Privacy Implications of Custom Dimensions

Custom Dimensions can be configured to collect personal data depending on the values you choose to track. Before creating a Custom Dimension, it is important to consider the privacy implications of the data being collected.

With the Visit scope especially, it is easy to associate personal data with actions that people take on your site. For example, you could use custom dimensions to capture a user’s job role or employer. However, if you have not obtained consent or given explicit warnings that this personal data is being collected for analytics purposes then your usage may not be compliant with international privacy regulations.

While some information may not seem like it could identify a user, if you combine the user’s data with other information, it could become quite revealing. For example, if you are tracking both Job Role and Company dimensions on the Visit scope and only one person holds that role in the company, it will be obvious who the data is referencing even if you don’t have their name.

Or, if you collect User Type associated with the Visit scope but you only have one customer of a specific product, it will be clear who that user is even without a User ID.

Depending on your privacy regulations, you may need to seek consent from the user and document the fact it is being done within your privacy policy. You can review Matomo’s privacy documentation for more information on managing your website’s data collection practices.