Im developing a webshop and i got a task asking for storing users searches. Is it legal?

It will be stored in a db with the fields Date, Search text, userId

closed as off-topic by Overmind, Serge Ballesta, Benoit Esnard, Teun Vink, Tobi Nary Feb 12 at 10:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Overmind, Serge Ballesta, Benoit Esnard, Teun Vink, Tobi Nary
If this question can be reworded to fit the rules in the help center, please edit the question.

  • If you do that without consent, no. Let the client choose if he wants that stored or not. – Overmind Feb 12 at 8:56
  • 1
    You might want to further specify, which countries law you are seeking advice for. There will probably quite a lot different legislations. – Euphrasius von der Hummelwiese Feb 12 at 9:11

You can store anonymous data regarding searches like search item, time made etc. Most websites employ a privacy policy that will outline what data they store (albeit vaguely) which will cover you to do what you outline but without one you must be very careful. To stay the right side of the law.

  • Which law? Can you specify? – schroeder Feb 12 at 10:01

It's dependant on your and your customer's jurisdiction, but I'm not aware of any jurisdiction where its illegal to simply store user searches, as long as your site discloses the data that is collected, how it's used, and how long you're storing them for. You should check the laws in your jurisdiction for details on what needs to be disclosed and how to disclose them. Some jurisdictions may require that you allow user to opt out of collection or to allow viewing and deleting data that is collected.

Also, you'll need to check if there are any other legal or industry specific regulations that apply to your business. For example, in Europe you may be subject to GDPR if you collect PII, if you use credit card PCI-DSS may apply, or if you run a medical data you may be subject to medical information privacy laws.

Not the answer you're looking for? Browse other questions tagged or ask your own question.