University Policies and Procedures Manual (previously Business Policies and Procedures Manual)

Online Privacy

UPPM 88.30

For more information contact:
   Marketing and Communications
   Information Technology Services

1.0   Overview and Purpose

Washington State University (WSU, University) is committed to protecting the privacy of users of its websites, as well as ensuring transparency regarding how it uses information gathered and compliance with applicable laws.

This policy addresses how WSU collects, uses, shares, and protects information that may be obtained through the use of websites maintained by all WSU entities.

2.0   Applicability

This policy applies to all users interacting with any WSU website.

3.0   Information Collected

3.1   Information Collected Automatically

WSU automatically collects and stores the following information:

  • The internet domain and IP address used to access a WSU website;
  • The URL of the website from which the user accessed a WSU website;
  • The browser and operating system used;
  • The date and time;
  • The pages visited, including:
    • The information requested through the user’s browser;
    • The response from the user’s browser;
    • The size of the page the user received in response to the request; and
    • The marketing email or web page that referred the user to the web page.

3.2   Information Provided by Users

In some cases, WSU may request that users provide certain personal information such as:

  • Name
  • Username
  • Email address
  • Mailing address
  • Telephone numbers
  • Social media account information

Additionally, if during a visit to a WSU website, the user participates in a survey, sends an email, or performs some other transaction online, the following additional information may be collected:

  • The email address and contents, for those who communicate with a WSU entity via email;
  • Information volunteered in response to a survey; and
  • Information volunteered through an online form for any other purpose.

The information collected is not limited to text characters and may include audio, video, and graphic information formats that the user sends to WSU.

WSU may aggregate information collected from a user’s visit to the website with other information it maintains.

4.0   Automatic Collection Methods

WSU may use cookies in conjunction with third-party service providers, including Google Analytics, to analyze search engine usage and web traffic patterns. This information is used in the aggregate to monitor and enhance WSU web pages.

Other technologies used may include:

  • Applets
  • Scripts
  • Server logs
  • Custom URL parameters
  • Tracking images
  • Information and correspondence
  • Web analytics

5.0   Use of Information

5.1   Use of Information Collected Automatically

WSU uses information it automatically collects only for lawful purposes to advance the legitimate interests of WSU. This includes:

  • To improve the content and functioning of a website;
  • To manage and improve the user experience and preferences associated with a WSU website and communication;
  • To track how often people access or read website content;
  • To optimize and personalize online interactions with WSU;
  • To identify anomalies in web traffic if needed to protect:
    • Personally identifiable information; and
    • WSU institutional information; and
    • WSU systems.
  • To exercise WSU’s legal rights, if needed, to defend against legal claims, or respond to subpoenas, court orders, or other legal processes; and/or
  • As needed for internal, state, or federal investigations.

5.2   Use of Information Provided by Users

When a user contacts WSU by email, WSU may use email to:

  • Respond to the user as needed;
  • Address issues identified, to improve a WSU website; or
  • Forward the email to a WSU department or another public agency for appropriate action.

Survey information is used for official University business described on survey web pages. Information from other online forms is used only for official University business or for purposes expressly stated on the forms.

6.0   Disclosure and Sharing

WSU may use third-party service providers and suppliers to facilitate a website or the services WSU provides. Those providers and suppliers may have access to the information WSU collects to fulfill their obligations to WSU.  

WSU may provide links on a website to non-WSU websites and may also partner with third parties to place WSU-related ads on non-WSU websites. Use of non-WSU websites is subject to the terms and conditions or privacy statements of those websites.

WSU is a state agency, and as such may disclose or share information in accordance with applicable state, federal, or international laws. This includes, but is not limited to, RCW 42.56, the Washington Public Records Act. In the event of a conflict between this policy and RCW 42.56 or other law, statute, or regulation, the law, statute, or regulation takes precedence.

7.0   Retention and Security

WSU retains data for at least the minimum required retention according to applicable WSU retention schedules.

WSU has taken steps to safeguard the integrity of its data and prevent unauthorized access to information it maintains. These measures are designed and intended to:

  • Prevent corruption of data;
  • Block unknown or unauthorized access to WSU systems and information; and
  • Provide reasonable protection of private information in WSU’s possession.

See UPPM Chapter 87.

8.0   User Rights

Applicable laws may give users additional rights to request access to, or to request the erasure, correction or transfer of, their data.

Example: The European Union’s General Data Protection Regulation (EU GDPR) provides certain rights to persons who are residing in the European Union when data is collected. If the EU GDPR applies, the user may ask to see their data or request, to the extent allowed by law, to have their data corrected or erased. They may also object to or request restrictions on how their data may be processed and may ask that their data be forwarded or transferred to another organization. Finally, to the extent allowed by law, they may withdraw consent to certain data processing, without penalty.

Additionally, state law requires agencies that collect personally identifiable information to provide “procedures for correcting inaccurate information, including establishing mechanisms for individuals to review information about them and recommend changes in information they believe to be inaccurate” (RCW 43.105.310). (See also Section 9.0.)

WSU does not knowingly collect personal information from children or minors as defined by the Children’s Online Privacy Protection Act (COPPA) on its general websites.

9.0   Contacts

Users should contact web.support@wsu.edu with any questions about this policy; concerns about their data, its collection or use; or to review or correct personal information.

10.0   Related Policies and Resources

UPPM Chapter 87 Information Technology and Security

_______________________
Revisions:  Dec. 2025 – NEW (Rev. 649)