UBIT Guidance: Understanding Website Privacy for University Sites

Category: Information Technology

Responsible Office: Information Security Office

Responsible Executive: Vice President and Chief Information Officer

Date Established: August 9, 2024

The University at Buffalo (UB, university) values the privacy of all its constituents and guests. It is imperative that individuals understand what data is collected by the university and how it is used so personal information can be managed effectively. The university is not authorized to sell or otherwise disclose the information collected from the website for non-university commercial marketing purposes.

To enhance UB’s digital capabilities third-party technologies and services which implement various cookies and digital tracking methods are used. This technology captures an individual’s information automatically, including:

• User client hostname; the hostname or internet protocol address (IP address) requesting access to the university website
• Type of browser and operating system used
• Date and time the site was visited
• Web pages or services accessed
• Website visited prior to visiting UB’s website
• Website visited after visiting UB’s website
• If information was downloaded from UB’s website, as well as what the information was

Third-party advertising and marketing providers, such as Google Analytics, will capture an individual’s information on behalf of UB. Examples of information captured by third-party service providers could include:

• Content viewed during the visit.
• Date and time of visit
• Amount of time spent on the website.
• Visitor location based on IP address.
• Demographic information
• Search terms entered on the website.
• UB uses information about website visits to monitor overall performance and make improvements to functionality and user experience, and to better connect with UB constituents by offering relevant information about university services, events, and educational programs. Automatically collected visitor information is used to:
• Improve the content and function of UB’s websites
• Analyze visitor engagement
• Conduct statistical analysis of website traffic and usage
• Analyze visitor interests and behaviors
• Detect attempts to damage or gain unauthorized access to the website and UB’s associated computer systems
• Identify candidates and profiles for re-engagement and outreach efforts; this may include more targeted advertising and remarketing programs, performing troubleshooting and root cause analysis, and offering relevant information about services, events, research, and educational offerings to better connect with UB’s constituent audiences and the global community

UB utilizes the following capabilities on buffalo.edu websites.

• Analytics Cookies - Count visits and traffic sources to measure and improve the performance of university websites.
• DoubleClick Cookies - Run to improve advertising, collects cookies which provide information specific to an individual’s browsing activity and keeps it linked to their unique cookie ID. Individuals can opt out of ad personalization in browser settings.

To improve reporting and advertising practices, UB uses numerous analytics remarketing and advertising reporting features which allow UB to monitor website performance, enhance ad delivery and avoid audience duplication. These reports provide no specific information on individual users and store data for 26 months. This information is used to enable cross-device reporting, cross-device remarketing, and cross-device conversion export to ads.

This guidance document serves as support for the University’s Website Privacy Policy, by providing detailed information related to the use of data collected for advertising and website performance tracking.

This guidance applies to visitors navigating official UB websites and associated third-party web applications. This policy does not apply to mobile applications.

Cookies

A small file stored on a visitor’s device, either temporarily for that session (session cookie) or permanently on the hard disk (persistent cookie). Cookies provide a way for the website to recognize visitors and keep track of the visitor’s preferences.

Official University at Buffalo (UB) Websites

Online content, both publicly accessible as well as material behind an authentication layer, owned or controlled by the university's formal academic and administrative units. These sites typically reside in, or resolve to, the buffalo.edu domain (though some may not, examples of such websites include but are not limited to, ubbulls.com, ubcfa.org, myubcard.com) and may serve any (or all) of the university's stakeholders.

Personal Information

Personal information means any information concerning a natural person which, because of name, number, symbol, mark, or other identifier, can be used to identify that natural person.

Third-Party Web Applications

Vendor-created, -provided, or -hosted technology solution that conducts official business for, or provides official service(s) to, the university or its constituents through an explicit contractual relationship.

Tracking Codes or Beacons

An often-transparent graphic image, usually no larger than 1-pixel x 1 pixel, placed on a website or in an email that is used to monitor the behavior of the user visiting the website or sending the email. Tracking codes or beacons do not contain personally identifiable information. Tracking codes collect traffic data and click information. This information is used to prioritize tasks, record visitor-specific web traffic, and associate web traffic history with unique visitors. A tracking code is a snippet of JavaScript code that tracks the activity of a website user by collecting data to report the effectiveness of website performance. A beacon is another form of tracking that confirms content has been accessed by a user.

Visitor

Natural person who uses the internet to access official UB websites and third-party websites associated with the university.

Privacy Compliance Officer

• Make decisions about records disclosure in accordance with applicable laws.
• Respond to the UB community about inquiries or complaints.

University Communications

• Promote awareness of the policy through established university communications channels, and demonstration of best practices.
• Provide a link to this policy in all UB website footers.

Procurement

• Determine that all contracts (purchases) with third-party platform providers include verbiage about compliance with this policy. This may include specific language that addresses vendor practices with respect to additional data collection, including financial data.

Vice President and Chief Information Officer

• Oversee all components of UB information technology.

Vice President and Chief Information Officer
Phone: 716-645-7979
Email: cio@buffalo.edu

Information Security Office - Privacy Contact
Phone: 716-645-6997
Email: privacy@buffalo.edu

• Data Access Procedure
• Freedom of Information Law (FOIL)
• Privacy Cookie Banner
• UB Minimum Security Standards for Desktops, Laptops, Mobile, and Other Endpoint Devices
• Website Privacy Policy