Track PDF documents & files: track PDF opens or views & prints

Tracking PDF document use always sounds like a really neat idea.  When you track a PDF it should tell you who opened or printed a document, when it was, and where they did it.  At least in theory.

Why Track PDF documents?

There are normally three reasons for wanting document tracking:

1. Marketing analysis: Determine which are the most popular PDF documents in terms of how often users read them, rather than just numbers sold.  If you are tracking PDF opens, then you can see if a document is opened lots of times by the same person.
2. Authorized use: Did someone unauthorized try to open a document, or did an authorized person open it from a ‘strange’ location?  When you have a question about document distribution, you can use document tracking to see where they went.
3. Compliance: Management standards, such as ISO 9000 require that documents not only be produced and distributed, but that they also be maintained.  Tracking PDFs helps you to demonstrate full compliance with standards and regulations.

How to implement PDF Tracking

To track PDF opens, you have two choices.  You could use either a:

1. page server, handing individual pages down to a client
2. reporting server, which relays from the client when a user opens a document (and maybe when it closes, but most likely not).

The first thing to understand when tracking PDF documents is that you are forcing recipients to always be online.  The technology used to track PDF opens needs to ‘phone home’ to tell you what is happening.

From a business perspective, this could be a disaster.  Many people require offline access to documents, but a PDF tracker cannot accommodate this.  As a result, tracking PDF ebooks and magazines may not be such a good idea.

Tracking a PDF document and privacy issues

Privacy is becoming a bigger issue.  In many countries, you must register what it is that you intend to collect if it relates to personal information.  In the EU, the opinion is that anything linking a person to an IP address is personal data.  You also have to register what you will use the data for, and ask the consumer for their informed consent to track PDF opens, views, and prints.  Realistically, you will likely need to set up a raft of policies and procedures before you can track PDF use.

This does not apply to business users, but it may be a fine point.  Plenty of institutions, such as banks, do not, as a matter of policy, allow PDF tracking of documents used internally.  Some PDF tracker products cannot be used in those environments.

Tracking PDF documents and identifying users

Finally, when tracking a PDF file, who is the recipient?

On a home PC or laptop, it’s whoever is using it — though you don’t know who is actually sitting in front of the screen (unless proctoring software is installed, which is used to prevent cheating in online exams, tests, and courses).  For mobile devices, people are generally relaxed about letting others use them, so you may not be tracking what you think.

Secure data room systems that provide document tracking don’t really identify the user – they just identify a login.  Users can share their login details with others, so you have no idea who you are really tracking.  Some systems, such as Digify or DocSend, automatically remove tracking if you let users download or print documents.

  Tracking a PDF by IP or email address

It is useful to know where the PDF document is that’s being tracked, as this can give you an idea of whether it is being shared with others.

Some theories say you can track PDF documents by IP address, but that doesn’t mean much if you’re seeing an ISP with thousands of customers.  Users also regularly change IP addresses, use a proxy to mask their real IP address, or can use a VPN to share the same IP address with others.

Similarly, PDF tracking by email address is hampered if it’s not a company email address, since many people use freemail accounts to avoid identification and can share generic email accounts with others.

  Can PDF downloads be tracked?

Rather than protecting the document itself, some prefer to track PDF downloads.  There are various ways of doing this, and they’re usually quite easy to integrate into a website.  You can track the IP address a user downloads from (though this can be bypassed with a VPN), or make them sign in to an account to download a PDF and log the activity with their name and email that way.

Of course, this is merely a more limited approach to performing the IP or email address tracking mentioned above, and it has the same pitfalls.  This time, it has an even bigger flaw, though — if the document isn’t protected in some other way, the user can just share the first copy they downloaded with others, bypassing any download logging.

So, download logging is mostly useful for analytics purposes: knowing how many times users download each product for marketing or server bandwidth reasons.

   Can you see if a PDF has been edited?

Another desired form of tracking is being able to see whether a PDF has been edited. Preferably, what exactly has been changed, when, and by whom. This is often important for compliance, security, and the general integrity of documents. There are a few ways to know if a PDF has been edited:

• Last modified metadata: The “Last modified” field in a PDF file will give you an indication of when the PDF was last changed. You can compare this with the original version to tell whether a PDF has been re-saved after it was received. However, changing the metadata of a file is not difficult — several free online tools allow you to do so. This is therefore not a reliable way of telling if a PDF has been edited, and it doesn’t reveal exactly what has changed anyway.
• Digital signatures: Digital signatures are a more effective way of determining if a PDF has been modified or not as they are backed up by cryptography. Saving a modified document will invalidate the signature, making it clear to the sender that it has been changed. However, signatures are far from infallible. Technical users can bypass flaws in the partial encryption to insert content undetected.
• Cloud document collaboration: Some cloud document and data room services allow you to set to see the edit history of a document. This is useful if you give somebody else edit permissions but need to vet the final version. However, such services do not typically support PDFs, and editing permissions usually grant a broad range of functionality including making copies of the document, printing, and downloading. Copying the document removes any version history, meaning users can still misuse and share modified versions of your document. Of course, this kind of feature also requires an internet connection, which isn’t always feasible.

Due to there being no good way to prevent abuse or ensure integrity when PDF editing is enabled, edit tracking is best employed in the draft phase with trusted parties. After distribution to a wider audience, it is more secure to prevent editing entirely. Instead, edits can be suggested through the use of comment and highligting tools that do not modify the original PDF.