinder it.

Opponents argue that in a digital world rife with user tracking, privacy compromises of this magnitude cannot be contemplated simply to enable more sophisticated ad-serving.

Despite KaST’s early stages of development, privacy concerns are mounting, and a campaign has been launched to regulate Google’s use of the technology.

Source

The post Key and Surface Tracking Comes to Chrome first appeared on Webdesigner Depot.


Source de l’article sur Webdesignerdepot

/par

10 Best Alternatives to Google Analytics in 2021

,

When you think of installing analytics, you probably reach for Google Analytics. And you wouldn’t be alone. The platform’s tight integration with SEO and the implication that using Google products is beneficial to ranking means that Google Analytics is the most commonly installed analytics solution globally.

Google Analytics isn’t a bad choice: it’s free, it’s fairly comprehensive, and it does indeed tie most SEO efforts up with a nice bow.

But Google Analytics is also slow, extremely bad for privacy — both yours and your users’ — and for many people, it’s too unwieldy, having grown organically over the years into a relatively complex UI.

Some alternatives are fast, privacy-friendly, and geared towards different specialisms. Today we’re rounding up the best…

1. Heap

Heap is an event-based analytics platform. That means you can tell not just how many people visited your site but what actions they took when they were there. This isn’t a unique proposition, but Heap is one of the best implementations.

Heap offers an auto-track tool, which is ideal for new installations because you can get up and running immediately and fine-tune the details later. That makes it great for startups, although it’s also the choice of major corporations like Microsoft.

Heap’s free plan includes 60k sessions per year and 12 months of data history, but when you outgrow that, the business plans start at $12,000/year.

2 ChartMogul

ChartMogul is geared towards SaaS that offer subscription plans, staking a claim as the world’s first subscription data platform.

Services like Buffer and Webflow use ChartMogul to monitor their revenue and analyze the ROI of changes to their features, design, and user experience.

Ideally suited for startups, ChartMogul pricing is based on monthly recurring revenue; it has a free plan for up to $10,000 MMR; after that, pricing starts at $100/month.

3. Fathom

Fathom is an awesome, privacy-first analytics solution. It offers a simple dashboard and is ideal for anyone looking for simple analytics information to verify business decisions.

Fathom is ideally suited to freelancers, or entrepreneurs with multiple projects, as it allows you to run multiple domains from a single account. Fathom is entirely cookieless, meaning you can ditch that annoying cookie notice. It’s GDPR, ePrivacy, PECR, CCPA, and COPPA compliant.

There’s a seven-day free trial; after that, Fathom starts at $14/month.

4. FullStory

FullStory is designed to help you develop engaging online products with an emphasis on user experience.

FullStory is a set of tools, making it ideal for large in-house teams or in-house teams working with outside agencies or freelancers. It pitches itself as a single source of truth from which everyone from the marketing department to the database engineers can draw their insights, helping digital teams rapidly iterate by keeping everyone in the same loop.

FullStory uses AI to track and interpret unexpected events, from rage clicks to traffic spikes, and breaks those events down to a dollar-cost, so you can instantly see where your interventions will have the most impact.

There’s a free plan for up to 1k sessions per month; once you outgrow that, you need to talk to the sales team for a quote.

5. Amplitude

Amplitude has one of the most user-friendly dashboards on this list, with tons of power behind it. For project managers trying to make science-based decisions about future development, it’s a godsend.

The downside with Amplitude is that to make the most of its powerful data connections, you need to pump a lot of data in. For that reason, Amplitude is best suited to sites that already have a substantial volume of traffic — among those customers are Cisco and PayPal.

Amplitude provides a free plan, with its core analytics and up to 10m tracked actions per month. For premium plans, you have to contact their sales team for a quote.

6. Mixpanel

Mixpanel is a little bit more than an analytics program, aiming to be a whole suite of web tools it has ventured into split testing and notifications.

Mixpanel is laser-focused on maximizing your sales funnel. One look at the dashboard, and you can see that Mixpanel, while very well designed, has too many features to present them simply; Mixpanel is ideally suited to agencies and in-house development teams with time to invest — you probably want to keep the CEO away from this one.

Mixpanel has a generous free plan for up to 100k monthly users, with its business plans starting at $25/month.

7. Mode

Mode is a serious enterprise-level solution for product intelligence and decision making.

Ideally suited to in-house teams, Mode allows you to monitor financial flow and output the results in investor-friendly reports. You can monitor your entire tech stack and, of course, understand how users are interacting with your product. Wondering who handles the analytics for Shopify? That would be Mode.

Mode has a free plan aimed at individuals, but this tool’s scope is really beyond freelancers, and the free plan’s only likely to appeal to high-price consultants and tech trouble-shooters. For the full business plan, you need to contact Mode’s sales team for a quote.

8. Microanalytics

Microanalytics is a relatively new analytics program with a lightweight, privacy-focused approach.

Microanalytics provides a simple dashboard with acquisitions, user location, technology, and the all-important event tracking to monitor user behavior. Microanalytics is compliant with the web’s most stringent privacy laws, including GDPR, PECR, and CCPA. The tracking code is just 1kb in size, meaning that you’ll hardly notice its footprint in your stats.

Microanalytics is free for up to 10k pageviews/month; after that, the monthly plan starts at $9.

9. GoSquared

GoSquared is another suite of tools, this time aimed at SaaS. Its primary product is its analytics, but it also includes live chat, marketing tools, and a team inbox.

If you’re tired of comparing multiple tools to help make the most of your startup, GoSquared kills several birds with one stone. Perhaps most importantly, if you’re beginning to build a team and don’t have any engineers onboard yet, GoSquared has an award-winning support team and an idiot-proof setup process.

GoSquared has a free plan that’s fine for evaluating the suite and integrating data from day one. As you begin to grow, paid plans start at $40/month.

10. Segment

Segment is a little different from the other analytics tools on this list; Segment is a layer that sits between your site and your analytics. It integrates with many of the tools on this list.

There are several benefits to this approach. The main one is that different teams within your enterprise can access analytics data in a form that suits them — designers can access complex data, and management can stick to revenue flow. It also means that you can switch analytics programs with a single setting in Segment and even migrate historical data into new apps. If you’re an enterprise that wants to future-proof its customer intelligence gathering, Segment is worth considering.

Segment is trusted by some of the web’s best-known names, from IBM to Levis, and…ahem…Google.

Segment is free for up to 1k visitors per month, and after that, the team plan starts at $120/month.

Source

The post 10 Best Alternatives to Google Analytics in 2021 first appeared on Webdesigner Depot.


Source de l’article sur Webdesignerdepot

/par

Everything You Need to Know About Websites And Privacy Laws

,

When it comes to compliance, website developers need to keep their eyes on more than just ADA regulations and Section 508. Privacy laws are a big consideration and decisions on how to build privacy into a website start with architects. 

And that’s exactly what website developers (and designers!) are. They build up attractive, functional websites and apps for their clients. Yes, they work closely with clients, copywriters, vendors, and other professionals to get the job done, but the developers are the ones who put it all together. 

That’s why it’s critical that website developers are well-versed in marketing privacy laws — these regulations directly impact the end results of their work. But how does a website architect create a digital platform that honors both user privacy and the needs of their clients? 

What Privacy Laws Are Important For Web Developers?

The two biggest privacy laws that web developers need to keep tabs on are the General Data Protection Regulations (GDPR) and the California Consumer Privacy Act (CCPA). Each law has its own unique scope and provisions, but they both shifted the landscape in defining an individual’s rights to their personal data and set mechanisms for how these rights would be protected and enforced.

Each regulation also carries with it fines, fees, and legal measures for non-compliance. These can be substantial. And if that’s not enough, there’s an ever-increasing consumer demand for websites that prioritize privacy and security. Consider these statistics:

  • 82% of Americans surveyed say they are concerned about the security of their online data
  • 79% of adults claim they are very or somewhat worried about how companies use the data they collect about them
  • 63% of Americans believe they understand very little or nothing at all about privacy laws and regulations that are intended to protect their data

How Can Developers Implement These Laws?

Privacy by Design is Critical for Websites

Under GDPR, web developers are required to adopt the Privacy by Design framework, which is a multi-point methodology intended to standardize data protection measures. 

Building privacy into websites shouldn’t happen at the end stages. It should start with how the websites are conceptualized in the first place. Here are points to prioritize:

  • Minimize that data you’re collecting and pseudonymize it to protect data privacy
  • Are you capturing consent? How? Where?
  • Integrating security measures to protect data — anytime you capture data or implement a third party product, a security risk is born.
  • Knowing where you’re introducing privacy and data sharing notices
  • Implement just-in-time notices to provide consumers transparency and build trust 
  • Giving your users the opportunity to manage their personal data

Let’s look at these a little more closely…

Data Minimization is the Goal

Data minimization is an important principle embedded in GDPR. Data minimization itself is a pretty straightforward concept: organizations should limit how much personal data they collect and only process the information necessary to accomplish their business purposes. Once the data is no longer useful, it should be deleted. 

For web developers, this means several things. When it comes to building websites, forms, cookies, and other methods should only ask for essential information. For example, if you are creating a pop-up to collect email addresses, don’t ask for their location unless it’s relevant to the email list and better serving their needs.

How and Where Do You Introduce Privacy Policies and Notices?

Let’s say you take data minimization seriously. That’s great! Now you need to put those data collection practices into words and share them with your customers. 

Privacy policies and notices are a big part of both GDPR and CCPA. Both the CCPA and the GDPR mandate that your privacy policy detail why you’re collecting information and how it will be used, as well as what the individual’s rights are and how they can exercise them. 

CCPA takes a slightly different angle, requiring privacy policies to disclose if the business sells personal data and what third parties have access to the data. CCPA also dictates that privacy policies and notices are current, updated at least annually.  (Nota bene: GDPR also asks for updated privacy documents, but doesn’t specify frequency.) 

How does this translate from policy into web development?

  • If you’re collecting data to improve user experience, allow for targeted ads, or sharing information with third-parties, this information will need to be included in a privacy notice. Remember, CCPA works with a broad definition of selling data, so you may need to account for a “Do Not Sell” link on your home page. 
  • Considering using data beyond these purposes? Plan to obtain explicit user consent for each additional purpose.
  • What’s your plan for the data after the user gives it to you? Where is it stored? Who has access to it? How long are you keeping it? These are all questions that a website developer should consider, and that needs to go into a privacy notice. 

Just-in-Time Notices for Transparency and Trust

Part of Privacy by Design is the use of individual components of your website to create transparency and support compliance. From a development and design perspective, this means you should always be looking for ways to communicate the hows and whys of data collection. 

Yes, your privacy policies and notices aid in this, but going beyond these pieces is important. Customers recognize when businesses go the extra mile for them, after all. 

So consider implementing just-in-time notices at points where users enter their information. These notices are a chance to share your data collection practices with your users. It’s transparent! It’s open! It aids in consumer awareness! 

Keep Users in the Loop

Want to win over your customers? Make it as easy as possible for them to manage their personal data and how it’s being used. This starts with making sure they are aware of why you’re requesting their information and how you’re planning on using it for the website. You should also:

  • Get user consent — clear and unambiguous user consent — prior to gathering any data at all. This includes cookies.  
  • Don’t pre-tick boxes for consent. Just don’t. (It’s bad practice AND it’s against GDPR.)
  • Link to all legal documents on the site. Users should be required to agree to them before using the service. 
  • Want to send marketing communications like email newsletters to your customers? Make sure they agree to this. Expressly. 

One helpful tool for keeping users in the loop is a marketing preference center. A marketing preference center allows users easy access to their information. From there, they can manage, edit, and delete their information at their discretion.  

Bonus? A marketing preference center is an excellent point at which to communicate a business’ commitment to privacy. While users will pick up this through all the discrete elements of privacy on your website, putting it all into one hub that also allows users control over their data really reinforces this message. 

Remember, it’s not just on the consumer to manage their data. Web developers should commit to managing the data in their systems. This means they should:  

  • Maintain accurate and clean records of users’ data consent preferences
  • Send regular reminders to users to update their personal information in your system
  • If a user deletes their account, promptly delete all of their personal information  
  • If your client goes out of business or is sold, they should delete all personal information in their system

Make it User Friendly

A final point: making your websites user friendly is important regardless of privacy compliance. Users expect websites that don’t make them think deeply about, or worry about, their privacy. Make it accessible and easy. Don’t make people figure it out on their own.

Give them value for sharing their data

Your users don’t have to share their data. They’re choosing to. So in exchange for their personal information, make sure you’re using it to provide a user-friendly website. Offer them a secure, enjoyable experience.  

But don’t ask for more than you need

Let’s loop back around to this point again. While consumer data can help you build a better website, don’t plan your websites around it and don’t demand data to create a good experience. 

Usability, web design, and website security; all of these things benefit from consumer data. But privacy laws should always guide how any personal data is collected and used, and respect for consumers’ individual rights, and honoring their privacy should be top-of-mind for web developers. 

 

Featured image via Pexels.

Source


Source de l’article sur Webdesignerdepot

/par

Why PSI, DP, and SMC Are the Future of Data Privacy

,

Privacy regulations like GDPR and CCPA are changing the way data is collected and used. Data-driven organizations use data collaboration to understand their customers and research organizations that rely on data collaboration to advance research are being restricted. As more privacy regulations come online, what can organizations do to future-proof their use of data, whilst still adhering to privacy regulations?

Technology is now available that will allow organizations to continue to collaborate without ever exposing or moving the underlying data. 

Source de l’article sur DZONE

/par