Responding to Data Subject Requests with Coveo

Depending on the applicable privacy laws, data controllers are generally obligated to respond to a Data Subject Request (DSR) without undue delay.

A DSR is common under privacy laws. For example, the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”) both grant rights to individuals regarding their personal data, albeit to varying degrees.

Coveo and DSR

The Coveo Cloud Platform is built in order to allow its customers to answer DSR. In some cases, Coveo will reasonably assist its customers to respond to a DSR.

Usage Analytics and DSR

The following section presents the Coveo Usage Analytics (Coveo UA) features that can help Coveo Cloud customers fulfill some of their obligations as controllers. These features allow customers to identify, anonymize, export, and delete information about a specific user, as well as disable collection of usage analytics altogether.

The table below describes the general requests which may be related to Coveo UA. The Coveo client typically uses APIs or the Coveo Cloud Administration Console to fulfill end-user requests. Only Coveo Cloud Platform users using API keys with distinct privileges may communicate with Coveo UA to handle DSR. To enable full access to all Coveo UA features, the privileges to administrate UA data, export UA data, and delete user data are required. Coveo customers will then directly interact with the Coveo Cloud Platform, which fulfills the request without human intervention from Coveo.

Can I Know Who the Users Are?

Users that perform an action resulting in a usage analytics event are automatically attributed a usage analytics user ID such as alice.smith@example.com-google. For an anonymous user, the user ID defaults to a visitor ID such as 29fb0d0a-b5eb-4c20-aff0-9d282df11569.

The Usage Analytics Read API, under User Statistics API - Version 15 and up, exposes the GET /v15/users/{userId}/overview endpoint. This enables returning all usage analytics data related to a given user identified by their userId for a given organization.

GET https://platform.cloud.coveo.com/rest/ua/v15/users/{userId}/overview?org={organizationId} HTTP/1.1
 
Accept application/json
Authorization Bearer {accessToken}

Can I Anonymize a User?

Customers and partners choosing to not track their users must ensure that users are anonymous when the usage analytics data is sent to the Coveo Cloud Platform. It’s possible to anonymize users during their interactions with your sites.

To anonymize your users, depending on your search page:

• When using Coveo JavaScript Search Framework, set the anonymous option of the Analytics component to true.

  <div id="search" class="CoveoSearchInterface">
    <div class="CoveoAnalytics" data-anonymous="true"></div>
  </div>
  

• When using the Usage Analytics Write API directly, set the anonymous property to true whenever logging search, click, custom, or view events (see Logging Usage Analytics Events).

Can I Export All Data About a User?

When your Coveo account or an API key grants the Data Exports privilege, you may interact with Coveo UA to export user data. The Coveo Cloud Administration Console then permits full data export of user data if filters are used to tailor the export to a given userId in a given organization (see Understanding Usage Analytics Export Filters).

Can I Delete All Data About a User?

When your Coveo account or an API key grants the Delete user data privilege, you may interact with Coveo UA to delete user data. The Usage Analytics Read API, under User Statistics API - Version 15 and up, exposes the DELETE /v15/users/{userId}/alldata endpoint. This enables deleting all usage analytics data related to a given user identified by their userId for a given organization.

DELETE https://platform.cloud.coveo.com/rest/ua/v15/users/{userId}/alldata?org={organizationId} HTTP/1.1
 
Accept application/json
Authorization Bearer {accessToken}

Can I Disable Coveo Usage Analytics in a Search Interface?

A successful call to any of the following API endpoints (e.g., POST https://platform.cloud.coveo.com/rest/ua/v15/analytics/searches) will record a usage analytics event:

If you want to stop recording usage analytics in a search interface, you must ensure that no such calls are being made from that location.

In a search interface that relies on the JavaScript Search Framework, the simplest and most efficient way to disable usage analytics is to not initialize an Analytics component at all.