Do newsrooms and media sites always understand the full implications of the data collection habits of their analytics software providers? Thanks to the murky world of ad-tech, publishers have to be vigilant about their understanding of every type of third-party software. Even well-intentioned applications can put readers’ personal information at risk.

Melody Kramer, a columnist for Poynter and a veteran of digital media, was alarmed enough by these breaches to propose a series of questions she recommended companies make sure to ask vendors before using their service. At Parse.ly, we often get asked about what features we offer, however, sometimes the people that know the needs of their newsroom for analytics software don’t realize the needs of their audience’s privacy.

As a company, it’s important to us that companies understand how we approach analytics and privacy because we believe that the modern equivalent of the Gutenberg Press in the web era is a keen understanding and application of data. Applying data to use in your operations and strategy well means committing  to analytics and privacy without compromise, so in a series of posts, we’ll be  answering Kramer’s questions, as well as providing tips on what to look for when evaluating other software products.

Addressing Third-Party Data Concerns: Part I

In the original piece some of these questions were combined. For clarity, we’ve broken them up here.

Q1: Has my newsroom properly vetted and assessed other options before deciding on this tool?

A1: Software users often assume they’ve vetted all the options by comparing features and prices of their various options. However, to set the stage for the rest of these questions, we encourage sites considering Parse.ly (or any other software) also assess how vendors rank when it comes to values, like privacy.

For example, on a feature by feature or price comparison, we can assure you that Google Analytics will “beat” Parse.ly but usually the reason companies work with Parse.ly isn’t because Google Analytics doesn’t have enough features – or because they’re sick of the free price tag!

However, with those features and free model, Google makes it hard to access that information for your newsroom, while using your audience data to improve their other paid products, like AdWords.

Since you are reading these questions and answers – make sure you ask them to vendors! Even if the answers are what you expect, how a company responds to them can tell you a lot about how they’ll work with you as a client. If during the vetting process certain companies won’t give you straight answers, don’t expect you’ll be able to get them later. You’re entering into a relationship with these providers, and the way they treat you and your audience’s privacy matters.

Q2. Have we considered all of the ethical implications?

A2: If you need a primer in what ethical implications you should be aware of when thinking about analytics software and adtech, we recommend Josh Stearns’ When News Reads You Back: Why Journalists Need to Stand Up for Reader Privacy. The article that originally posed  these questions, Melody Kramer’s Before Using a Third-Party Tool, Publishers Should Ask Themselves These Questions, also  goes into more detail about why these questions are important.

Your  organization may have specific  ethical implications you need to consider. Any third-party vendor you work with should be willing to accommodate you. Take for example, one of our client’s, The Intercept, mission statement:

The Intercept, launched in 2014 by Glenn Greenwald, Laura Poitras and Jeremy Scahill, is dedicated to producing fearless, adversarial journalism. We believe journalism should bring transparency and accountability to powerful governmental and corporate institutions, and our journalists have the editorial freedom and legal support to pursue this mission.

The Intercept has made sure that any relationships with third-parties it creates also supports this mission. They decided to work with Parse.ly in a way that would satisfy their need for reader privacy with their need for information about their audience’s interests.

Q3: What data is the third-party tool or platform allowed to collect? If that changes, who makes that decision? How long is the data stored?

A3: We’ll tackle these two in reverse order. By default, Parse.ly collects two years worth of data. Publishers can work with us to store more or less, though storage beyond two years of data is an additional cost to the client. This arrangement is included in the contract between Parse.ly and our clients, so any change to it would involve a change in contract terms.

As for the data we collect, the Parse.ly Tracker is a small piece of JavaScript code that monitors user actions taken on your site and relays them to the Parse.ly analytics server. You can read more about what data we’re collecting in our technical documentation, but a list of the items is also below.

Data Collected by Parse.ly’s Analytics Software

idsite	your Parse.ly API key
date	ISO 8601 encoded event datetime string
ip_address	IP address of the visitor
url	URL of the page being viewed
urlref	referring URL
screen	Client device resolution: x
action	Event type. Currently only pageview is supported
data	user identifier, anonymized

Optional  Data

title	Page title, optional.

We also outline what we collect and store in our privacy policy:

We may collect and store Anonymous Information about you, including your Internet protocol address, domain names, browser, device type, access times, and the web pages you view. When doing so, we may also use Cookies (as defined below), web bugs and navigational data like Uniform Resource Locators (URLs) to gather information regarding the date and time of your visit, your geo-location (from your IP address).

Parse.ly will have no obligation to, and Parse.ly agrees that it will not intentionally collect any personally identifiable information of users and visitors of the Monitored Domains (“PII”) in connection with the Parse.ly Service.

For services that do collect personally identifiable information about your users, you should be asking additional questions about the security of that information and how it will be used by the third-party.

Q4: How does a third-party tool or platform support a publisher who no longer wants to use the tool?

A4: If a client decides to no longer use Parse.ly, their data can be kept for up to two years by default. We do this in case a client needs to reactivate their service (i.e. their budget got cut one year, and then six months later they’re able to reinstate service). Data can be deleted upon request of the client.

We consider the data collected by an analytics service to be the property of the client, while the software is the property of the third-party. We do not own our clients data, and treat it as such if  a client relationship ends. Make sure to find out who “owns” the data when working with third-parties.

Q6: If the third-party tool or platform works with many news organizations, is my data secure or is there a chance it is being shared with others? If so, am I being informed?

A6: Your data is not being shared with any other organizations, period. The only people that have access to your data outside of those you give explicit access to through usernames and passwords are  Parse.ly employees as needed for product maintenance, troubleshooting, etc.

Because Parse.ly is used as the analytics software for so many media and news organizations, research using aggregate, anonymized data allows us to uncover network wide trends. We hope this information helps not only our clients, but the digital media industry at large. The macro picture of online news production and consumption is rapidly changing, and these network-wide reports can help sites put themselves in context of the bigger picture. This information is shared publicly, as in this recent Pew Research Report and our Authority Reports.

http://www.journalism.org/2016/05/05/long-form-reading-shows-signs-of-life-in-our-mobile-news-world/pj_2016-05-05_long-form-01/

Q7: Can I adapt or modify the privacy policy of the third-party tool or platform? Do I need to put their privacy policy on my website? How will I inform users?

A7: Our privacy policy cannot be adapted or modified. However, sites can create their own privacy policies that strengthen the guarantees in ours. We also welcome questions and comments about the privacy policy from clients or potential clients.

Informing users of your site’s use of analytics can be done publicly, as with an announcement like the Intercept’s (above) or a press release. Other ways to be transparent about your use of analytics software is to inform your audience how you are  using the systems as in these posts from Gatehouse Media  or this site update from David Stern of Slate. Finally, including a link to our privacy policy on your site to allow users to opt-out of tracking is a best practice we encourage.

Q8. If there is a data breach of the third-party tool or platform, how would we be informed?

A8. To date, there has been never been a data breach at Parse.ly. We train our staff on best practices to avoid hacking, we hire top-notch devops people, and we continue to invest in security over time.

If there were a data breach, we would reach out to all account admins immediately, and alert users directly in our platform’s dashboard.

Q9. Is the third-party tool or platform sharing data with other parties? What if it’s sold?

A9. Per our terms, personally identifiable information is never collected. Privacy-sensitive parts of site traffic data is collected, but is never shared at a granular level with third parties, and certainly never sold. From time-to-time, we produce anonymized, network-wide data samples for the purpose of research (not advertising), e.g. our recent collaborative study with Pew Research.

How confident that all the third-party systems you use can answers these questions in a way that protects your audience? See the remaining questions and  answers in this post.