UserID overwrites VisitorID, but doesn't claim existing Visit

[SeverinEventfrog]

We run a webshop. Users can put items in their basket and stroll around, but only need to login with a userId when starting the checkout proceedure. We want to have all actions pre-login also assigned to the userId. However, when enable_userid_overwrites_visitorid = 1 is set (is by default), then Matomo will not find the existing visit pre-login and instead create a new visit for the userId. Thereby loosing a lot of user interactions, like looking at products and not buying them.

Expected Behavior

enable_userid_overwrites_visitorid = 1
Navigate to the home page
1 visit with 1 action with unknown user
Navigate to the login screen
1 visit with 2 actions with unknow user
Login and call setUserId function
1 visit with 3 actions with known user (merging all pass actions)
Logout
1 visit with 4 actions with know user (it continues to put actions in the same visit)

Current Behavior

enable_userid_overwrites_visitorid = 1
Navigate to the home page without any Cookie
1 visit with 1 action with unknown user
Navigate to the login screen
1 visit with 2 actions with unknow user
Login and call setUserId function
1 visit with 2 actions with unknown user
1 visit with 1 action with known user (it didn't merged the pass actions)
Logout and no longer use setUserId
1 visit with 3 actions with unknow user
1 visit with 1 action with known user

Possible Solution

When userId overwrites visitorId, the check for existing visits should also check for visits of the visitorId, if that one is supplied. As when the visitorId is supplied, the trackingrequest clearly states to be from that visitor. So claiming the visit with the newly supplied userID is expected behaviour and even documented here: https://matomo.org/faq/general/how-are-requests-with-a-user-id-tracked/
"When a user logs in, Matomo counts all actions before and after logging in as one user, one visit, and one unique visitor."

Inuitively, this check could be done only, if no active visit for the userId is found.
However, I would suggest claiming the given visit even if another already assigned to the userId exists, as they might be from different devices within 20 minutes and just adding to the older one would disconnect the newer visits's previous actions from the userId.

Pseudocode:
get_existing_visit(visitorId, userId){
visits.add(get_visits_by_visitorId(visitorId)) # make sure, that visitorId has not already been overwriten by userId!
visits.add(get_visits_by_userId(userId))
visits.sort_by_last_action_time()
return visits.pop()
}

Steps to Reproduce (for Bugs)

See Behavior, we use JavaScript Tracking and the _paq.push(['setUserId', 'USER_ID_HERE']);

Context

In our Webshop, we want to know what a user has looked at and done during one sitting. If they happen to log in, we want all their actions to be mapped to their userID. We want this mapping to work, even if the user deletes their Cookies. We also want to be able to use the Matomo UI to click on Visitor-Profile and see all past actions of that User ( not only Visitor!).

We are aware of this option:
enable_userid_overwrites_visitorid = 0
Navigate to the home page
1 visit with 1 action with unknown user
Navigate to the login screen
1 visit with 2 actions with unknow user
Login and call setUserId function
1 visit with 3 actions with known user (just setting userID, vistorID unchanged)
Logout
1 visit with 4 actions with know user (it continued to put actions in the same visit)
But then, should the user ever delete their Cookie or much more likely just use another device, they would get another visitorID. The userID link is our active workaround but is slow for DB SELECTS and the Matomo Admin UI will only show all actions of the same VisitorID and not userID.

Your Environment

• Matomo Version: 4.10.0
• PHP Version: 7.3
• Server Operating System: Debian 4.19.x
• Additionally installed plugins:
  ** FormAnalytics
  ** GoogleAnalyticsImporter
  ** HeatmapSessionRecording
  ** MediaAnalytics

For information:

Matomo 4.1.0 on Windows
Edge 87 without adblocker

[bx80]

Thanks for reporting this @SeverinEventfrog, the detail you've provided is very helpful 👍

Since this is a case of documented behavior no longer happening in the current release I'll mark this as a regression.

[janinaMi]

Hey, im expiriencing the same issue. Could you please prioritize the issue higher, because it really messes up the tracking data.
Maybe it would be a possibility for the matching in the isNewVisit() method to use not only the user-id generated visitor-id, but also the visitor-id, which would be active without user-id?

[bx80]

@mattab This appears to be the same issue as L3-265. Since it's a regression, should it be assigned to the next point release?

[sgiehl]

@SeverinEventfrog @janinaMi Are you only using the setUserId method when the user logs in, or does this also trigger something else, like setCookieConsentGiven or enableBrowserFeatureDetection?

[janinaMi]

@sgiehl I'm just using the setUserId method

[SeverinEventfrog]

We also only use setUserId and we only use it after the user logs in. CookieConsent does specifically not trigger it. The moethod is only triggered after the correct userID is known.

[Starker3]

We have another user experiencing this issue. Due to how their website is setup it makes it appear as though 60% of their visits are from user that are not logged in, even though their website requires an account to access it. This leads to inaccurate reports for them because the existing visit is not claimed when the User ID is set.

[Starker3]

We have another customer who is experiencing this issue. They have a website where users are required to be signed in to view any pages and created a Custom Report to track certain actions. That report contains two specific metrics:
Sum of Unique User IDs
Sum of Unique Visitors

The Sum of Unique Visitors is effectively 2x the Sum of Unique User IDs for any period they select.

[atom-box]

A customer has pointed out that because of this bug "we reported the wrong numbers" for more than half a year to senior management.

[atom-box]

Another customer reported the bug today:

We found that the visit log will separate into 2 logs after the customer login instead of updating the id in the same visit log / profile.

[raphael-kagermeier]

Hi @Starker3 and @atom-box, we had a similar issue with one of our clients.
We were able to recover this unexpected behavior by accessing the visitorLog via the API and merging visits within a short timeframe that had matching device and screen specs.

While this approach didn't alter the Matomo statistics, it served as an effective workaround given that we where already generating custom (excel) reports for our clients.

The specs we used to merge visits where:

• operatingSystem
• deviceModel
• browser
• language.

A simple merger plugin for Matomo might be a handy solution for the future, since realizing this misconfiguration is quite frustrating.

[michalkleiner]

We have tried to reproduce this issue to understand exactly the scope of the problem.
It might be a combination of different JS tracker settings such as cookie consent or browser features detection etc.

There were changes in Matomo 5 (PR 20096) related to the tracking requests that might address this so it would be good if the customers could confirm this is still an issue on Matomo 5.

Additionally, we aren't seeing if this worked previously, hence removing the regression label.

We acknowledge that there might be various issues around UserID tracking, but this will require a larger piece of work to fix holistically.

Let us know when you bump into any related issues so we can look into it better.

[MatomoForumNotifications]

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/two-sessions-instead-of-one-visitor-id-and-user-id/45230/9

[9joshua]

I can only reproduce this with a Brave browser. Unable to reproduce on Cloud or on-premise with Chrome and FF...

The Brave shield was disabled during my test.
My Brave _pk_id cookie still had the original visitor ID.

EDIT: The above test was using v4.15. I was unable to reproduce this with Matomo 5 RC1.