Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am building an app that communicates with my website with ASIHTTPRequest to a PHP-based REST API on the server side.

Naturally, in my app I have different endpoints on the server side, and usually return JSON data.

Is it unethical to log counters on how many times each endpoint was hit?

I'd like to capture how the app was used capturing what endpoint was hit, the user agent, time of day, possibly their IP (to group visits etc).

Should I ask permission to do this?

share|improve this question

migrated from Oct 30 '11 at 13:18

This question came from our site for professional and enthusiast programmers.

+1 for taking ethics into consideration. – Oscar Gomez Oct 28 '11 at 19:48
up vote 7 down vote accepted

It should be in your terms and conditions, but you should not have to inform the user. Technically this is the same as traditional HTTP server log files and running statistics against them.

I would however make sure that it's not possible to identify an individual user from the data as that may violate local or international privacy laws. They could opt in for that if they wish.

share|improve this answer

The only questionable piece of data that you are tracking is IP address. The rest is pretty generic. Any site implementing Google Analytics is tracking pretty much the same thing...without warning.

If you do want to track IP address (or anything else that could make the user personally identifiable), though, you should get permission before doing so.

share|improve this answer
I've posted a follow up question pertaining to IP information:… – barfoon Oct 28 '11 at 20:05
Further to this - what if I hashed the IP address? That way I couldn't get the IP back, but I could still group visits. – barfoon Oct 28 '11 at 20:07
@barfoon: on a technical point, there are only 2^32 IPv4 addresses, so hashing them isn't necessarily irreversible even with salt. More impenetrable would be to assign a randomly-generated token to each IP address, maintain a lookup table for a period of time (so that you can group requests by token for analysis), and then delete the lookup table to destroy the association between the token and the personally identifying information. Of course this means you can only group by IP over a limited period, once deleted that same IP address will get a different token next visit. – Steve Jessop Aug 18 '14 at 8:47

Nothing wrong with server-side tracking of access to your own site. Just don't spy on what the client might be doing that doesn't concern your site.

There's nothing questionable about logging IP addresses either. They can't be resolved to an individual without aid from law enforcement (or some other way to get their ISP to comply). In fact, they are essential if you're ever hit by an exploit and want to file charges.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.