The analytics event we chose not to collect

The proposed event was called form_field_hesitation.

Its purpose sounded reasonable. A long synthetic application form had a high exit rate in usability runs, and I wanted to know which fields caused people to pause, edit repeatedly, or leave. The first event sketch recorded focus duration, keystroke count, correction count, previous and next field, validation response, and—in the earliest version—the value present when focus moved away.

The raw value was clearly too revealing. Removing it made the proposal easier to defend and no easier to justify.

A sequence of focus times and correction counts across fields about identity, eligibility, and contact details could form an intimate behavioral trace without containing the literal answers. It might identify where effort occurred. It could not tell me whether the person was confused, interrupted, checking a document, considering a consequence, using assistive technology, or simply thinking.

The event promised precision about behavior and ambiguity about meaning.

This was the decision that clarified Q2F8. The project should not make every collection permissible after a click. It should require retained evidence to support a named decision proportionate to its detail.

I chose not to collect form_field_hesitation. The work was not finished when the event disappeared. Its absence needed an alternative research plan, enforcement at the client and server, a record of the rejected design, and tests preventing it from returning through a generic metadata field.

The proposal began with a dashboard shape

I could already imagine the visualization: one row per form field, average focus time, correction count, exit rate, and a bright marker for the apparent friction point.

That imagined dashboard made the event feel inevitable. Once a chart has a plausible axis, collecting the data required to fill it can look like implementation rather than a product decision.

I wrote the questions separately from the proposed measures:

Is one validation rule preventing continuation?
Is the service slow enough that people abandon the step?
Is the label or requested information unclear?
Does the form ask for information people do not have available?
Does the step create disproportionate effort for keyboard or assistive-technology users?

Focus duration answered none of them directly. Correction count could indicate an unclear format, a browser autofill conflict, a typo, or ordinary revision. Exit after a field did not prove that field caused the exit.

The dashboard would turn ambiguous proxies into tidy ranking. The visual clarity could exceed the evidential clarity and encourage me to redesign the wrong field.

Starting with the decision exposed how much interpretation the event asked the data to perform silently.

Removing values did not remove intimacy

The revised proposal kept only timing and counts. It felt anonymous because it contained no typed text or account name.

Behavioral sequences can still be identifying or revealing. A rare path through a form, precise timestamps, browser context, validation patterns, and session continuity can narrow a population. Even without direct identification, the trace may describe uncertainty around sensitive questions in more detail than the product needs.

The relevant comparison was not “raw value versus no raw value.” It was:

What decision is being made?
What is the least revealing evidence that can support it?
What additional risk and obligation does sequence detail create?

The decision was to improve a form step. I did not need to reconstruct individual hesitation to investigate it.

This changed how I thought about minimization. Removing obvious identifiers is one technique. Minimization begins earlier by choosing an evidence shape that cannot answer unnecessary questions even if somebody later wants it to.

The less flexible dataset was a feature because it prevented the system from becoming capable of replaying a person's path through sensitive fields.

Consent did not settle proportionality

The form prototype could present an optional measurement preference. Q2F8 could record an immutable receipt and enforce it at the server gate. If the person chose measurement, the event might be admissible under the declared test policy.

That did not make collection wise.

Consent is not a blank authorization to maximize detail inside a category. A person may agree to product measurement without expecting high-resolution timing around sensitive fields. Interface wording can be technically broad and still fail to make the actual observation understandable.

I asked whether I could explain the event plainly in the preference interface:

Record how long you focus each field, how often you edit it, and the sequence in which you move through this form.

The sentence revealed the intimacy that “measurement analytics” concealed. It also raised a product question: if the study requires this much explanation, is the evidence important enough to ask for?

For this decision, it was not.

Q2F8 therefore treated category grant as one admission condition, not a substitute for purpose, schema, minimization, retention, and deletion review. An allowed category could contain events the catalogue still refused to define.

The system needed the power to say no after consent, not only before it.

The event could not distinguish waiting from thinking

Focus time combines application time and human time.

A field can remain focused while someone reads nearby instructions, switches to another window, searches for information, takes a call, or leaves the device. The event might stop the timer on page visibility change, but browser visibility is an incomplete model of attention. A screen reader user may move virtual cursor while DOM focus remains stable. Speech input and alternative input methods create different timing patterns from typing.

Correction count was equally ambiguous. Replacing a full value through autofill could look like many changes. Input method editors create intermediate states. Validation formatting can rewrite a value. A paste followed by one correction may represent less effort than several deliberate keystrokes.

To make the metric more “accurate,” the instrumentation would need more context: visibility, input method, event sequence, validation timing, device, and perhaps DOM mutation detail. Each addition increased collection while failing to produce intent.

The proposal had a bad refinement curve. More observation made the trace richer faster than it made the conclusion valid.

That was evidence to change method rather than improve the event.

I replaced the hesitation trace with narrower evidence around form behavior:

• A named step became visible.
• A validation rule triggered, identified by stable rule category rather than entered value.
• The validation service responded within a coarse performance bucket or timed out.
• The person continued, explicitly requested help, saved, or left the flow.
• A server-side submission reached an allowed outcome category.

The event stream did not record each focus change, keystroke, correction, raw value, or complete within-step sequence. Timing was aggregated around named system transitions where performance was the question, not around each person's thought process.

This evidence could distinguish a slow validation service from a high rate of a specific rule. It could show that exits clustered after a step without claiming why. It could reveal whether an explicit help affordance was used.

The schema remained closed and versioned. Exact field values and free-form error messages were forbidden. Each record received a short retention deadline tied to the evaluation window.

The replacement answered fewer questions and produced fewer seductive interpretations.

Operational measurement separated machine delay

One original hypothesis was that address validation took too long. Measuring field hesitation would mix service latency with everything a person did before and after the request.

The application already knew when it called the validation service and when a result arrived. Q2F8 defined an operational event with coarse duration buckets and outcome category:

validation_rule: address_format | address_lookup
duration_bucket: under_250ms | 250_to_1000ms | over_1000ms | timeout
outcome: accepted | corrected | unavailable

The event contained no address, exact timestamp beyond the admission envelope, or field-edit sequence. Aggregation could reveal whether service performance warranted caching, fallback, or a different interaction.

Server timings offered even narrower evidence for infrastructure latency and did not require client behavioral detail. Client timing remained useful for network and rendering effects, but it could be sampled and aggregated without attaching a rich session history.

Separating machine delay from human behavior improved diagnosis. A long pause was no longer asked to stand in for a slow service.

This was a recurring design move: measure the system directly when the decision concerns the system.

Validation categories replaced raw errors

The early instrumentation proposed recording the current validation message. That text sometimes included user-entered fragments or provider detail. It also changed with copy edits, making aggregation unstable.

The validation system already had internal rule identities. The event mapped those identities into a small reviewed set:

required_missing
format_invalid
value_out_of_range
service_unavailable
conflict_with_existing_record

Not every internal error belonged in analytics. A rare sensitive case could be grouped into other_reviewed or omitted entirely. The mapping lived beside the event definition and had tests preventing raw message fallback.

The interface still displayed specific, humane error text to the person. Analytics did not need that text to count rule outcomes.

This separation improved both privacy and data quality. Copy changes no longer created new categories. The event measured the rule class used for a decision, while the product remained free to improve language.

A field can be specific in the interface and coarse in retained evidence. The two audiences do not need the same payload.

The narrow events could locate a step associated with failed validation or exits. They could not explain confusion, uncertainty, or emotional response.

I paired them with voluntary usability sessions using synthetic form content. Participants knew the purpose of the session and could describe their reasoning. Observation focused on labels, order, error recovery, and whether requested information made sense.

The sessions revealed issues the hesitation metric would have misread. One participant paused because the label implied a document was required when an estimate was acceptable. Another corrected a field repeatedly because automatic formatting moved the cursor. A keyboard user encountered the error summary but focus did not move to it clearly.

All three would appear as “hesitation.” Their remedies were different: copy, input behavior, and focus management.

Qualitative evidence was smaller in scale and richer in context. It did not become a collection-free moral shortcut; it required informed participation and careful note handling. For the product question, it was a more proportionate way to understand why.

Analytics located patterns. Conversation and direct task review explained mechanisms.

The rejected event entered a decision register

Deleting the code proposal would make the absence invisible. A future form project could reinvent field_dwell_time and repeat the same reasoning.

Q2F8 recorded non-collection decisions:

proposal: form_field_hesitation
intended decision: identify form steps needing redesign
rejected fields: raw value, focus duration, keystroke count,
  correction count, per-field sequence
reason: intimate behavioral trace with weak causal interpretation
alternatives: step outcomes, rule categories, service timing,
  explicit help, voluntary usability sessions
reconsider only if: a narrower concrete decision cannot be answered
  through these methods and a proportionate schema is proposed

The record linked catalogue rules and integration tests. It did not label the idea permanently unethical in every context. It preserved why this system, for this decision, chose absence.

The register also gave review language. A later property proposal could be compared with the original risks instead of debated from memory.

Architectural decisions often protect what exists. This one protected what should remain impossible.

Non-collection was enforced twice

The browser helper had no formFieldHesitation method. The raw tracking API did not accept arbitrary event names. Source tests asserted that focus and input listeners did not construct optional analytics envelopes for the form.

The server catalogue also had no definition. A handcrafted request using the rejected name failed as unknown_event. A generic metadata property containing focus duration failed the closed schema of every allowed form event.

Both layers mattered.

Client absence prevented unnecessary observation and transmission. Server absence prevented a stale or bypassing integration from making the event admissible. Closed schemas prevented the same data from hiding under an allowed name.

The test suite included a negative fixture:

grant measurement preference
exercise every form field and validation path
assert no focus, keystroke, correction, or raw-value event exists
attempt manual submission of rejected event
assert server rejection and no durable payload

Granting the category was deliberate. It proved that non-collection came from event-level purpose review, not merely from the person declining all analytics.

Absence became an invariant the architecture could defend.

During implementation, a tempting compromise appeared: keep the event disabled normally but allow it in a debug mode to investigate difficult sessions.

That mode would create the same capability under a less reviewed label. Debug flags spread, logs retain longer than expected, and reproducing a real problem can encourage capturing the real person's input.

Q2F8 used synthetic fixtures for detailed interaction traces. A local instrumented build could record focus and input behavior from generated data in a controlled session. Those traces were excluded from deployed collection and purpose storage.

Operational diagnosis used request identities, validation rule categories, service timings, and client error codes without field values. If a real report required deeper inspection, it would need a separate, explicit support workflow rather than a hidden analytics switch.

This preserved the ability to debug mechanics without building a latent session-observation feature.

The difference was not whether detailed traces could ever exist. It was whether the normal product architecture had the authority to create them from people using the form.

Aggregation would not cure the input

Another proposal collected the detailed event and immediately aggregated it, deleting raw records after a short window. The final table would contain average time and correction count per field.

Aggregation reduced retention of individual traces. It did not eliminate their initial collection, transport, temporary storage, access, or vulnerability. It also preserved the interpretive problem: average focus time still did not tell us why a field was difficult.

Small populations and rare paths could make aggregates revealing. Combining field sequence, time, and validation result across a narrow evaluation window could isolate a participant even without an account identifier.

The architecture would need queue policy, aggregation correctness, raw-record deletion evidence, group thresholds, and controls preventing secondary use. That machinery might be appropriate for a justified question. It was disproportionate here.

Choosing a narrower input was simpler than collecting richly and attempting to manufacture safety downstream.

Minimization at source removed both data and the systems required to govern it.

When I tried to assign retention, every number felt arbitrary.

Keeping the trace for a few days might support debugging but not a full evaluation. Keeping it for a month increased exposure. Indefinite retention was indefensible. The decision did not have a clear analysis window because the proposal had started as open-ended “friction insight.”

This was diagnostic. If I could not say when the evidence had served its purpose, the purpose was not specific enough.

The replacement events attached to a four-week form review. New admission ended after the window. Raw step outcomes expired soon after analysis. Coarse operational latency aggregates followed a separate short ongoing reliability purpose.

Retention did not make the replacement automatically appropriate. It connected collection to the decision's lifespan.

The rejected event's inability to earn a deadline was another reason not to begin collecting it.

May 2018 made the question harder to avoid

The General Data Protection Regulation had entered into force in 2016 and was about to become applicable on May 25, 2018. Across the industry, teams were reviewing consent, purpose, minimization, retention, access, and deletion with new urgency.

Q2F8 was a personal technical experiment, not a claim of legal compliance. The regulatory moment supplied factual pressure and useful principles. It did not let software decide which legal basis applied or whether a purpose was fair.

It would have been easy to respond to the period by building a better banner, storing consent receipts, and continuing every event that fit beneath the chosen category. The hesitation proposal showed why compliance-shaped mechanics were a floor, not the whole product judgment.

A collection can be technically consented to and still disproportionate to the decision. A policy can permit data the application does not need. A retention job can faithfully delete evidence that should never have entered.

The strongest privacy control remained not creating the record.

The alternative produced a better form

The narrow evidence and usability sessions led to concrete changes.

The address step explained why an estimate was acceptable. Validation waited until input reached a meaningful boundary rather than interrupting every change. Cursor behavior stopped fighting automatic formatting. The error summary received focus after failed submission and linked back to fields. The slow validation service gained a bounded timeout and a manual fallback.

None of these improvements required knowing how long an individual stared at a field.

The replacement events could verify that service timeouts and specific rule failures changed during the evaluation. They could not claim the redesign reduced anxiety or confusion. That limitation remained in the decision note.

The form became easier to use because the investigation matched methods to questions: operational measurement for machine delay, interaction review for focus and errors, voluntary observation for understanding, and narrow aggregate outcomes for broad patterns.

Less data did not mean less engineering. It meant the engineering concentrated on the actual mechanisms.

The event's absence survived later curiosity

After the form improved, a new question appeared: did people still revise the eligibility field more than other fields? The rejected trace would have answered with a count.

The decision register forced the question through the original reasoning. What action would change? Could rule outcomes or voluntary sessions answer it? Would revision count distinguish confusion from careful editing? What detail was proportionate?

The proposal did not pass. The field remained uninstrumented at the keystroke level.

This was the point of maintaining absence. Without the record and server constraint, each new curiosity would reopen the full capability. With them, reconsideration remained possible but had to bring a better decision and evidence design.

A non-collection decision is not a one-time act of restraint. It is a boundary future changes must cross deliberately.

The choice had real costs.

I could not reconstruct field-by-field paths. I could not compute pause distributions or correction sequences. I could not train a model to predict abandonment from detailed interaction. I could not revisit the old sessions with a new behavioral question that had not been defined during collection.

Those unavailable analyses were the consequence of minimization.

It is dishonest to describe privacy choices as producing every product benefit with no loss. The system gave up optional knowledge to reduce retained intimacy, interpretation risk, and lifecycle complexity.

The remaining evidence was sufficient for the decision at hand. A future materially different decision might justify new, still bounded collection. It would not inherit data merely because collecting had once been possible.

Capability was deliberately narrower than curiosity.

The absent event became the project's center

Q2F8 eventually contained a versioned event catalogue, closed property schemas, preference receipts, a server-side admission gate, retention deadlines, erasure workflows, and an audit surface.

Those mechanisms could make declared limits enforceable. The rejected event explained why limits needed to exist before enforcement.

The review sequence became:

1. Name the decision the data will support.
2. State the hypothesis and alternative explanations.
3. Compare methods, including non-collection.
4. Choose the least revealing evidence sufficient for the decision.
5. Define a closed schema, population, admission window, retention, and deletion path.
6. Enforce the definition at client and server boundaries.
7. Review the result within its known limits and retire collection.

form_field_hesitation failed at steps two through four. Building it and deleting it later would not have improved the architecture.

The most important event in Q2F8 is absent from every table. Its absence is not missing instrumentation. It is the product of an explicit technical and product decision, protected by schemas, code, server policy, and tests.

The system became trustworthy not because it could account for every event it stored, but because it retained the ability to refuse one that sounded useful.