9

I am building an app that communicates with my website with ASIHTTPRequest to a PHP-based REST API on the server side.

Naturally, in my app I have different endpoints on the server side, and usually return JSON data.

Is it unethical to log counters on how many times each endpoint was hit?

I'd like to capture how the app was used capturing what endpoint was hit, the user agent, time of day, possibly their IP (to group visits etc).

Should I ask permission to do this?

Improve this question
0

3 Answers 3

Reset to default
7

It should be in your terms and conditions, but you should not have to inform the user. Technically this is the same as traditional HTTP server log files and running statistics against them.

I would however make sure that it's not possible to identify an individual user from the data as that may violate local or international privacy laws. They could opt in for that if they wish.

Improve this answer
3

The only questionable piece of data that you are tracking is IP address. The rest is pretty generic. Any site implementing Google Analytics is tracking pretty much the same thing...without warning.

If you do want to track IP address (or anything else that could make the user personally identifiable), though, you should get permission before doing so.

Improve this answer
3
  • I've posted a follow up question pertaining to IP information: stackoverflow.com/questions/7934312/…
    – barfoon
    Oct 28, 2011 at 20:05
  • 2
    Further to this - what if I hashed the IP address? That way I couldn't get the IP back, but I could still group visits.
    – barfoon
    Oct 28, 2011 at 20:07
  • @barfoon: on a technical point, there are only 2^32 IPv4 addresses, so hashing them isn't necessarily irreversible even with salt. More impenetrable would be to assign a randomly-generated token to each IP address, maintain a lookup table for a period of time (so that you can group requests by token for analysis), and then delete the lookup table to destroy the association between the token and the personally identifying information. Of course this means you can only group by IP over a limited period, once deleted that same IP address will get a different token next visit.
    – Steve Jessop
    Aug 18, 2014 at 8:47
0

Nothing wrong with server-side tracking of access to your own site. Just don't spy on what the client might be doing that doesn't concern your site.

There's nothing questionable about logging IP addresses either. They can't be resolved to an individual without aid from law enforcement (or some other way to get their ISP to comply). In fact, they are essential if you're ever hit by an exploit and want to file charges.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.