I'm currently in the progress of making a url shortening service that will let the creator see the http request headers that the browser has made when visitors visit the url.
The visitors won't be made aware that they are being tracked, but obviously nothing is personally identifiable.
Is there anything I should be made aware of ethically or legally that makes this a bad idea?
The visitors won't be made aware that they are being tracked
Wouldn't it solve your concerns to just...not do that? Tell them the request is being logged
I am sure privacy freaks will cringe, but I do not think there is a problem. You are not doing anything web logging does not do for every web request anyway.
It's a grey area, but I don't see anything wrong with it. It's the same info the site owners will see when the request gets redirected to their site, right?
I would note it somewhere on your service's home page or in the terms of use, but I think it is pretty safe to assume that web users know that their browsers send requests to servers, and that those requests will be recorded and analyzed unless they are told otherwise.
I thought a bit about it, and my first reaction was "Don't log more than necessary!" ... but then I thought "Why?". What worth is it to log all the headers? I mean, the data would not be much different to the data the user's browser sends to the webserver of the shortlink's target. The only header I'd consider worth logging would be the referer, since I assume that many people like to know how well their link is used and which page uses that link...
Having a Privacy Policy and explicitly notifying users are not the same thing, I don't believe. You can mention, in a privacy policy for the URL shortener, that this data is tracked, and that way someone who is concerned with their privacy will be able to find this information.
For example, bit.ly doesn't alert users to the fact that it tracks their activity, but it has a privacy policy available at http://bit.ly/pages/privacy/.
I don't know that you need to go so far as to specify that you are making header data available, other, perhaps, than to include what most sites (whether or not they are URL shorteners) that you track "non-personally-identifying information" and make that information available to whomever.