The Cookie Monster Goes to Washington
October 31st, 2008 by mpusieski
“Me want cookies!” This is what I hear many of my Government clients say – more specifically they want to understand cookies in relation to their web analytics. I have come to call this the “Cookie Monster” issue since there is so much confusion. So for my post here (and with many thanks to DJ) I thought Let’s start with dessert first!
Below I have listed from most accurate to less accurate the ways visitors are identified on-line:
- Authenticated: The technique by which access to Internet or intranet resources requires the user to enter a username and password as identification. This is the only way to count visitors “across machines”, as no matter where they log in they are identified correctly. Cookies are really just tracking unique computers!
- Persistent Cookies : A text file containing a random identification string that “lives” on the visitors computer. Using the value stored in this cookie, WebTrends can identify if you’ve been to the site before and identify you as a “new” or “returning” visitor (but can’t tell anything else about you… it’s a random number after all!). This is also used to provide “unique visitor” counts in WebTrends.
- Session Cookies : A text file containing a random identification string that only remains in the computer’s memory for the length of the visit, or “session”. It does not live on the machine after you navigate away from the site that set it, so there is no way to identify visitors that have been to the site before.
- IP Address : Internet Protocol Address is used to identify a computer connect to the internet. Since there are only so many IP addresses to go around, more often than not individual machines end up sharing the same IP address due to the use of proxy servers (used by large organizations like companies and universities), internet service providers or even home wireless routers.
The real question is “how does visitor identification affect my analytic reports”? Very few Government sites use authentication, so that means that most visitor tracking is either with IP address (tends to be very inaccurate) or with Cookies (Session or Persistent). The current OMB guideline restricts the use of Persistent Cookies for Government Agencies to only agencies that have received direct permission. This means most government web analytic programs are limited to Session Cookies. Since only Authenticated or Persistent cookies can track a visitor returning to the site the use of Session cookies eliminates ‘returning’ and ‘unique’ visitor information.
Understanding this in relation to the data you are collecting for your reports makes all the difference in analyzing the information correctly. While you can see how many visitors or visits came in a day – you will not be able to know how many visit/visitors are new vs returning. Does this mean that analytics then has no value? Absolutely Not!! Even gathering information with Session Based ID still provides valuable insight on path navigation, content groups, registrations, surveys etc. which in turn can help with the number one point of the eGov Initiatives – to improve constituents on line experience.
One final thought about cookies: It is also important to know the source of the party setting the cookie on your machine (we recommend and use 1st party cookies). If you navigate to www.agency.gov for example, the cookie was be considered 1st party if it is set by the domain you are visiting (www.agency.gov in this case), but if a cookie was set by www.vendor.com, it would be a 3rd party cookie because you weren’t specifically requesting information from www.vendor.com. 3rd party cookies have historically been tolerated, but the proliferation of spyware, malicious websites and with increased privacy concerns a harsh light has been shed on this technology in the past few years. Newer browser technologies are even actively rejecting 3rd party cookies, and rejection rates can be as high as 27% according to some analysts. If you are only using a 3rd party cookie to identify your traffic the only source to fall back on if it’s rejected is the IP Address.
Tim Evans as part of the WAA Public Sector Committee is currently gathering information from agencies that have successfully petitioned for the use of persistent cookies to share with agencies interested in pursuing the use of persistent cookies – please feel free to contact either Tim or myself if you’d like to participate.
For additional insights and options on accurately assessing traffic on government sites, please download our Government Best Practices whitepaper or comment below on what else you’d like to see addressed here for government agencies online.
Tags: cookies, government, OMB guidelines, privacy
Follow us on Twitter
November 2nd, 2008 at 1:31 pm
I hope the government focus of this item didn’t cause a lot of people to skip it. On the surface it has to do with government web sites, but underneath it has to do with the survival of persistent cookies, period. Tim Evans, wherever you are, good luck to you.
November 6th, 2008 at 10:10 am
I have ben arguing for a good 6 years with public administration accounts to use persistent cookies for stats quality sake. After all, it’s a matter of accountability; how long can you spend millions on the Web as a Government, and still rely on crappy analytics?
Interestingly enough, I was asked to give a presentation of 100 + Governement people here in Canada about Google Analytics. I was quite surprised to see that already many agencies and ministries throughout the country were already using it, and for some using WebTrends SDC, so serving cookies! In several instances, those sites were serving persistent cookies (what GA does) even though their privacy policy was stating the opposite! As if one could use Google blindly, since nothing “bad” could come out of it (note: cookies are **not** bad!).
Since WebTrends is the most largely used solution at the Federal and Provincial Governements in Canada (analyzing IIS logs), I think there would be a good opportunity to explain them how much more tagging brings to the table, and even how much more persistent cookies allow as a session tracking method (think of all those reports WT won’t let you do if you sessionize on IPs).
WebTrends could then be presented as a strong alternative to a Saas solution, since SDC can be locally implemented, which means that it is still possible to benefit from tagging and persistent cookies (all done by SDC itself, no need to teak the IIS servers) while keeping the data internally (and on this side of the border mind you (not subject to Patriot Act)).
I think this would become a very strong competitive advantage with those acconts.
November 9th, 2008 at 12:23 pm
Really great article. I wish good luck from Private Krankenversicherung