Download as PDF, PPTX
![PII detection
Quick Test
1. Email
[a-zA-Z0-9_.-]+(@|%40) [da-zA-Z.-]+.[a-zA-Z.]{2,6}
2. IP_address
^([0-9]+.){3}[0-9]+$
Source: www.cardinalpath.com/what-you-need-to-know-about-google-analytics-personally-identifiable-
information/](https://image.slidesharecdn.com/blackhat4-maythe25thbewithyou-180512122718/85/Blackhat-Analyics-4-May-the-25th-be-with-you-27-320.jpg)
![PII prevention filters
PP01: TidyURL - Replace email with EMAIL-OBFUSCATED-BY-
FILTER@gmail.com
URL (.*?)(=|%3D)([a-zA-Z0-9_.+-]+(@|%40)[a-zA-Z0-9-
]+.[a-zA-Z0-9-.]+)($|&.+)
Output URL $A1=EMAIL-OBFUSCATED-BY-FILTER@gmail.com$A5
PP02: Tidy EventLabel - Replace email with EMAIL-OBFUSCATED-BY-
FILTER@gmail.com
EventLabel (.*?)(=|%3D)([a-zA-Z0-9_.+-]+(@|%40)[a-zA-Z0-
9-]+.[a-zA-Z0-9-.]+)($|&.+)
Output EventLabel $A1=EMAIL-OBFUSCATED-BY-
FILTER@gmail.com$A5](https://image.slidesharecdn.com/blackhat4-maythe25thbewithyou-180512122718/85/Blackhat-Analyics-4-May-the-25th-be-with-you-28-320.jpg)
![Generic PII exclude params
email, emailAddress, clientEmailAddress, Username, postCode, mac, oldPassword,
password, password_confirmation, regCode, username, username_confirm,
signin[username], signin[runas], signin, sign_in, conf, gpid, obem, inf_contact_key,
user_id, userId, username1, frmUsername, nickName, qz_user_name, url_mac,
Email, email, mail, MAIL, feedback_email, newEmailAddress, newemailaddress,
emailAddress, emailaddress, recipientName, recipientEmail, MMDB_ID, mmdb_id,
EMAIL_ID, email_id, email[body], email[subject], interaction[email], interaction[name],
CVC_M1RSUBNM, CVC_M1RADDR1, CVC_M1RADDR2, CVC_M1RCITY,
CVC_M1RSTATE, CVC_M1RCTRYC, CVC_M1RZIP, CVC_M1REMAIL,
CVC_M1RTACCT, MSRSUBNM, MSRADDR1, MSRADDR2, WESCITY,
WESSTATE, WESZIP, MSREMAIL, Name, selectedAddress, selectedAddres_0,
selectedAddres_1, selectedAddres_2, selectedAddres_3, selectedAddres_4,
selectedAddresSize, Address1, Address2, City, State, Zip, zipcode, qz_user_country,
state, oauth_token, oauth_verifier, rptregcta, rptregcampaign, nickName,
selectedAddress, username1, frmUsername, mac_address, username, password,
login, firstName, lastName, payerName, street, city, country, zipCode, payerEmail,
email, rfemail, rflogin, login, PayerID, user](https://image.slidesharecdn.com/blackhat4-maythe25thbewithyou-180512122718/85/Blackhat-Analyics-4-May-the-25th-be-with-you-29-320.jpg)
![Light Score
1. Do you have a Privacy Policy? +1
2. Do you link to Privacy Policy on global footer(or header) try.powermapper.com +1
3. HTML links on Privacy Policy:
• Do you mention you use cookies OR link to “How Google uses cookie data“
www.google.com/policies/privacy/partners/ +0.25
• Do you mention the word “Do Not Track” or DNT on privacy policy +0.25
• Link to GA opt-out plugin OR GA opt-out page +0.25
• Link to DoubleClick remarketing opt-out OR Adchoices link +0.25
4. Has your Privacy Policy has been updated within the last 12months +1
5. If your using session recording (e.g. ClickTale) have you set sensitive fields to either
type=password OR have relevant class: <input id="CreditCardPin" class="tracking-
sensitive ClickTaleSensitive -metrika-nokeys“type="text"> +1
6. Is AnonymiseIP enabled for EU Visitors +1
7. Is GTM`s 2 stage authentication login setting enabled OR similar TMS setting +1
8. Do you have a GA custom email alert for URLs containing “@” or “@gmail” +1
9. GA exclude traffic from robot setting is enabled +1
10.You have actioned atleast one GA heathcheck alert +1
Ref: www.google.com/analytics/terms/us.html
[n] / 10](https://image.slidesharecdn.com/blackhat4-maythe25thbewithyou-180512122718/85/Blackhat-Analyics-4-May-the-25th-be-with-you-48-320.jpg)
![Dark Score
1. 3rd party cookies are being deployed on your website -1
2. Have not enable frequency capping on Display network -1
3. UserID tracking is enabled, but not declared to users on privacy page.
4. GA`s data append via CSV upload (dimension widening) for userID as a
customDimension using sensitive data (e.g. Financial grouping/status
based on users postcode/address) -1
5. Using Device Signature (Android App only) -1
6. Email address stored in GA url report -1
7. Storing passwords in GA URL report -1
8. Respawn of users sessionID cookie, after the user tries to clear cookie -1
9. Using any of the techniques mentioned on evercookie -1
10.Using opt-in ClickJacking to install a trojan virus -100
[n] / 10](https://image.slidesharecdn.com/blackhat4-maythe25thbewithyou-180512122718/85/Blackhat-Analyics-4-May-the-25th-be-with-you-51-320.jpg)
Uploaded byPhil Pearce
Blackhat Analyics 4: May the 25th be with you!
Phil Pearce provides a summary of key points about the General Data Protection Regulation (GDPR) and steps for compliance. Some of the major changes under GDPR include higher fines for non-compliance, expanded definitions of personal information, and requirements for consent. Phil outlines settings to make in Google Analytics and Google Tag Manager to comply with GDPR, including disabling remarketing and IP anonymization. He also discusses privacy policy updates, supplier contracts, and automated health checks to monitor compliance.
More Related Content
Similar to Blackhat Analyics 4: May the 25th be with you!
Blackhat Analyics 4: May the 25th be with you!
- 1. BlackHat Analytics 4: Maythe 25th be with you
- 2. #MeasureCamp @philpearce Web Analytics Exchangementor 750 GA questions answered Tracking protection group (DNT) Welcome Phil Pearce Analytics Expert & Master of the Dark Arts Accelerate-Agency.com @philpearce linkedin.com/in/philpearce
- 3. Just a quickLeia Disclaimer... #SPWK @philpearce I`m not her!
- 4. Ask my brother instead... #SPWK@philpearce Or consult your Leia council
- 5. Blackhat Analytics Summary 1. Inbalance:Reason behind GDPR 2. PERC vs GDPR: whats changed? • Fines • PI definitions 3. Jedi Training: Steps to be Compliant • Vendor Settings • Script Settings • CMS plugins • Privacy policy changes • Supplier Contracts 4. Checklist 5. Take aways #SPWK @philpearce
- 6. A long timeago... …or about 6 light years ago to be precise!
- 7.
- 9.
- 11. Don’t panic… ...I haveseen a vision of your future
- 12.
- 13. 2 Strikes… beforefine For any new law… there will be a grace period to account for accidental non-compliance or to give large enterprise time to adjust their systems
- 14. Expect lots ofCraziness before 25th May!
- 15. Before things returnto normal
- 16. Before things returnto normal
- 17.
- 18. PERC vs GDPR PERCGDPR IP Address Not personal data Personal Data UserID Not personal data Personal Data TransactionID Not personal data Personal Data Cookie Identifier Not personal data Personal Data Device Signature Not personal data Personal Data Standardisation Different in EU countries Harmonised Across EU Charge for Subject Access Request £10 Free Max fine £500,000 £17,500,000
- 19.
- 20.
- 21. Ouch! The privacypolice just got handed a giant stick!
- 22. How to avoidbeing fined… Principles… 1. Notify & provide reason for data collection 2. Allow users to View/Edit/Delete their data 3. Special Categories of Data require Consent 4. Consent must be Pro-active tickbox 5. Any financial decision based on user-data must have consent, such as pricing personalisation
- 23. GA settings Never DeleteGA Events and PageURLs setting… aka don’t expire…
- 24.
- 25. Add Address andContact for the DPO in your organisation
- 26. PII safeguards …to preventGA account deletion!
- 27. PII detection Quick Test 1.Email [a-zA-Z0-9_.-]+(@|%40) [da-zA-Z.-]+.[a-zA-Z.]{2,6} 2. IP_address ^([0-9]+.){3}[0-9]+$ Source: www.cardinalpath.com/what-you-need-to-know-about-google-analytics-personally-identifiable- information/
- 28. PII prevention filters PP01:TidyURL - Replace email with EMAIL-OBFUSCATED-BY- FILTER@gmail.com URL (.*?)(=|%3D)([a-zA-Z0-9_.+-]+(@|%40)[a-zA-Z0-9- ]+.[a-zA-Z0-9-.]+)($|&.+) Output URL $A1=EMAIL-OBFUSCATED-BY-FILTER@gmail.com$A5 PP02: Tidy EventLabel - Replace email with EMAIL-OBFUSCATED-BY- FILTER@gmail.com EventLabel (.*?)(=|%3D)([a-zA-Z0-9_.+-]+(@|%40)[a-zA-Z0- 9-]+.[a-zA-Z0-9-.]+)($|&.+) Output EventLabel $A1=EMAIL-OBFUSCATED-BY- FILTER@gmail.com$A5
- 29. Generic PII excludeparams email, emailAddress, clientEmailAddress, Username, postCode, mac, oldPassword, password, password_confirmation, regCode, username, username_confirm, signin[username], signin[runas], signin, sign_in, conf, gpid, obem, inf_contact_key, user_id, userId, username1, frmUsername, nickName, qz_user_name, url_mac, Email, email, mail, MAIL, feedback_email, newEmailAddress, newemailaddress, emailAddress, emailaddress, recipientName, recipientEmail, MMDB_ID, mmdb_id, EMAIL_ID, email_id, email[body], email[subject], interaction[email], interaction[name], CVC_M1RSUBNM, CVC_M1RADDR1, CVC_M1RADDR2, CVC_M1RCITY, CVC_M1RSTATE, CVC_M1RCTRYC, CVC_M1RZIP, CVC_M1REMAIL, CVC_M1RTACCT, MSRSUBNM, MSRADDR1, MSRADDR2, WESCITY, WESSTATE, WESZIP, MSREMAIL, Name, selectedAddress, selectedAddres_0, selectedAddres_1, selectedAddres_2, selectedAddres_3, selectedAddres_4, selectedAddresSize, Address1, Address2, City, State, Zip, zipcode, qz_user_country, state, oauth_token, oauth_verifier, rptregcta, rptregcampaign, nickName, selectedAddress, username1, frmUsername, mac_address, username, password, login, firstName, lastName, payerName, street, city, country, zipCode, payerEmail, email, rfemail, rflogin, login, PayerID, user
- 30. GTM Accept GDPR AnnonIP CD20 forconsent CD19 for consentTimeStamp 2year to 1.5yr cookie Disabled Remarketing non-loggined new users IP resolves to EU
- 31. Tick this box Securelogins
- 32. GTM user accessaudit See actual audit here.
- 33. Conditionally disabled Remarketing viaGTM… bit.ly/2IxMKRt
- 34. Right to Beforgotten
- 35. Right to Beforgotten
- 36. Privacy Policy pageupdates Opt-out links Subject Access mailto or deletion request
- 37.
- 38.
- 39. Email 1. IP matchto EU 2. .co.uk et al email extension matched to EU
- 40. Breach notification http://en.wikipedia.org/wiki/Data_breach http://www.symantec.com/content/de/de/about/downloads/press/2010_annual_study.pdf PII`s data sucked-out from exposed servers! Companiesmust notify DPA within reasonable amount of time, but not (currently) obligated to notify public!
- 41.
- 42. Mistakes to avoidimplementing 1. Mobile popups 2. Asking for consent on Newsletters 3. Triggering Adwords pop-up on landing page cpc fine 4. Asking users in China or USA for consent 5. Excessively confusing pop-ups
- 43. Automatically monitoring & enforcementof the system. aka Automatic “Health checks”
- 44.
- 45. Imperial Durnt, durnt, durnt…durnt, dan ner! External Feedback mechanism
- 46. Google Adwords privacycpc tax SSL as ranking signal SERP ranking organic bonus. Google “trusted stores” program Note: See “Privacy as a ranking factor slides” and TrustFactor video.
- 47.
- 48. Light Score 1. Doyou have a Privacy Policy? +1 2. Do you link to Privacy Policy on global footer(or header) try.powermapper.com +1 3. HTML links on Privacy Policy: • Do you mention you use cookies OR link to “How Google uses cookie data“ www.google.com/policies/privacy/partners/ +0.25 • Do you mention the word “Do Not Track” or DNT on privacy policy +0.25 • Link to GA opt-out plugin OR GA opt-out page +0.25 • Link to DoubleClick remarketing opt-out OR Adchoices link +0.25 4. Has your Privacy Policy has been updated within the last 12months +1 5. If your using session recording (e.g. ClickTale) have you set sensitive fields to either type=password OR have relevant class: <input id="CreditCardPin" class="tracking- sensitive ClickTaleSensitive -metrika-nokeys“type="text"> +1 6. Is AnonymiseIP enabled for EU Visitors +1 7. Is GTM`s 2 stage authentication login setting enabled OR similar TMS setting +1 8. Do you have a GA custom email alert for URLs containing “@” or “@gmail” +1 9. GA exclude traffic from robot setting is enabled +1 10.You have actioned atleast one GA heathcheck alert +1 Ref: www.google.com/analytics/terms/us.html [n] / 10
- 49. Force Rankings: Make anote of your Light score
- 50. Darkness and the Light- scorings 10 Yoda 6-8 Luke 3-5 Leia 0-2 Chewbacca 0 Neutral Zone - 0-2 Darth Maul - 3-5 Count Dooku - 6-8 Darth Vader - 10 Darth Sideous Light score -
- 51. Dark Score 1. 3rdparty cookies are being deployed on your website -1 2. Have not enable frequency capping on Display network -1 3. UserID tracking is enabled, but not declared to users on privacy page. 4. GA`s data append via CSV upload (dimension widening) for userID as a customDimension using sensitive data (e.g. Financial grouping/status based on users postcode/address) -1 5. Using Device Signature (Android App only) -1 6. Email address stored in GA url report -1 7. Storing passwords in GA URL report -1 8. Respawn of users sessionID cookie, after the user tries to clear cookie -1 9. Using any of the techniques mentioned on evercookie -1 10.Using opt-in ClickJacking to install a trojan virus -100 [n] / 10
- 52. Force Rankings: Make anote of your Dark score
- 53. Darkness and the Light- scorings 10 Yoda 6-8 Luke 3-5 Leia 0-2 Chewbacca 0 Neutral Zone - 0-2 Darth Maul - 3-5 Count Dooku - 6-8 Darth Vader - 10 Darth Sideous Light score Dark Score - -
- 54. Now: Light Score -Dark score = Actual score
- 55. Darkness and the Light- scorings 10 Yoda 6-8 Luke 3-5 Leia 0-2 Chewbacca 0 Neutral Zone - 0-2 Darth Maul - 3-5 Count Dooku - 6-8 Darth Vader - 10 Darth Sideous Light score Dark Score Sum of both - - -
- 56.
- 57. If you gota dark score join these… “MOA code of conduct” or “DAA code of ethics” will eventually introduce one www.digitalanalyticsassociation.org/codeofethics www.moaweb.nl/Richtlijnen/internationale-gedragscodes-en-richtlijnen/2012-09-17%20GRBN%20Code%20Comparison.pdf/view
- 58. Thanks & Questions #SPWK@philpearce
- 59. Links to resources GDPRvideo playlist https://www.youtube.com/watch?v=PMHO2T1p0g8&index=68&list=PL45AABD8BB96D3785&t=0s CookieLaw video playlist https://www.youtube.com/playlist?list=PL45AABD8BB96D3785 checklist https://www.omnisend.com/blog/gdpr-for-ecommerce-definitive-guide-free-gdpr-checklist/ essentials blog post by webguild https://www.thewebguild.org/news/gdpr-essentials-for-web-developers-and-site-owners post on GooglePlus https://plus.google.com/u/0/+StephaneHamel-immeria/posts/YcnrmoQQpT4 GDPR view by a marketer https://www.portent.com/blog/internet-marketing/gdpr-29-things-marketers-must-know.htm vendor - HotJar Webinar https://www.hotjar.com/privacy/gdpr-compliance-with-hotjar-webinar vendor - WooCommerce https://woocommerce.com/2017/12/gdpr-compliance-woocommerce/ GDPR supplier template http://bit.ly/gdpr-supplier-contract
- 60.
- 61. Watch this video Alink to the video is here.
- 62.
- 63.
- 64.
- 65. Tick this box Nowyou can...
- 66. Thanks from Philthe Analytics Adventurer