Behavioral Analytics Overview

From Clicks to Decisions

The Analytics Overview covers how to collect data. OpenTelemetry covers how to observe systems. This page covers what comes next: understanding why users do what they do, how organizations measure and optimize user behavior, and — critically — how this understanding can be abused.

Behavioral analytics sits at the intersection of engineering, product management, marketing, and business strategy. Because of all these intersections, it also often collides with regulation and ethics. The same infrastructure that helps a developer discover a confusing checkout flow can also enable surveillance advertising that may make us quite uncomfortable. Things are rarely clear-cut, so you need to understand both sides.

This page is organized as a journey from foundational measurement concepts (what is a session? what is a conversion?) through the tools and techniques organizations use (attribution, A/B testing, session replay) to the harder questions about data quality, privacy, and abuse.

1. The Site Visitation Model

Before you can measure user behavior, you need a shared vocabulary for what you are measuring. This is a great example of the idea of ubiquitous language from domain-driven design. Web analytics organizes user activity into a hierarchy of increasing abstraction:

+-----------+ | Segments | Clusters of users sharing traits +-----+-----+ (e.g., "mobile users from California") | +-----+-----+ | Users | A person (ideally), identified across sessions +-----+-----+ via cookie, login, or fingerprint | +-----+-----+ | Sessions | A group of interactions within a time window +-----+-----+ (default: 30 min inactivity timeout) | +-----+-----+ | Events | Discrete user actions (click, scroll, submit) +-----+-----+ | +-----+-----+ | Pageviews | A page load or virtual navigation (SPA) +-----+-----+ | +-----+-----+ | Hits | Any request to the server (images, scripts, etc.) +-----+-----+
Analytics Jargon Meets "Truth": An interesting way that people will often talk about analytics is to use the term that is most useful to make their point. This is a form of data + rhetoric that is quite prevalent in tech these days. We aren't quite lying with our data, but we are shaping a perception, maybe to fit our narrative. We'll see this same approach being used in data visualization as well. The point here being that data stories can be shaped just as easily as normal stories, do not kid yourself that data === truth.

A simple example might be the choice of discussing hits or page views as opposed to actual outcomes on a site or app. As an example, you might inform the boss that the site had 1.5 million hits last month. If each page had ~75 assets on it for say images, fonts, CSS, JavaScript, and so on where the average visitor consumed 5 pages per visit and visited 3 times in a month. That would mean that each visitor on average generated (5 * 75)*3 = 1,125 hits in a month, which is a mere 1,133 visitors! Having just ~1000 visitors might get you fired, but over a million hits, why you need a raise!

Digging into data and letting the multitude of "truths" to be revealed is what you should do, but don't be surprised if motivated reasoning and political pressures can tempt you to shape narratives.

Let's walk through each level of this hierarchy from the bottom up, since each layer builds on the one below it.

Hits

A hit is the most granular unit of measurement — any single request from a client to a server. Every image, stylesheet, script, font, favicon, and HTML document generates a hit. In the early days of the web, hits were the only metric available because web server access logs recorded every request. Hits are easy to count (just parse the log) but almost entirely useless as a measure of user activity because a single page load can generate dozens or hundreds of hits depending on how many assets it references. In short, how you build can juice your hits up, but you also might find it to go download if you bundle for performance reasons.

Hits don't matter much for user behavior analysis, but they may still matter in one context: server capacity planning. If your server handles 10,000 hits per second before degrading, you need to know total hit volume. However, even there it may not be useful because a small object and a large object will result in vastly different capacity numbers.

Pageviews

A pageview is one level up from a hit — it represents the loading of a single HTML document (page). In traditional server-log analytics with multipage applications (MPA), a pageview is identified by filtering hits for HTML content types. In client-side analytics (like GA or our course project), a pageview is explicitly fired by the tracking script when a page loads.

Pageviews are more meaningful than hits because they approximate "a user looked at something," but they have their own problems:

Events

An event is a discrete user action that occurs within a page: a click, a scroll, a form submission, a video play, a file download, a hover that triggers a tooltip. Events are where behavioral analytics gets interesting, because they capture what the user actually did, not just which pages they loaded.

The challenge with events is taxonomy — deciding what to track and what to name it. Without a consistent naming convention, you end up with click_button, button_click, btn_clicked, and Click - Button all meaning the same thing. Event taxonomies are a data governance problem, not a technical one. However, to be reaslistic that is jumped ahead as you probably could say that the events at the lowest level start with the events that HTML-JavaScript have defined (click, scroll, load,mouseover, etc.) and then go to custom events that the developer could define (chart:update, grid:sort, etc.) which ultimately are mapped to user experience ideas like add_to_cart, cta_clicked, etc. as mentioned above.

Google Analytics (GA4) made a significant architectural shift by treating everything as an event, including pageviews. A pageview in GA4 is simply an event named page_view. I do worry that letting GA beliefs drive things is a platform > protocol or standard idea and that the W3C or other standards body really ought to straigten out this jargon issue.

Sessions

A session groups a user's pageviews and events into a single concept of a visit. Interestingly this session/visit concept has a bit of a challenge when it intersects with HTTP.

You should recall that HTTP is stateless, but it is also connectionless. It is difficult to know that the user is still around or not without building our own stateful mechanism, often using polling or a socket. The general approach is that the session times out, so to speak, if the user has not performed some activity within some given time period. The standard session timeout is 30 minutes of inactivity — if a user reads an article for 45 minutes without interacting, their next click starts a new session.

Session length defaults are simply a convention dating back to the early days of web analytics (Urchin/Google Analytics), and not a law of nature or formerly agreed upon concept Notice how session rules vary by tool:

Variable Session Length: There are good and bad reasons why session timeout length might not be the same. For example, in a high-security domain like banking, it might make sense to use a shorter session timeout to ensure that sensitive data is not exposed for too long via session hijack. On the other hand, for some long effort in an app situation, you might see very long session lengths.

It is also possible to shape narrative with session length, tuning timeout to be short will of course up session counts!
Idle Timers and Session Length: It is possible to have more insight of if a user still has a session around by using a heartbeat mechanism. This can be done by sending a small packet of data to the server at regular intervals to keep the session alive because they haven't really left yet. This can be especially useful in situations where the user might be on a slow connection or in a high-latency environment. We also might have a socket open to accomplish the same thing. The problem with this approach is that it can be resource-intensive at scale. For small sites or under special conditions like usability monitoring idle mechanisms can be quite useful though.

Users

A user represents a person (ideally) identified across multiple sessions. The concept seems straightforward — "how many people use our site?" — but the technical reality is anything but. A "user" in analytics is not a person; it is an identifier: a cookie value, a login ID, a device fingerprint, or some combination. The gap between "identifier" and "person" is where most analytics data quality problems live. (I generally talk about this as an aspect of what he dubs the "identity problem of the internet" and something that is felt in many other ways online beyond analytics accuracy)

New vs. Returning Users

A new user is one whose identifier (cookie, user ID) was not previously seen. A returning user is one whose identifier was previously recorded. This sounds simple but is deeply unreliable:

Reality check: The concept of a "unique visitor" is a useful fiction. The same person routinely appears as 2–4 "unique" users across devices and browsers. Treat unique visitor counts as rough order of magnitude, never exact headcounts. Obviously, getting more exact counts can be done with fingerprinting or forcing logins. The former being a bit suspect and potentially illegal in some regions while the later adds friction and may not be appropriate in all contexts.
User Fraud & Abuse: Creating fake users and even creating armies of devices if device identity is relied upon is a serious problem online. We can roughly call it click fraud and it is a problem that can be difficult to detect and prevent. It is yet another example of online and real-world intersection issues and is unlikely to be solved using purely technical efforts.

Segments

A segment is a subset of users filtered by shared characteristics: device type, geographic location, traffic source, behavior pattern, or any combination. Segments are where analytics becomes actionable — aggregate numbers hide the story; segment-level analysis reveals it. If done well, we see analytics tying back to user-centered design thinking, where the segments map to the personas and their activities, as captured by user stories, hopefully will map to the next topic output.

Connecting the Hierarchy to Outcomes

This measurement hierarchy tells you what happened, but not whether it mattered to the organization (and hopefully the user). The missing piece is outcomes — the conversions, goals, and KPIs (Key Performance Indicators) that give meaning to the activity data. A million pageviews means nothing if none of them lead to a signup, a purchase, or a support question answered. Section 3 covers how organizations define and measure outcomes, but the connection is worth noting here: every level of the hierarchy becomes more useful when paired with an outcome metric.

2. Engagement Metrics

How do you know if users are actually engaging with your content, or just loading pages and leaving? Engagement metrics attempt to measure the quality of a visit, not just the quantity.

Engagement Fraud and Abuse Depth: We've discussed fake users, but usually you also need to fake activities and you can do all these things fairly easily - think screen recorders and automated testing. For example, falsifying user scroll depth can be done by manipulating the viewport size or by using JavaScript to simulate scrolling. Given that AI agents can navigate properly constructed web pages and applications, I am quite concerned that artificially inflated engagement metrics will go supercritical, moving beyond active criminal efforts and reaching anyone who wants to mess with someone if they have access to a paid AI subscription. Given the ability to generate content, it is going to be quite difficult to detect engagement fraud without deep validation and verification that goes well beyond CAPTCHAS
Incentivized to Accept Fraud? You would imagine that big platforms wouldn't want there to be fraud, be it content fraud, click fraud, engagement fraud, etc., But they are sadly incentivized to accept fraud because they are incentivized to accept money until it starts costing them money or come with major reputational damage. If that seems an incredibly spicy take to you, be careful, there is data that suggests that some large FAANG organizations make actual billions on AI-slop content, click fraud, deceptive advertisements, and worse. If you don't believe this go read investigative articles from 404media or read financial disclosures carefully for the tells, as it is a bit of an open secret rather than something terribly difficult to verify.

Scroll Depth

Scroll depth measures how far down the page a user scrolls, typically reported as percentage quartiles (25%, 50%, 75%, 100%). The modern way to track this is with the Intersection Observer API, which fires callbacks when elements enter or leave the viewport:

// Track scroll depth with Intersection Observer
const markers = [25, 50, 75, 100];
markers.forEach(pct => {
  const el = document.getElementById(`scroll-${pct}`);
  if (!el) return;

  const observer = new IntersectionObserver((entries) => {
    entries.forEach(entry => {
      if (entry.isIntersecting) {
        // Send scroll depth event
        navigator.sendBeacon('/collect', JSON.stringify({
          event: 'scroll_depth',
          depth: pct,
          page: location.pathname
        }));
        observer.unobserve(entry.target); // Fire once
      }
    });
  }, { threshold: 0.5 });

  observer.observe(el);
});

The old approach — listening to the scroll event and calculating position with scrollTop / scrollHeight — is a performance disaster. The scroll event can fire hundreds of times per second. Intersection Observer is asynchronous and does not block the main thread. Understand that today the browser shares a single thread with user-level JavaScript, so it is a good idea to understand the impact of your code on the user's performance and experience. Poor or too much JavaScript that negatively impacts the user is a self-inflicated problem for too many modern web developers.

Time Metrics

Time-based engagement has multiple definitions, and confusing them leads to bad analysis:

Metric Definition Measurement Method
Time on Page Time between pageview and next navigation Difference between consecutive page timestamps
Dwell Time Time from SERP (Search Engine Results Page) click to return to SERP Search engine measurement (not available to site owners). Interestingly, some of this data used to be available, but the retention of this data by Google and other search vendors is a concern for privacy and data protection regulations.
Attention Time Time the page is visible and the user is active Page Visibility API + interaction heartbeat

These distinctions suggest the idea of an "engaged session" as opposed to just a session. Consider opening a tab, looking for a second, and moving to focus on another tab is quite different from a session where the user is engaged with the site or application.

In Google Analytics and engaged session is defined as a session that lasts more than 10 seconds, has a conversion event, or has 2+ pageviews. This is Google's attempt to replace bounce rate with something more meaningful.

Definitional Differences: Like sessions, the idea of engaged sessions is a bit fuzzy and can be difficult to define precisely. For example, what constitutes "engagement" can vary widely depending on the context and the goals of the organization. Additionally, the definition of engaged sessions can be influenced by factors such as user behavior, device capabilities, and network conditions. It is important to carefully consider these factors when designing and implementing engagement metrics to ensure that they accurately reflect the user experience and provide meaningful insights for decision-making.

Time Troubles

While time and engagement seem straightforward enough in practice, things can get a little confusing. To illustrate this, consider the following example of a session:

Session Timeline ================================================================================ 0s 10s 30s 2m 5m 10m |---------|---------|------------|------------|---------------| Page A Page B Tab hidden Tab visible Page C load load (user reads (user load email) returns) Time on Page A: 10s (until Page B load) Time on Page B: 20s (until tab hidden? until Page C? ambiguous) Attention Time: 10s + 20s + 3m = 3m 30s (excludes hidden tab) Session Duration: 10m (first to last interaction)

Notice the fundamental problem with time on page: it is measured as the gap between consecutive pageviews. For the last page in a session, there is no next pageview, so time on page is undefined (or zero). This means the most important page — the one where the user found what they wanted and left satisfied — often has no time measurement at all. Again, we are seeing strong awareness of the domain, and critical thinking is absolutely required to understand the meaning of the metrics. The next example, is one of the most notoriously abused metrics

Bounce Rate

Bounce rate is the percentage of sessions in which the user viewed only a single page and triggered no additional interaction events before leaving. In the older versions of Google Analytics, a "bounce" was strictly defined as a single-pageview session — the user arrived, saw one page, and left without clicking anything else. The formula was simple:

Bounce Rate = Single-page sessions / Total sessions

The new version of Google Analytics (GA4) changed the definition by inverting it. Instead of tracking bounces, GA4 tracks engaged sessions (sessions lasting >10 seconds, or with a conversion, or with 2+ pageviews). Bounce rate now is simply the inverse: 1 − engagement rate. This means the same user behavior can produce different bounce rates depending on which tool you use.

The concept matters because bounce rate was historically one of the most-reported metrics in web analytics — and one of the most misinterpreted. A high bounce rate is often treated as evidence that a page is "bad," but this conflates two very different scenarios:

Both register as identical bounces. Without additional signals (scroll depth, time thresholds, satisfaction surveys), bounce rate cannot distinguish success from failure. We return to this problem in detail in Section 12: Data Interpretation Pitfalls.

Click and Tap Patterns

Tracking where users click reveals navigation preferences, content interest, and usability problems. Click tracking records coordinates (for heatmaps), element identifiers, and timing. The analytically interesting patterns are not individual clicks but clusters: rage clicks (rapid repeated clicking on unresponsive elements), dead clicks (clicks on non-interactive elements users expected to be clickable), and ghost clicks (accidental taps on mobile from scrolling).

Engagement is not goodness. High engagement can mean users love your content — or that they cannot find what they need and are thrashing around desperately. A 10-second visit where the user finds their answer instantly is a better experience than a 5-minute visit where they struggle through confusing navigation. Always interpret engagement metrics in context.
Sounds Reasonable Enough or Cool Enough: A big problem I find in the world is that people often quickly latch on to something because it sounds reasonable or feels cool.

The key to moving on from sounding cool to knowing what we talk about requires us to be ok not knowing and be patient to find out why something is the way it is? Think about dead clicks are they dead or is this a touch device and the click is the user scrolling the page? Think about bounce it sounds reasonable that someone coming and bouncing away is a bad thing, but is it?

Sadly style slogan engineering and now analytics is somewhat the norm, not the exception. Viscreal slogans like rage click or technical posturing with acronyms (ITP, SERP, etc.) might feel cool or make one sound technical, but does everyone in the room know what it all means? If not, we are LARPing data-driven decisions, not living the idea of it.

3. Measuring Outcomes

Engagement metrics tell you what users do. Conversion metrics tell you whether what they did mattered to the organization.

Conversions

A conversion occurs when a user completes a desired action. Conversions come in two flavors:

  1. Macro conversions: Primary business objectives — purchase, sign-up, subscription, application submission
  2. Micro conversions: Steps that indicate progress toward a macro conversion — adding to cart, watching a demo video, downloading a whitepaper, creating an account
Marketing Funnel with Metrics ================================================================================ Awareness 100,000 visitors Impressions, reach +---------------------------------------------------------+ | | | Interest 20,000 engaged Scroll depth, | | +------------------------------------------------+ | | | | | | | Consideration 5,000 signups Form starts,| | | | +---------------------------------------+ | | | | | | | | | | | Conversion 500 purchases Orders| | | | | | +---------------------------+ | | | | | | | | | | | | | | | Retention 150 repeat | | | | | | | | | | | | | | | | | | | | | | | +--+-----------------+------+ | | | | | +---------------------------------------+ | | | +------------------------------------------------+ | +---------------------------------------------------------+ Conversion Rate = 500 / 100,000 = 0.5% Funnel Drop-off: 80% (Awareness→Interest), 75%, 90%, 70%

KPIs vs. Vanity Metrics

A Key Performance Indicator (KPI) is a metric that is directly tied to a business objective and is actionable — you can change your behavior in response to it. A vanity metric feels good but does not inform decisions.

Vanity Metric Actionable KPI
Total pageviews Pageviews per session (engagement depth)
Total registered users Monthly active users (MAU)
Social media followers Conversion rate from social traffic
App downloads Day-7 retention rate
Email list size Email click-through rate
The vanity metric trap: Organizations that optimize for vanity metrics often make their product worse. Adding pop-ups increases email signups (vanity) while decreasing conversion rate (KPI). Adding auto-play videos increases time-on-site (vanity) while increasing bounce rate and user frustration. Always ask: "If this number goes up, do we actually know what to do differently?" Snarkily, you might hear data people talk about "up and to the right" or "line must go up" or "more is always better" or ...

The point here is to point out that vanity metrics are required in some organizations where management is simply not tolerant of things that go against their predispositions. This type of motivated thinking is a bit too common even in some of the most powerful technical companies, so much so that you may hear about HiPPO issues and other stories of how data can't survive contact with management. It's a sad state of affairs when we try to bend measured reality to people's beliefs or feelings, but in my view, the (dis)allowance of this is a way to gauge the data maturity of an organization and should be something you look out for in your career.

Dark Patterns and Analytics Manipulation

A dark pattern (Wikipedia)) is a user interface design that deliberately manipulates users into taking actions they did not intend or would not choose if they fully understood what was happening. Dark patterns are relevant to behavioral analytics for two reasons:

  1. they are used to inflate analytics metrics
  2. analytics data can obscure their effects by making manipulated outcomes look like genuine user interest.

Common dark patterns that directly juice analytics numbers:

Dark Pattern How It Works Metric It Inflates
Confirmshaming The decline option is worded to make the user feel guilty: "No thanks, I don't want to save money" Email signups, conversion rate
Forced continuity Free trial silently converts to paid subscription; cancellation is deliberately difficult to find Subscription count, retention rate
Roach motel Easy to sign up, extremely hard to delete account or unsubscribe (multi-step, phone call required, hidden settings) Registered users, MAU
Misdirection Visual hierarchy draws attention to the option the company wants; the user's preferred option is grayed out or smaller Upsell conversion, add-on attachment rate
Trick questions Double negatives or confusing checkbox language: "Uncheck this box if you prefer not to not receive emails" Opt-in rate, email list size
Sneak into basket Additional items (insurance, warranties, donations) pre-added to cart during checkout Average order value, attachment rate
Disguised ads Ads styled to look like content or navigation links; "Download" buttons that are ads, not the actual download Click-through rate, pageviews
Infinite scroll / pagination games Content split across unnecessary pages, or auto-loading prevents the user from ever reaching the footer Pageviews per session, time on site, scroll depth

The analytics problem is that these patterns produce metrics that look like success. An email list that grows 40% in a quarter looks impressive in a dashboard — but if it grew through confirmshaming and pre-checked boxes, the list is full of disengaged subscribers who will never open an email. The conversion rate went up; the actual business value did not.

Dark patterns corrupt the feedback loop. Analytics is supposed to tell you what users want. If you manipulate the UX to force desired behaviors, you are measuring your own manipulation, not user intent. The metrics go up, the dashboards look green, and nobody notices that customer satisfaction, brand trust, and long-term retention are eroding — because those are harder to measure and slower to surface. We will see dark patterns again in Section 15 where consent banners use the same techniques to inflate tracking opt-in rates.
The Web Didn't Invent Dark Patterns! If you have tried to cancel a SiriusXM account, found yourself agreeing to some "insurance" or service you didn't want, or being pressured inappropriately by a salesperson IRL, you've experienced dark patterns. They are not new to our digital realm, though I'd say they are more common because it is easier to pressure people at a distance. Easier to sleep at night, I guess, if real people getting angry are not "in your face." This speaks to a larger dehumanization and "othering" effect due to the mediated world of the internet that far exceeds the topic of analytics.

4. Attribution

Users rarely convert on their first visit. They might see a social media post, search up your brand a week later, click a retargeting ad, and finally convert after receiving an email coupon. Attribution is the process of assigning credit for a conversion to the touchpoints that influenced it.

UTM Parameters

The foundation of campaign attribution is somewhat de facto based upon UTM parameters These URL query parameters tag inbound links so you can identify which campaigns drive traffic:

Attribution Models

When a conversion follows multiple touchpoints, how do you distribute credit? Each model tells a different story:

User Journey: Social → Organic Search → Email → Paid Ad → Conversion ================================================================================ Model Social Search Email Paid Ad Logic ----------------- ------ ------ ------ ------- -------------------------- Last-Click 0% 0% 0% 100% Last touch gets all credit First-Click 100% 0% 0% 0% First touch gets all credit Linear 25% 25% 25% 25% Equal credit to all Time-Decay 10% 20% 30% 40% More credit to recent touches Position-Based 40% 10% 10% 40% 40/20/40 first-last-middle Broad Data-Driven 15% 35% 20% 30% ML model estimates impact

Google moved GA4 to data-driven attribution as the default in 2023, using machine learning to estimate each touchpoint's contribution. This sounds sophisticated, but it is a black box — you cannot inspect or validate the model's reasoning. This is a sad problem with 3rd party analytics in general, where there is a bit of secret sauce behind that data that guides your online efforts. My general belief is that assumptions are usually required in life, but knowing what assumptions are in play is essential.

Attribution is a comforting fiction. No model perfectly captures causation. Attribution tells you which touchpoints preceded a conversion, not which ones caused it. A user who was going to buy anyway still clicks an ad — does the ad deserve credit? Significant effort could be applied to get to the bottom of things, but rarely do people do it as the effort may not be worth it.

5. Attribution Challenges

Even if you accept that attribution models are imperfect, the practical reality is worse than the theoretical limitations suggest.

Cross-Device Tracking

A user browses on their phone during lunch, researches on their work laptop in the afternoon, and then goes home and purchases on their home desktop. Without a login-based identity, these are three separate "users" in your analytics. Cross-device tracking requires either:

ITP and Cookie Restrictions

Apple's Intelligent Tracking Prevention (ITP) in Safari limits first-party cookies set via JavaScript to a 7-day lifetime (24 hours when the referring domain is classified as a tracker). Firefox's Enhanced Tracking Protection and Chrome's evolving restrictions create a landscape where analytics cookies are increasingly ephemeral. This starts to cross over into regulatory and social concerns.

Walled Gardens

Facebook, Google, Amazon, and other platforms each operate their own measurement systems in isolation. When a user sees a Facebook ad and then clicks a Google ad before converting, both platforms may claim full credit for the same conversion.

Walled garden double-counting: It is common for the sum of conversions reported by Facebook + Google + email + direct to exceed actual conversions by 30–60%. Each platform has an incentive to claim credit — they are selling you the next ad. This is not a bug in their systems; it is a feature of their business model. Again, we are seeing ethical considerations creeping in and financial markets reacting to "vibes" rather than reality. Check your existing beliefs about this possibility by performing a Tesla Stock Valuation thought experiment.

The Third-Party Cookie Apocalypse

Third-party cookies — the backbone of cross-site tracking and retargeting — are being phased out. Safari and Firefox already block them. Chrome has wavered but is restricting them. The advertising industry is scrambling for alternatives:

Incrementality Testing

The gold standard for measuring whether a channel actually causes conversions (rather than just being present before them) is an incrementality test: randomly withhold ads from a holdout group and compare conversion rates. If the holdout group converts at 4% and the ad-exposed group at 4.2%, the ad's true incremental lift is only 0.2 percentage points — not the 4.2% the ad platform claims. Very few organizations run these tests because the results are often sobering.

6. Google Analytics Dominance

Google Analytics (GA) holds approximately 85% market share among websites using an analytics tool. Understanding why this monopoly exists and what it means is essential context for anyone working with web analytics.

History: From Urchin to GA4

Google acquired Urchin Software in 2005 (A San Diego firm!) and rebranded it as Google Analytics. The "UTM" in UTM parameters stands for Urchin Tracking Module — a relic of this origin. The free tier was a deliberate strategy to (1) make web analytics ubiquitous, (2) train a generation of marketers on Google's terminology, and (3) feed data into Google's advertising ecosystem.

The evolution tells a story about data ownership:

The Conflict of Interest

Google is simultaneous:

  1. the largest seller of online advertising
  2. the most popular analytics platform for measuring ad effectiveness
  3. the dominant search engine that controls organic traffic.

This triple role creates inherent conflicts:

"Free" does not mean free — you train their ad models. Google Analytics data feeds Google's advertising algorithms. Every conversion you track, every audience segment you build, every event you log enriches the same system that sells ads back to you. You are simultaneously the customer and the product. Crazily, this is almost a textbook example of a monopoly!

Given some abuses in the space, the observation of online system enshitificationpopularized by Cory Doctorow, and most importantly the effects of "splinternet" from political and regulatory realities such as Europe's enforcement of GDPR some organizations are looking more seriously at GA alternatives. A few are listed here.

Alternatives

Tool Model Key Differentiator
Matomo Open source, self-hosted or cloud Full data ownership, GDPR-friendly, GA feature parity
Plausible Open source, cloud-first Privacy-first, no cookies, lightweight (<1KB script), simple UI
PostHog Open source, self-hosted or cloud Product analytics + session replay + feature flags, developer-oriented
Amplitude SaaS (free + paid) Product analytics focus, behavioral cohorts, strong event modeling
Fathom SaaS (paid) Privacy-focused, simple, EU-hosted option
Adobe Analytics Enterprise SaaS Deep segmentation, data warehouse integration, enterprise scale

7. Tag Managers & Instrumentation

A tag manager is a tool that lets non-developers add, modify, and remove tracking scripts ("tags") on a website without deploying code. Google Tag Manager (GTM) is the most popular, but many others exist.

The Appeal

Marketing teams want to track new events, add conversion pixels, and instrument A/B tests now — not after the next sprint and they certainly would prefer not to go talk to the tech team to get it done. Tag managers solve this by decoupling tracking instrumentation from application deployment. A marketer can log into GTM, add a Facebook pixel, configure a trigger for button clicks, and publish — all without a developer touching code.

Developer-Configured vs. TMS

Developer-Configured Tag Management System (TMS) =========================== =========================== Application Code Application Code +-------------------+ +-------------------+ | analytics.track( | | <script> | | 'add_to_cart', | | GTM container.js | | { sku, price } | | </script> | | ) | +-------------------+ +-------------------+ | | v v GTM Container (Web UI) Your Analytics +-------------------+ Endpoint | Tag: GA4 pageview | +-------------------+ | Tag: FB pixel | | /collect | | Tag: Hotjar | | - validate | | Tag: LinkedIn | | - sessionize | | Tag: TikTok | | - store | | ...15 more tags | +-------------------+ +-------------------+ | Pros: Pros: v - Full control - Marketing autonomy - Minimal JS payload - No deploy needed - No third-party scripts - Vendor flexibility - Data stays on your servers Cons: Cons: - Requires dev work for changes - Performance tax (many scripts) - Slower iteration - Loss of dev control - Script injection risk - "Tag soup" accumulation
Tag managers are a performance tax. A typical GTM container loads many third-party scripts, and can add anywhere from 500KB–2MB of JavaScript and even dozen or morenetwork requests. Each tag can delay page load, block the main thread, and interfere with other scripts. The performance cost compounds: each tag vendor loads their own dependencies, tracking pixels, and sometimes entire analytics SDKs. Here we see a usability (for the marketer) and performance (for the user) trade-off
Ungoverned GTM containers are a security risk. Anyone with GTM access can inject arbitrary JavaScript into your production site. Without governance (approval workflows, audit logs, Content Security Policy), a compromised GTM account or a careless marketer can break site functionality, exfiltrate user data, or introduce XSS vulnerabilities. Treat GTM publish access like production deploy access. Here we see a usability (for the marketer) and security (for dev and user) trade-off.

Server-Side Tag Management

A newer approach moves tag execution from the browser to a server-side container. The browser sends a single request to your server, which then fans out to vendor APIs. This improves client performance and gives you data control, but adds infrastructure complexity and cost. It also has a privacy implication: server-side tracking can bypass browser privacy protections like ITP and ad blockers, which is precisely why privacy advocates are concerned about it.

Abstracting Dependencies Pattern Here we see the realization that direct insertion of 3rd party dependencies into a software is a bad idea. It is better to abstract dependencies and manage them through a self-controlled mechanism. This allows for better control, easier maintenance, and reduces the risk of security vulnerabilities. In some sense, this is a trade-off of development ease (usability) with maintainability and safety.

8. A/B Testing & Optimization

A/B testing attempts to apply the scientific method to web design and product decisions. Instead of debating whether a green or blue button converts better, you show each version to a random subset of users and measure the outcome. The winner is what leads to the most outcomes! It's just science?

The Process

A/B Test Lifecycle ================================================================================ 1. HYPOTHESIS "Changing the CTA from 'Submit' to 'Get Started' will increase signup rate by 10%" | v 2. DESIGN Control (A): Current "Submit" button Treatment (B): New "Get Started" button | v 3. RANDOMIZE Assign users to A or B (cookie/user-ID bucketing) Typical: 50/50 split | v 4. RUN Collect data until statistical significance Minimum sample size depends on baseline rate + MDE | v 5. ANALYZE Compare conversion rates Check: p-value < 0.05? Confidence interval? | v 6. DECIDE Significant → ship winner Not significant → test was inconclusive, not "A wins"

Client-Side vs. Server-Side Splitting

Client-side: JavaScript modifies the DOM after page load. Fast to set up, but may cause a "flicker problem" — users see the original version flash before the test variation loads. Examples: Optimizely, Google Optimize (deprecated), VWO.

Server-side: The server decides which variant to render before sending HTML. No flicker, full control, but requires developer integration. Tools: LaunchDarkly, Split.io, custom feature flag systems.

Cookie-Based Bucketing

The simplest A/B implementation assigns users to groups using a cookie:

// Simple A/B bucketing
function getVariant(testName) {
  const cookieKey = `ab_${testName}`;
  const existing = document.cookie
    .split('; ')
    .find(c => c.startsWith(cookieKey + '='));

  if (existing) return existing.split('=')[1];

  // Assign randomly
  const variant = Math.random() < 0.5 ? 'control' : 'treatment';
  document.cookie = `${cookieKey}=${variant}; path=/; max-age=${30 * 86400}`;
  return variant;
}

// Usage
const variant = getVariant('cta_text');
if (variant === 'treatment') {
  document.querySelector('.cta-button').textContent = 'Get Started';
}

Multivariate Testing (MVT)

MVT tests multiple elements simultaneously (headline, image, button color). A full factorial MVT with 3 headlines × 2 images × 2 buttons = 12 combinations, each needing sufficient sample size. MVT requires enormous traffic volumes and is generally impractical outside high-traffic sites. It also begs some very careful experiment design lest you jump to the wrong conclusions.

Statistical significance is not optional. Most A/B tests need thousands of conversions (not visits — conversions) to reach significance. Peeking at results early and declaring a winner is called the "peeking problem" and invalidates the statistics. A test showing variant B at +15% after 2 days might show +2% (not significant) after 2 weeks. If your site has low traffic, you probably cannot run valid A/B tests — and running invalid ones is worse than not testing at all. This is another example of something that simply doesn't make sense for small players and may actively lead you to a wrong conclusion. Recall the Prof's point about 1,10,100,1000,100,000, FAANG scale type customer bases, you will use different analytical techniques at different levels. Jump on "best practices" from the tech leaders at your peril!

9. Session Replay Up Close

Session replay tools (FullStory, Hotjar, LogRocket, PostHog) let you "watch" recordings of user sessions. But these are not screen recordings — they are DOM reconstructions built from serialized page state and mutation events. This section builds on the Analytics Overview introduction to session replay in Section 13.

How Replay Works

The replay pipeline has three stages:

Session Replay Data Pipeline ================================================================================ 1. CAPTURE (Browser) 2. TRANSMIT 3. RECONSTRUCT (Viewer) +------------------------+ +------------------+ +------------------------+ | | | | | | | Initial DOM snapshot | -----> | Compressed | | Rebuild initial DOM | | (full page serialize) | | event stream | | | | | | via WebSocket | | Apply mutations in | | MutationObserver | -----> | or batched | | sequence with timing | | (DOM changes) | | POST requests | | | | | | | | Overlay mouse/scroll | | Mouse/scroll/input | -----> | ~50-200 KB/min | | events on timeline | | events with timestamps | | per session | | | | | | | | Redact PII from | | CSS snapshots | -----> | | | masked fields | | (stylesheets, computed)| | | | | +------------------------+ +------------------+ +------------------------+

The core technology is the MutationObserver API. Libraries like rrweb (open source) serialize the initial DOM as a virtual DOM tree, then record every mutation (element added, removed, attribute changed, text changed) with timestamps. On playback, mutations are replayed in sequence to reconstruct the visual experience.

Fidelity Challenges

Dev Choices, Analytics Headaches Here we see that the choice of technical frameworks and libraries can significantly impact the effectiveness of analytical systems such as session replay tools. Developers must consider the trade-offs between performance, maintainability, and compatibility when choosing these tools because such choices may ripple far downstream. We've already seen this with the social media generation effect on web dev, such as React by default, CSS-in-JS, etc. where things that can deeply impact user outcomes are applied because of belief despite clear data at scale showing these problems (see: The Market for Lemons). LLMs are going to hyperscale this effect sadly.

From Replay to Heatmaps

Individual session replays is more qualitative data. Aggregating interaction data across thousands of sessions produces quantitative visualizations:

Nobody watches replays at scale. A site with 10,000 daily sessions generates 10,000 replay recordings per day. Nobody watches more than a few dozen. During the initial stages of a site or app and when introducing a new feature to a cohort of users this data is invaluable. However, at scale you are more likely to condense this type of data into metrics and watch a few key replays. Remember too much data can be just as bad as too little!

10. Analytics for Usability

Behavioral analytics is not just for marketing. It is a powerful tool for verifying usability — confirming (or contradicting) what qualitative UX research suggests.

The HEART Framework

Google's HEART framework provides a structured approach to measuring user experience at scale:

Dimension What It Measures Example Signals Example Metric
Happiness User satisfaction, attitudes Survey responses, NPS, ratings CSAT score after task completion
Engagement Depth and frequency of use Session duration, pages/session, return visits 7-day active users / total users
Adoption New users picking up a feature Feature first-use events, signup rate % of users who tried feature X within 7 days
Retention Users coming back over time Return visits, churn rate, cohort curves Day-30 retention rate
Task Success Can users accomplish their goals? Task completion rate, error rate, time-to-complete % of checkout starts that result in purchase

Before/After Redesign Measurement

When you redesign a page or flow, analytics provides objective evidence of improvement (or regression):

Analytics is the smoke detector, not the fire investigator. Analytics tells you that something changed and where it changed. It does not tell you why. A 40% drop in checkout completion after a redesign is a fire alarm. Session replay, user interviews, and usability testing are the investigation that follows. Never skip from "metric dropped" to "I know the cause" without qualitative research. Also make sure to consider things far beyond the internet (example: holidays, news events, weather, Reddit posts going viral, etc.)

11. Voice of the Customer

Behavioral analytics captures what users do. Voice of the Customer (VoC) captures what they think and feel. Together they form a complete picture — the quantitative "what" and the qualitative "why."

The Quant/Qual Matrix

User research methods can be mapped along two axes: behavioral vs. attitudinal, and quantitative vs. qualitative.

Quantitative Qualitative (how many, how much) (why, how it feels) +--------------------------+---------------------------+ | | | Behavioral | Analytics, A/B tests, | Session replay, usability| (what users | click heatmaps, funnel | testing, field studies, | do) | analysis, scroll depth | diary studies | | | | +--------------------------+---------------------------+ | | | Attitudinal | Surveys (CSAT, NPS), | User interviews, focus | (what users | card sorting (quant), | groups, open-ended | say) | desirability studies | feedback, contextual | | | inquiry | +--------------------------+---------------------------+

The most common mistake is staying in one quadrant. Organizations that only look at analytics (top-left) know what happened but not why. Organizations that only interview users (bottom-right) know what users say but not what they actually do. The strongest insights come from combining quadrants.

VoC Methods

Method Timing Scale What It Reveals
On-page survey During visit High (1000s) "Did you find what you were looking for?" — task success from user's perspective
Exit survey On exit intent Medium (100s) Why users leave without converting; abandonment reasons
NPS (Net Promoter Score) Post-interaction High (1000s) "Would you recommend?" — loyalty proxy (0–10 scale)
CSAT (Customer Satifisfaction Score) Post-task High (1000s) Satisfaction with specific interaction (1–5 scale)
Feedback widget Any time Low (10s–100s) Self-selected issues; biased toward extremes (very happy or very angry)
User interview Scheduled Low (5–15) Deep understanding of mental models, workflows, unmet needs
Diary study Longitudinal Low (10–30) Behavior over time; habits, context, emotional journey
Session + survey hybrid During visit Medium Links subjective feedback to objective behavior for the same session
The most important analytics data point is the one you cannot collect automatically — what the user was trying to do. A pageview tells you someone loaded a page. A scroll depth event tells you they read halfway. But only asking the user can tell you they were looking for a phone number that was buried in a PDF three clicks deep. VoC closes this gap.
NPS has become a cult metric. Organizations plaster "What's our NPS?" on dashboards, tie bonuses to it, and treat a single number as a comprehensive measure of customer health. But NPS has serious methodological problems: it collapses a rich distribution into three buckets (detractor/passive/promoter), it is culturally biased (different countries cluster differently on the 0–10 scale), and the "would you recommend?" question does not apply to many products (nobody "recommends" their insurance company). A single number cannot capture the complexity of user sentiment.
All metrics are kind of bad, some are useful For an alternative take on NPS and other metrics consider that metric imperfection significantly pre-dates the internet, for example: Big Mac Index, Hemline Index, Q Score, and so on. Even MPG (Miles per gallon) has issues! Remember, "your mileage may vary!"

The internet has only amplified this problem. For example, the rise of social media has led to a proliferation of metrics that are often used inappropriately or without proper context. Additionally, the rise of big data and the rise of machine learning and AI has led to a proliferation of metrics that are often used to make decisions without proper understanding of the underlying algorithms.

12. Data Interpretation Pitfalls

Collecting behavioral data is the easy part. Interpreting it correctly is where organizations consistently fail. The following pitfalls are not edge cases — they are the default mistakes that most analytics practitioners make.

The Unique Visitor Illusion

The same person routinely appears as multiple "unique" users: different browser at work, phone on the commute, tablet at home, private browsing session for gift shopping, and a fresh identity after clearing cookies. Studies consistently show that cookie-based unique visitor counts are inflated by 20–40%. When someone reports "we have 100,000 monthly unique visitors," the actual number of people is more likely far less 80k, 60k, 40k, it could be quite different!

Inferring Intent from Clickstream

A user clicks on a product page. Did they want to buy it? Maybe. Or maybe they:

Clicks are ambiguous. Treating every click as a signal of interest is a category error.

Single-Metric Thinking

Optimizing one metric in isolation almost always degrades others:

Averages Hiding Distributions

Hopefully, we know the danger of averages as opposed to distribution. Recall the Prof's average net worth joke (Gates, him, and a student). The average issue is alive and well in behavioral analytics. For example, an average session duration of 2 minutes and 30 seconds sounds reasonable. But the actual distribution is often bimodal: 60% of sessions are under 10 seconds (bouncers), and 40% are 5+ minutes (engaged users). The "average" of 2:30 describes nobody. Always look at distributions, not averages.

Correlation vs. Causation

Pages with high time-on-page are not necessarily "good" pages. They might be confusing pages where users struggle to find information. Pages with high exit rates are not necessarily "bad" pages — they might be the page that successfully answered the user's question. Without additional context (task completion, satisfaction surveys), behavioral metrics are ambiguous.

The Denominator Problem

Conversion rate depends entirely on who you count in the denominator. A checkout conversion rate of 3% could be:

The same conversion event produces wildly different rates depending on the denominator. When comparing conversion rates across companies or benchmarks, the denominator is rarely the same.

Simpson's Paradox

A metric can go up in every segment but down overall. This sounds impossible but happens regularly when segment sizes shift:

Segment Week 1 Conv Rate Week 2 Conv Rate Trend
Mobile (small volume) 2% (of 1,000) 3% (of 8,000) Up
Desktop (large volume) 8% (of 9,000) 9% (of 2,000) Up
Overall 7.4% (of 10,000) 3.6% (of 10,000) Down

Both segments improved, but overall conversion dropped because the mix shifted toward the lower-converting segment (mobile). Aggregate metrics without segment decomposition are misleading.

Bounce rate is the most misunderstood metric in web analytics. A 90% bounce rate on a blog post that answers the user's question in 10 seconds is a success, not a failure. The user arrived, got their answer, and left satisfied. A 20% bounce rate on a landing page designed to drive signups might be great — or it might mean users are confused and clicking around randomly. Bounce rate without context is noise.
When someone presents a single number to explain user behavior, they are almost certainly wrong. Human behavior is multivariate; single-metric explanations are comforting fictions. "Users leave because load time is 4 seconds" might be true, or the content might be irrelevant, or the design might be confusing, or all three. Demand critical thinking and multivariate analysis if possible.

13. JavaScript Availability

Behavioral analytics overwhelmingly depends on client-side JavaScript. What happens when JavaScript is not available?

The Facts

The UK Government Digital Service (Gov.uk) conducted a widely-cited study finding that approximately 1.1% of users did not receive JavaScript-enhanced pages. But the reasons are critical — and routinely mischaracterized:

Cause Frequency Nature
Network interruption (JS failed to download) Most common Delivery failure
Corporate proxy/firewall stripping scripts Common in enterprise Delivery failure
Content Security Policy blocking inline/external JS Varies Configuration failure
Prior script error breaking subsequent scripts Common Cascading failure
Browser extension blocking scripts (ad blocker) ~15–30% of desktop users Deliberate (potentially more common than believed)
User deliberately disabled JS Negligible (<0.1%) Deliberate
The "2% of users have JS disabled" talking point might be wrong about the cause. Few people deliberately disable JavaScript. The real issue is delivery: networks fail, proxies interfere, CDNs go down, CSP policies misconfigure, and one broken script breaks everything after it. This matters for analytics because your analytics script is subject to the same delivery failures. If your analytics depends entirely on client-side JS, you have a systematic blind spot for exactly the users having the worst experience.

Implications for Analytics

14. Behavioral Data Quality

Every data source has blind spots. Behavioral analytics data is particularly susceptible to quality issues because it deeply depends on client-side collection, user identity, and consent. This section builds on the data quality discussion in Analytics Overview Section 16.

Identity Resolution Failures

Connecting multiple sessions to the same user requires identity resolution. Common approaches and their failure modes:

Session Stitching

When a user logs in mid-session, you need to retroactively connect their anonymous pre-login activity to their authenticated identity. This is called session stitching. It sounds simple, but it creates data pipeline complexity: you must rewrite historical records, update aggregations, and handle the case where the anonymous session was already attributed to a different user.

Consent-Biased Sampling

Under GDPR and similar regulations, analytics often requires consent. Users who accept cookies are systematically different from users who reject them. Consent-accepting users tend to be:

Consent bias is systematic sampling error. If only 60% of your visitors consent to tracking, your analytics data represents a biased 60% — not a random 60%. Conclusions drawn from this sample may not generalize to the full population. This is not hypothetical: studies show consent rates vary dramatically by country (90%+ in some markets, 40% in Germany) and by user demographic. Your analytics is measuring a filtered population.

Survivorship Bias in Funnels

Funnel analysis only shows users who entered the funnel. It cannot show users who should have entered but were blocked by a bug, a confusing CTA, or a page that failed to load. The most important drop-off might be before step 1.

Client Clock Unreliability

Client-side timestamps depend on the user's device clock, which can be wrong by minutes, hours, or even days. This affects:

Server-side timestamps are more reliable but measure arrival time, not interaction time. Best practice: record both and use server time for ordering, client time for duration calculations.

15. GDPR & Behavioral Privacy

Behavioral analytics collects detailed records of what people do online. Privacy regulation exists because this data, in aggregate, creates a surveillance infrastructure. This section builds on the privacy discussion in Analytics Overview Section 9.

Consent Banner Reality

GDPR requires informed, specific, freely-given consent for non-essential cookies and tracking. In practice, consent banners have become a dark pattern battlefield:

Dark pattern consent banners are under active enforcement. French CNIL fined Google €150M and Facebook €60M in 2022 for making rejection harder than acceptance. The trend is toward stricter enforcement. Designing manipulative consent UX is not just unethical — it is increasingly a financial liability.

Depth vs. Data Minimization

GDPR's principle of data minimization requires collecting only what is necessary for a stated purpose. This directly conflicts with behavioral analytics' desire for maximum depth:

Analytics Goal Data Needed Minimization Tension
Page popularity Page URL + count Low — no personal data needed
User journeys Session-level page sequence Medium — requires session identity
Cross-session behavior Persistent user ID High — requires persistent tracking
Session replay Full DOM + interactions Very high — captures everything on screen

Privacy-Preserving Alternatives

Server-Side Tracking: The Privacy End-Run

As browsers restrict client-side tracking, organizations are moving tracking server-side. Instead of the browser sending data to 15 vendor endpoints, it sends one request to your server, which forwards data to vendors via server-to-server API calls. This bypasses ITP, ad blockers, and CSP restrictions — which is precisely why privacy advocates see it as an end-run around user protections.

16. Data Lakes, Warehouses, CDPs

When analytics outgrows a single tool — when you need to combine web analytics with CRM data, transaction data, support tickets, and advertising spend — you need data infrastructure.

The Modern Analytics Data Flow

Collection → Ingestion → Storage → Activation ================================================================================ COLLECTION INGESTION STORAGE ACTIVATION (Sources) (Pipelines) (Repositories) (Outputs) +------------+ +-----------+ +---------------+ +-------------+ | Web beacon |------->| |------>| | | | +------------+ | | | Data Lake | | Dashboards | | Mobile SDK |------->| ETL / ELT |------>| (S3 / GCS) | | (Looker, | +------------+ | | | Raw, cheap, | | Tableau) | | Server logs|------->| |------>| unstructured | | | +------------+ | | +-------+-------+ +-------------+ | CRM |------->| | | +-------------+ +------------+ | | v | | | Ad platforms|------>| | +---------------+ | ML Models | +------------+ +-----------+ | | | (churn, | | Support | | Data Warehouse| | LTV, rec) | | tickets | | (BigQuery, |--->| | +------------+ | Snowflake, | +-------------+ | ClickHouse) | +-------------+ | Structured, | | | | query-fast | | Ad Platforms| +-------+-------+ | (audience | | | sync) | v | | +---------------+ +-------------+ | | +-------------+ | CDP | | | | (Segment, |--->| Email/CRM | | RudderStack) | | (triggered | | Identity + | | campaigns) | | activation | | | +---------------+ +-------------+

Key Concepts

The "360-Degree View" Promise

Every CDP and data platform vendor promises a single, unified view of each customer. The reality:

17. The Privacy Abuse Trajectory

This section is the capstone cautionary tale. The same technologies that enable product analytics — event tracking, identity resolution, data warehousing — also enable a surveillance advertising infrastructure that most users do not understand and did not meaningfully consent to.

The Escalation Ladder

From Analytics to Surveillance ================================================================================ Level 1: Anonymous Pageviews "How many people visited our site?" Server logs, aggregate counts. Harmless. | v Level 2: Behavioral Tracking "What do visitors do on our site?" Session replay, click tracking, scroll depth. Useful. Still first-party, still within user expectation. | v Level 3: Persistent Identity "Who are these visitors across sessions?" Cookies, login-based tracking, fingerprinting. Starting to accumulate a profile. | v Level 4: Cross-Site Tracking "What do our visitors do on OTHER sites?" Third-party cookies, tracking pixels, ad networks. Now building a browsing history the user did not share. | v Level 5: Data Enrichment "What do we know about these people offline?" Data broker APIs: income, home value, political affiliation, health conditions, purchase history. Matched via email or IP. | v Level 6: Advertising Sync "Let's target these people with ads everywhere." Audience sync to Facebook, Google, programmatic exchanges. User sees ads based on profile they never consented to build. | v Level 7: Surveillance Profile "We know everything about this person." Identity graph companies (LiveRamp, Oracle Data Cloud) maintain profiles with 1000+ attributes per person. Sold to anyone willing to pay.

The Data Broker Ecosystem

Data brokers aggregate information from public records, purchase histories, loyalty programs, app SDKs, and web tracking into profiles that are sold to advertisers, insurers, employers, landlords, and law enforcement:

The gentle slope from analytics to surveillance. Nobody sets out to build a surveillance system. It starts with "let's understand our users better" and progresses through "let's personalize their experience" to "let's buy third-party data to enrich our profiles" to "let's sync our audience segments to ad platforms." Each step is individually justifiable. The cumulative result is that a person's browsing history, purchase patterns, physical location, income estimate, and health interests are compiled into a profile sold on the open market — and none of it required a single deliberate act of malice. This is what makes it insidious: the infrastructure of surveillance is built from individually reasonable decisions.

"Creepy Ads"

The most visible symptom of this infrastructure is the experience of seeing an ad for something you only discussed verbally, or searched for once in a private browser. The explanation is rarely "your phone is listening" and almost always "the data broker ecosystem is more extensive than you realized." Retargeting pixels, email-based audience matching, and household-level IP targeting combine to create an uncanny tracking experience that erodes user trust in the entire web.

18. Choosing Your Analytics Stack

There is no single "best" analytics tool. The right choice depends on your context:

Factor Simple / Privacy-First Product Analytics Enterprise / Full Stack
Site type Blog, marketing site, docs SaaS app, marketplace Large e-commerce, media
Tool examples Plausible, Fathom, Umami PostHog, Amplitude, Mixpanel Adobe Analytics, GA4 + BigQuery, custom
Budget $0–$20/mo $0–$2,000/mo $10,000+/mo
Setup complexity Single script tag Event taxonomy + SDK integration Data warehouse + ETL + team
GDPR stance Cookie-free, no consent needed Consent required for full features DPA + legal review + consent management
Key capability Pageviews, referrers, basics Funnels, cohorts, retention, feature usage Attribution, segmentation, data integration

Build vs. Buy

The CSE 135 course project occupies a useful position in this spectrum: you build a minimal analytics pipeline from scratch (collector, sessionizer, storage, API, dashboard). This is not because building your own analytics tool is practical for production use — it is because building it teaches you what the commercial tools do and where their limitations lie.

The course project exposes what commercial tools hide. When you build a collector, you discover that navigator.sendBeacon() drops data silently if the payload is too large. When you build a sessionizer, you confront the arbitrary nature of the 30-minute timeout. When you build a dashboard, you realize how easy it is to present misleading aggregations. This understanding makes you a more critical consumer of commercial analytics tools — and a more honest presenter of data.

19. LLMs and the Possibility of a Zero-Click Future

Everything on this page assumes a user visits your site. But what happens when they never arrive at all?

The Zero-Click Problem

A zero-click interaction occurs when a user gets their answer without clicking through to any website. This is not new — Google has been providing direct answers in search results (featured snippets, knowledge panels, "People also ask") for years. But LLM-powered interfaces (ChatGPT, Google AI Overviews, Claude, etc.) have dramatically accelerated the trend by synthesizing answers from multiple sources and presenting them as conversational responses.

The behavioral analytics implications are severe:

Precedent: Google News and Journalism

This dynamic is not hypothetical — it has already played out in journalism. Google News and similar aggregators display headlines, summaries, and sometimes substantial excerpts from news articles. Users scan the summary, get the gist, and move on without clicking through to the publisher's site. The result:

LLMs repeat this pattern at larger scale. The difference is that Google News at least sent some click traffic. An LLM that synthesizes your content into a conversational answer may send none.

What This Means for Behavioral Analytics

The entire behavioral analytics apparatus described on this page — the visitation model, engagement metrics, conversion funnels, attribution — assumes that user interest manifests as a visit. When interest is satisfied off-site by an LLM, the model has a structural blind spot:

Traditional Model LLM-Mediated Model ============================== ============================== User has question User has question | | v v Search engine results LLM synthesizes answer | from your content + others v | User visits your site <-- measurable v | User reads answer <-- invisible v | Pageview, events, v scroll, conversion <-- measurable User is satisfied <-- invisible | (never visits site) v Analytics captures it all Analytics captures nothing

This creates a troubling asymmetry: the users you can measure are increasingly an unrepresentative sample. They are the users who needed something an LLM could not provide — a transaction, an interactive tool, a complex multi-step process. The informational users, the ones in the awareness and consideration stages, are disappearing from your data entirely.

Analytics built for the click-through era may not survive the answer era. If your analytics strategy assumes that user interest = site visits, you are measuring a shrinking fraction of your actual audience. Organizations that rely heavily on content-driven organic traffic (publishers, documentation sites, educational institutions, e-commerce with long research cycles) are most exposed. The uncomfortable question is: how do you measure the value of content that is consumed but never visited?

Emerging Responses

The industry is grappling with this shift, but solutions are nascent:

This is a present problem, not a future one. Studies estimate that 60%+ of Google searches now result in zero clicks (the user's need is satisfied on the SERP itself). With LLM-powered search the trend accelerates. A real example of that is that the most popular CSS library, Tailwind, which is even heavily favored by the internal prompts of Claude and ChatGPT, is utterly collapsing, losing most of its business in a single year. (See Reddit Thread) To me, they are a canary since they represent the "hip devs." Observations of my firm's customers show a more modest but serious 10% at minimum drop-off with some as high as 30%. Bot traffic is, however, absolutely through the roof, so that in late 2025, we even had sites being DOSed (denial of service) by LLM bots. As of early 2026, we are seeing a significant tragedy-of-the-commons issue unfolding, and I am uncertain what the situation will be like when you read this. I can confidently say that if you are designing an analytics strategy, you must account for the possibility that your most valuable audience interactions are ones you may never see in a dashboard.

20. Summary

This page covered the behavioral and product side of web analytics — the practices, tools, and pitfalls of measuring what users do and acting on that understanding.

Key Terms & Concepts

Term Definition
Hit Any single HTTP request from client to server (images, scripts, HTML). The most granular and least useful behavioral unit.
Pageview The loading of one HTML document. In SPAs, must be fired as a "virtual pageview" on route change.
Event A discrete user action within a page (click, scroll, form submit, video play). GA4 treats everything — including pageviews — as events.
Session A group of interactions within a time window, typically ending after 30 minutes of inactivity.
User (analytics) An identifier (cookie, login ID, fingerprint) intended to represent a person. The gap between "identifier" and "person" is where data quality problems live.
Segment A subset of users filtered by shared characteristics (device, location, behavior, source). Where analytics becomes actionable.
Bounce rate Percentage of single-page sessions with no further interaction. GA4 redefines it as 1 − engagement rate. Widely reported, widely misunderstood.
Engaged session GA4 concept: a session lasting >10s, or with a conversion event, or with 2+ pageviews. Intended to replace bounce rate.
Scroll depth How far down a page a user scrolls, typically measured in quartiles (25/50/75/100%) via Intersection Observer.
Time on page Time between consecutive pageview timestamps. Undefined for the last page in a session.
Dwell time Time from SERP click to SERP return. Measured by the search engine, not available to site owners.
Attention time Time the page is visible and the user is active. Measured via Page Visibility API + interaction heartbeat.
Rage click Rapid repeated clicking on an unresponsive element. Strong signal of user frustration.
Dead click Click on a non-interactive element the user expected to be clickable. Signals a design/affordance problem.
Conversion Completion of a desired user action. Macro conversions are primary objectives (purchase); micro conversions are progress indicators (add to cart).
KPI Key Performance Indicator — a metric tied to a business objective that is actionable. Contrast with vanity metrics.
Vanity metric A metric that feels good but does not inform decisions (e.g., total pageviews, total registered users).
Funnel A sequence of steps a user takes toward a conversion. Each step narrows the population; drop-off rates reveal friction points.
UTM parameters Query parameters (utm_source, utm_medium, utm_campaign, etc.) that tag inbound links for campaign attribution. "UTM" = Urchin Tracking Module.
Attribution model A rule or algorithm for distributing conversion credit across marketing touchpoints (last-click, first-click, linear, time-decay, position-based, data-driven).
Incrementality test A holdout experiment that measures the causal impact of a channel by comparing conversion rates between exposed and unexposed groups.
ITP Intelligent Tracking Prevention — Apple Safari's system that limits cookie lifetimes and restricts cross-site tracking.
Walled garden A closed measurement ecosystem (Facebook, Google, Amazon) that reports conversions independently, often resulting in double-counting.
Third-party cookie A cookie set by a domain other than the one the user is visiting. Backbone of cross-site tracking; being phased out by all major browsers.
Tag manager (TMS) A tool (GTM, Adobe Launch, Tealium) that lets non-developers inject tracking scripts without code deploys. Enables marketing autonomy; risks performance and security.
Tag soup The accumulation of dozens of unaudited, overlapping tracking scripts in a tag manager container.
A/B test A controlled experiment showing two (or more) variants to random user subsets to measure which performs better on a target metric.
Statistical significance The threshold (typically p < 0.05) at which an observed difference is unlikely to be due to chance. Requires sufficient sample size.
Flicker problem In client-side A/B testing, the original content flashes before JavaScript swaps in the variant. Solved by server-side splitting.
Session replay DOM reconstruction of a user session from serialized page state and MutationObserver events — not a screen recording.
Heatmap Aggregated visualization of click density, scroll depth, or attention across thousands of sessions overlaid on a page screenshot.
HEART framework Google's UX measurement structure: Happiness, Engagement, Adoption, Retention, Task Success.
NPS Net Promoter Score — "Would you recommend us?" on a 0–10 scale, collapsed into detractor/passive/promoter buckets. Widely used, methodologically controversial.
CSAT Customer Satisfaction Score — a post-task survey measuring satisfaction with a specific interaction (typically 1–5 scale).
Voice of the Customer (VoC) Qualitative methods (surveys, interviews, feedback widgets) that capture what users think and feel, complementing behavioral data.
Simpson's paradox A statistical phenomenon where a trend in aggregate data reverses when broken into segments. Caused by shifting segment sizes.
Survivorship bias Analyzing only users who made it through a process, ignoring those who dropped off before entering. Common in funnel analysis.
Consent bias Systematic sampling error from only measuring users who accept tracking cookies. The consenting population differs from the full population.
Identity resolution The process of connecting multiple sessions and identifiers to a single user. Approaches: cookie-based, login-based, fingerprinting. All have significant failure modes.
Session stitching Retroactively connecting anonymous pre-login activity to an authenticated identity when a user logs in mid-session.
Data minimization GDPR principle requiring collection of only what is necessary for a stated purpose. Directly conflicts with behavioral analytics' desire for depth.
Dark pattern A UX design that manipulates users into unintended actions (e.g., making "Accept All" cookies prominent while hiding "Reject").
Progressive enhancement Building from a baseline HTML experience and layering on JS capabilities. Applies to analytics: start with server logs, add client-side for richer data.
Data lake Raw, unstructured data storage (S3, GCS). Schema-on-read — cheap to store, slow to query.
Data warehouse Structured, optimized analytical data store (BigQuery, Snowflake, ClickHouse). Schema-on-write — fast to query.
ELT Extract, Load, Transform — load raw data into the warehouse, then transform with SQL. Replaced older ETL because warehouse compute is now cheap.
CDP Customer Data Platform (Segment, RudderStack) — resolves identity across touchpoints and activates unified profiles to downstream tools.
Data broker A company that aggregates personal data from public records, purchases, apps, and web tracking into profiles sold to advertisers, insurers, and others.
Identity graph A data structure maintained by identity companies (LiveRamp, Oracle) that links multiple identifiers (cookies, emails, device IDs) to a single person.
Retargeting Showing ads to users based on their previous browsing behavior (e.g., "you looked at these shoes — here they are again on another site").
Privacy Sandbox / Topics API Chrome's replacement for third-party cookies — categorizes user interests on-device and shares only coarse topics with advertisers.
Confirmshaming A dark pattern where the decline option is worded to guilt the user ("No thanks, I don't want to save money").
Roach motel A dark pattern where signing up is easy but cancelling or deleting an account is deliberately difficult (hidden settings, phone calls, multi-step flows).
Zero-click interaction A user gets their answer from a search result, featured snippet, or LLM response without clicking through to any website. Invisible to site analytics.
AI Overview / LLM answer An LLM-generated summary that synthesizes content from multiple sources and presents it directly, reducing or eliminating click-through to source sites.

Section Summary

Section Key Takeaway
1. Visitation Model Hits, pageviews, events, sessions, users, and segments form a measurement hierarchy — but "unique user" is a fiction
2. Engagement Metrics Scroll depth, time on page, and click patterns measure quality of interaction — but high engagement can mean frustration
3. Measuring Outcomes Conversions and KPIs connect behavior to business value; vanity metrics feel good but do not inform decisions
4. Attribution Attribution models assign credit across touchpoints, but all models are simplifications — correlation, not causation
5. Attribution Challenges Cross-device, cookie limits, walled gardens, and double-counting make attribution data unreliable
6. Google Analytics ~85% market share creates a monoculture; free tier subsidized by advertising data extraction
7. Tag Managers TMS enables marketing autonomy but introduces performance and security risks; ungoverned containers are dangerous
8. A/B Testing Scientific method for the web, but requires statistical rigor — most sites lack traffic for valid tests
9. Session Replay DOM reconstruction via MutationObserver, not video; value is in automated aggregation, not watching individual replays
10. Usability Verification HEART framework structures UX measurement; analytics detects problems, qualitative research diagnoses them
11. Voice of the Customer VoC methods (surveys, NPS, interviews) provide the "why" that behavioral data cannot; combine quant and qual
12. Interpretation Pitfalls Unique visitor inflation, single-metric thinking, averages hiding distributions, Simpson's paradox — the default is to misread data
13. JavaScript Availability ~1% of users do not get JS, mostly from delivery failures — analytics has a systematic blind spot for broken experiences
14. Data Quality Identity resolution, consent bias, survivorship bias, and clock drift corrupt behavioral data systematically
15. Privacy Dark pattern consent banners, data minimization tension, and server-side tracking as a privacy end-run
16. Data Infrastructure Data lakes, warehouses, CDPs, and ELT pipelines power analytics at scale; the "360-degree view" is aspirational
17. Privacy Abuse Anonymous analytics escalates to surveillance through individually reasonable steps — this is what makes it insidious
18. Choosing a Stack Match tool complexity to your needs; the course project teaches you what commercial tools hide
19. LLMs & Zero-Click LLM-powered answers satisfy users without a site visit, creating a structural blind spot in all visit-based analytics; the journalism precedent shows this is not hypothetical
20. Summary Behavioral analytics is powerful, flawed, and ethically fraught — understanding its mechanics is the first defense against its misuse