Using Google Analytics without GDPR consent
1–10 of 118 posts
Re: Using Google Analytics without GDPR consent
#2> `/ip=([\d.]*)\n/`
1. This is going to break if your clients are using IPv6.
2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don't know what that means as far as compliance.
Re: Using Google Analytics without GDPR consent
#3So sending a request to cloudflare to get your users IP makes this GDPR compliant? This is not how any of this works. Be careful when using this script.
In any case, the cloudflare dependency needs to be listed in your Data Protection page.
Re: Using Google Analytics without GDPR consent
#4> `/ip=([\d.]*)\n/` 1. This is going to break if your clients are using IPv6. 2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don't know what that means as far as compliance. [0]( https://www.groundlabs.com/blog/what-is-pii-for-gdpr/ )
If you hash your IP with a bunch of other fairly unpredictable and high cardinality information; it's no longer PII.
Re: Using Google Analytics without GDPR consent
#5Another frustrating "web analytics is evil" post, this time trying to not store PII in a service that disallows PII as part of their terms of service.
Re: Using Google Analytics without GDPR consent
#6Did you consider self-hosting Plausible?
Re: Using Google Analytics without GDPR consent
#7> `/ip=([\d.]*)\n/` 1. This is going to break if your clients are using IPv6. 2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don't know what that means as far as compliance. [0]( https://www.groundlabs.com/blog/what-is-pii-for-gdpr/ )
I wouldn't trust any article that purports to be about GDPR that uses the term 'PII' a term which itself isn't anywhere to be seen in the regulation!
In reality an IP address is generally not PII, but it may be personal data - the case is Breyer which was decided on pre-GDPR law but still relevant. If you could use reasonable means to identify someone from the IP address then it will be personal data. I don't really agree with the outcome of the case because it implied it was easy to contact an ISP to get them to disclose details of the subscriber information associated with the IP address. In the UK at least it would require cause, and a court order.
Re: Using Google Analytics without GDPR consent
#8Google recently introduced "Consent Mode" which basically disables cookie-based tracking and collects anonymous data only. I still find it problematic as Google probably doesn't need a cookie to identify you but it's at least something that is officially backed by Google, instead of a hack like this.
BTW if you use client information to derive an identifier that is unique within a session and you send that identifier to a third-party (e.g. Google) this approach gives you zero benefits. In fact ePrivacy & GDPR don't mention cookies anywhere and don't care what technology you use to derive identifiers, if they can robustly identify an individual or device and you actually send them to another service (for purposes that are not strictly necessary for the performance of your service) you're obliged to asked for consent.
Re: Using Google Analytics without GDPR consent
#9What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent.
What he is doing is illegal.
Re: Using Google Analytics without GDPR consent
#10Love the contrast between the title and the text. This isn't even about GDPR, it's about a completely different piece of legislation, the E-Privacy Directive. This is completely agnostic on personal data and so the post is largely flawed.
Even if you're not dealing with any personal data, if you're placing a cookie (or doing anything analogous device fingerprinting etc) you are in scope of the Directive and need consent, irrespective of GDPR.
The new E-Privacy Regulation is looking to implement an exception to consent for analytics but that would have providers like Google Analytics out of scope. Anyway, it's stuck in the mud at present...