About access to the data, the page says: "access is limited to those with stat1 analytics server credentials". Right, so if a Wikimedia project runs a campaign they need to sync first with.. whom? and where? And if a 3rd party runs the extension in their wiki, do they also need to contact you?
Are you planning to make the access to data easier in the future? Like e.g. using the campaign value as a tag in the user account creation log.
A third party user wouldn't (and I don't think could) send the data to a Wikimedia analytics slave. To be honest I doubt third parties will be interested in this very much, considering this functionality is already built in to Google Analytics and most other modern analytics vendors.
The reason the data goes in to a restricted database is that, while userid and username etc. are public information, other parts of what is collected by Schema:ServerSideAccountCreation are not.
Using the campaign value to tag users in the account creation log is a good idea, and we could add it in the future. However, we might need to think more about security and validation of campaign names at that point. For instance: offsite trolling group or vandal inserts "campaign=OffensiveRacialSlur" in to a commonly used link, and account get tagged as "OffensiveRacialSlur". Right now if someone puts garbage or trolling in to a campaign name, it doesn't matter because the data has to be made public by hand. One way we could combat this is to publish aggregate campaign data only, perhaps in a Special page or the like, instead of tagging individual accounts.
In addition to what Steven said. I assume many/most valid campaign identifiers will lead to Usertagging, but that's different from publicly identifying users with campaigns. I can see why someone would want to contact users who created an account in response to a particular campaign, I suggest you follow up on Talk:Usertagging.
This post was posted by SPage (WMF), but signed as S Page (WMF).
