Today we are launching a new feature called Private User Attributes. This feature allows our customers to collect event data from feature flag evaluation while controlling which user attribute fields are stored or exposed in other parts of the LaunchDarkly user interface.
In our feature management platform we use the stream of flag impression events generated by our SDKs to power many useful features—including attribute autocomplete, our users page, the flag status dashboard and A/B testing. Some of our customers have requirements to restrict Personally Identifiable Information (PII) from being sent to LaunchDarkly. Until now, these customer's only choice had been to completely disable any event data that might contain PII fields (emails, user names, etc.).
The introduction of Private User Attributes means all customers now have the the ability to selectively choose not to send back some or all user attributes. With this selective approach, customers can continue to view flag statuses, use A/B testing, and view and override attributes for targeted users while protecting sensitive data. We have also made several small changes to the LaunchDarkly web UI to display when attributes are not available and offer reasonable choices when data has been marked as private and is unavailable for display.
What is a Private User Attribute?
When a user attribute is declared private it can continue to be used for targeting but its value will not be sent back to LaunchDarkly. For example, consider the following targeting rule:
if e-mail endsWith "@launchdarkly.com" serve true
To implement this in your application, you’d make this call to LaunchDarkly:
ldclient.variation("alternate.page", {
key: "35935",
email: "bob@launchdarkly.com"
}, false)When this code is executed, a flag impression event would be sent back to LaunchDarkly containing the following data:
{
"key": "alternate.page",
"kind": "feature",
"user": {
"email":"bob@launchdarkly.com",
"key": "35935"
},
"value": true
}In the example above, LaunchDarkly has received the email address of a user. Suppose now that you want to target by email address but not send that personally identifiable address back to LaunchDarkly.
This is what private attributes are for—you can mark the email field ‘private’. If your application marks the email field private, you can still target by email address but LaunchDarkly will receive the following data:
{
"key": "alternate.page",
"kind": "feature",
"user": {
"key": "35935",
"privateAttrs": ["email"]
},
"value": true
}This data object no longer contains the targeted user's email address. Instead, there is a record that an email attribute was provided during feature flag evaluation but that its value has been excluded from the event data.
Ok, let's hide some stuff.
There are three different ways to configure private attributes in our SDKs:
- You can mark all attributes private globally in your LDClient configuration object.
- You can mark specific attributes private by name globally in your LdClient configuration object.
- You can also mark specific attributes private by name for individual users when you construct LDUser objects.
It should be noted that the user key attribute cannot be marked private, for this reason we encourage the best practice of not using any PII as the user key. For more in-depth docs you can look at the SDK Reference Guides.
How do private attributes work for mobile and browser SDKs?
You might recall that our mobile and browser SDKs work slightly differently—flags are evaluated on LaunchDarkly's servers, not in the SDKs. We still support private user attributes for these SDKs; when evaluation happens, we do not record any data about the user being evaluated. For analytics events, these SDKs strip out private user attributes the same way our server-side SDKs do, so your data is still kept private.
How will marking attributes private affect my experience?
At LaunchDarkly usability is critically important to us (after all, we use LaunchDarkly to build LaunchDarkly). In thinking through the impact of reducing the amount of data that is visible we wanted to still provide an intuitive UX for existing features. Because we record the name—but not the value—of a private attribute, name autocomplete will continue to function for private attributes in the UI, but autocomplete will not be offered for attribute values. We also indicate which attributes on a user are marked private on the User Page and when we are unable to predict a user's Flag settings because a targeting rule uses a private attribute. Below is an example of the User page for a user with attributes marked as private:
Why shouldn't I just make ALL my attributes private?
Making all your attributes private would limit some of the product features that rely on having attribute values available. For example:
- The UI will not offer to autocomplete values. You'll be able to see the names of hidden attributes, but not their values. So you'll know that (e.g.) “email” is available for targeting, but you won't know (in the UI) what email addresses exist.
- Flag settings (on the users page) won't be exact. We'll be able to know if the user has a specific setting enabled, but we won't be to predict what variation a user is receiving because we won't be able to evaluate the targeting rules when hidden attributes are in play.
Given these limitations, our recommendation is that you selectively use Private User Attributes only for the purpose of securing PII.
We'd like to thank all the customers that provided feedback on this feature, we hope you enjoy not sharing your data.
