Data Security & Privacy for Digital Experience Analytics

Question 1

How can we set up consent management?

One way to manage the user data you collect is by obtaining user consent before capturing any digital behaviors and user sessions. This setting is turned on by default in the Recording and Consent section of session replay settings. This option allows you to get consent from a user before recording their sessions. When this setting is selected, sessions will only be recorded when an API is called to start session replay. See Recording and Consent for more information.

Question 2

How does consent work for other website analytics features such as heatmaps and funnels? Is it the same as or different from screen recordings? Do we need to ask for consent for these specific aspects?

All elements of Digital Experience Analytics, including session recording/replay, heatmaps, funnels, and path analytics (and other features to be released), use the same consent logic. These tools visualize the user interactions from the session data. If you implement consent, a website visitor must opt in before the session will be captured in the Qualtrics platform. Once the session is captured, these tools use the session data to replay the user's interactions, visualize their click interactions, and capture where the website visitor dropped off in the journey. The consent is at the session level, not at the feature level.

Question 3

How can we delete website visitor information if requested?

Users who have the delete permission can delete session recordings of website visitors. You can go to the “session tab” in in your project and filter sessions based on the information provided such as IP address or session ID. Once the filtering is performed, you can select the session and then delete it. See Deleting User Sessions for more information.

Question 4

Can we turn off the collection of IP addresses?

Capturing IP address is an opt-in feature by the project owner. You can choose not to enable it.

Question 5

What documentation is available for data security and privacy for Digital Experience Analytics?

See this support page for information about Data Security, Privacy, Session Replay Enablement, Data Encryption, Data Masking, User Consent, and Personal Data Requests.

Question 6

How does masking work?

For maximum safety, masking of PII is done client-side (in the browser during the session capture) before it's sent to Qualtrics' servers. There are 3 mechanisms to enable this:

You can check "Mask all input fields" to automatically mask all HTML elements that are considered "inputs." This includes things like text entry fields, emails, passwords, etc. When masked, the original text will not be captured during sessions.

To mask non-input elements, you can supply one or more CSS selectors. Work with your engineering team to identify sensitive HTML elements (for instance, a header on a page that might have a customer's name) and supply CSS selectors that refer to those elements. During session capture, Qualtrics will mask any text contained in those elements and prevent it from being captured.

You can also mask all content (text, images, and video) and selectively choose to not mask certain content.

Question 7

Is masking retroactive?

Masking is not retroactive. Once a session has been captured, elements cannot be hidden after the fact if new masking rules are added. However, you can delete sessions that were captured prior to the new masking rules.

Question 8

What are the users' options for the consent question? Just yes/no?

The consent field to confirm if Qualtrics will record is True/False. You can determine the content of any consent questions.

Question 9

Is Digital Experience Analytics HIPAA compliant?

Individual tools are not HIPAA compliant or non-compliant. You can use DXA in a manner that complies with HIPAA, but it is up to you to ensure that you have the appropriate consent from a website visitor to share whatever data may be captured by DXA with Qualtrics. HHS has already stated that tracking technologies (such as session replay) are not per se violations of HIPAA as long as the covered entity gets adequate consent from the website visitors. Qualtrics complies with HIPAA to the extent it imposes obligations on Qualtrics as a business associate - we sign BAAs with our customers that are covered entities that allow us to process PHI.

Question 10

What is the location (city/state/country) where our Data and Personal Data will be stored?

Qualtrics stores all Digital Experience Analytics data in the same datacenter as the rest of the your Qualtrics data (e.g for customers in our Australian data center, Digital Experience data you collect using our platform will be stored in the Australian region).

Data Security & Privacy for Digital Experience Analytics

About Data Security and Privacy

Session Capture Enablement

Data Encryption

Data Masking

IP Address

Personal Data Requests

Data Retention Policy

Digital Experience Analytics Legal FAQs

FAQs