Spy tracking in Martin's Money email

thelawnet

Is this really necessary?

(found in the source of 'Martin's Money Tips')

http://tracking.moneysavingexpert.com:80/track?
mailingid=1052&messageid=1302
&databaseid=604&type=open&serial=xxxxx
&emailid=xxxx&userid=xxxx&extra=&&&

(personal identifying data removed.)

It directly contradicts the claim here:
http://www.moneysavingexpert.com/site/privacy-policy
that "Except in the limited circumstances mentioned below, we do not collect your personal information when you enter or use our site."

It also contradicts this claim:

"We do not share your e-mail address with 3rd parties and your e-mail address will never be sold onto a 3rd party. Your e-mail address will be stored in a secure Database hosted in a secure site."

the email-address is transmitted in plain text over the internet, and would be logged by any proxy servers (such as in an office environment, or on a public wifi point) that you might be behind.

bigpound

I think this is simply to let them know who is reading their newsletters. If you are on an insecure workstation or in a public place where the links you visit are logged for others to see, that is your problem. Or am I missing something??

thelawnet

bigpound wrote: »

I think this is simply to let them know who is reading their newsletters. If you are on an insecure workstation or in a public place where the links you visit are logged for others to see, that is your problem. Or am I missing something??

The privacy policy?

Right below where it says 'Get this weekly email' the 'Privacy Policy' is linked. It's obviously relevant to subscribing to the email. So that Privacy Policy would disclose that they are tracking people's behaviour, specifically exactly who reads the emails, at what time, at what location, and so on.

Generally speaking people dislike their behaviour being tracked. I for one think it is nobody's business but my own what I do or do not read, and will reject any 'read receipts' and the like. You are, at a bare minimum are entitled to be informed when this is happening. There is no point in having a privacy policy if you just do what you like.

And even if you did disclose that you were tracking people's behaviour in the privacy policy, there still wouldn't be any need to include the email address, because that should already be in the 'secure database'. Undisclosed stealth spying should never be made 'my problem'.

MSE_Martin

Hi

Im not actually sure what that link is - I've not seen one of those before? We use google analytics on the site which tracks site users. I will find out what and why its there and let you know.

Certianly we have absolutely no bespoke data - we don't track individuals - we don't data mine. We do of course track macro use of the site - but there you are a number not a name if you know what I mean.

let me find out.

Martin

thelawnet

MSE_Martin wrote: »

Hi

Im not actually sure what that link is - I've not seen one of those before? We use google analytics on the site which tracks site users. I will find out what and why its there and let you know.

Certianly we have absolutely no bespoke data - we don't track individuals - we don't data mine. We do of course track macro use of the site - but there you are a number not a name if you know what I mean.

let me find out.

Martin

It has been in the 'Martin's Money' email since 11th November. Right at the top, if you view the source.

bigpound

I wouldn’t consider time and date you clicked a link personal information.

MSE is not transferring your information to other parties.

Your argument is the equivalent of blaming a bank for not protecting your information because somebody listened to you read out your details over the phone when in the local pub.

robt_2

<IMG SRC="http://tracking.moneysavingexpert.com:80/track?mailingid=1051&messageid=1302&databaseid=604&type=open&serial=1226325347&emailid=MY_EMAIL_HERE&userid=XXXXXXXXXXX&extra=&&&&quot; WIDTH="1" HEIGHT="1" BORDER="0" />

Nothing to be worried about - but it does seem an odd thing to include unless you are trying to track how many times the email is read ie how many times it is forwarded. But unless you want to know WHO is forwarding it there is no need to include our registered email address in it

thelawnet

bigpound wrote: »

I wouldn’t consider time and date you clicked a link personal information.

It's not a link.

This is an invisible image embedded in the email.

It reveals who reads the email, their IP address (from which you can derive location and ISP or employer), and the time/date they read the email.

MSE is not transferring your information to other parties.

That wasn't my point.

Your argument is the equivalent of blaming a bank for not protecting your information because somebody listened to you read out your details over the phone when in the local pub.

????

No it's the equivalent of me blaming EMI if, without notification, they track every time I put 'The Beatles' on my CD player, and store it on a database complete with my email address and location.

bigpound

You were quoting the part of the privacy where they transferred info to other parties, so I thought that was your point?

And IPs only show the closest town, and sometimes the organisation if your from there. You are of course assuming they log your IP. Martin said they use google analytics so you can probably find out exactly which information is logged.

MSE_Martin

Hi just to give a provisional response - we're still looking at this.

The tracking link simply tells us whether the email has been opened or not. The techie chaps use it as part of our delivery testing to ensure the email gets to people (the email can be blocked both with delivery problems and spam filter problems this helps check the second).

I think using this we could probably (if we wanted to - though we dont) work out the email addresses of everyone who opened the email - bu that's about it.

Certainly no third party gets the info - and we dont use it for anything else.

I will check out how that interacts with the privacy policy and if it does conflit (im not sure it does) then we will have to amend it. We get more compaints about 'non-delivery' of the email than anything else and this is a very important tool to help people ensure they're getting it.

Martin

thelawnet

MSE_Martin wrote: »

Hi just to give a provisional response - we're still looking at this.

The tracking link simply tells us whether the email has been opened or not. The techie chaps use it as part of our delivery testing to ensure the email gets to people (the email can be blocked both with delivery problems and spam filter problems this helps check the second).

It's not going to be very effective at doing that.

Microsoft Outlook blocks all remote images by default, so does Yahoo Mail, Google mail, and I would imagine most other providers and email clients work in the same way (according to this forum post from 2006, that was the case then too: http://www.webmasterworld.com/html/3032312.htm)

It's only the subset of users who have an email client that doesn't block remote images, or explicitly choose to download them, that will ever load this image.

On an individual basis, users with delivery problems can simply tell you they've received it, because it's likely to be far more complicated communicating with a non-technical user about whether their email client has downloaded the invisible image or not than simply asking them if they have got the email.

And on aggregate basis, you can't use it to find out the number of people actually *reading* the email, because a large percentage of the readers will never load the tracking image, or any of the other images in the email.

I will check out how that interacts with the privacy policy and if it does conflit (im not sure it does) then we will have to amend it. We get more compaints about 'non-delivery' of the email than anything else and this is a very important tool to help people ensure they're getting it.

The people who say they are not getting your email are probably having it spam filtered. The bug won't help the email get through spam filters (in fact, possibly the reverse, though that depends on specific spam-matching techniques that are in use), and if it does get through the spam filters, it sits on the hard drive/server, and any external images won't get loaded until the user actually reads the email (and quite probably not even then). By that point, given that the user has the email open in all its glory, they are unlikely to be complaining about non-delivery - while OTOH the fact that the image hasn't been loaded proves neither that they haven't received it, nor that they haven't opened and read it, and merely introduces an additional support issue, vis-a-vis external image loading.

And by the way, the fact that so many email clients block external images for privacy reasons rather suggests that this is something that should go in your privacy policy.....