This article is quite fishy, by including the Google Analytics snippet you are always exposing your visitor's IP to Google.
Using Google Analytics without GDPR consent
21–30 of 118 posts
Re: Using Google Analytics without GDPR consent
#22Earlier quoted context omitted.
Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies. You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner. You can use your server logs to measure your audience.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
Maybe you don't want them but someone else who visits your website does. You can't assume everyone dislikes the same laws as you and since it's a law people kind of have a right to it.
Re: Using Google Analytics without GDPR consent
#23So sending a request to cloudflare to get your users IP makes this GDPR compliant? This is not how any of this works. Be careful when using this script. In any case, the cloudflare dependency needs to be listed in your Data Protection page.
This is a fair point. I wish there was a way to get a visitor's IP without the need to call a server.
That being said, my website is already served through Cloudflare, and this is an endpoint Cloudflare provides for debugging purposes.
I think this is ethically safe, but legally it probably is not. I definitely agree.
Re: Using Google Analytics without GDPR consent
#24For anyone looking for a GDPR-compliant solution without Google, take a look at Plausible. Not at all as mighty as GA, but it delivers the most important data IMHO.
Re: Using Google Analytics without GDPR consent
#25Earlier quoted context omitted.
Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies. You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner. You can use your server logs to measure your audience.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.
Re: Using Google Analytics without GDPR consent
#26Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
GDPR doesn't apply to personal websites where there is no company behind the website.
edit: here's a source: https://gdpr-info.eu/art-2-gdpr/
This Regulation does not apply to the processing of personal data:
(c) - by a natural person in the course of a purely personal or household activity;
Re: Using Google Analytics without GDPR consent
#27This is great info on how to substitute IP address or turn off user tracking. I do think the replacement is dubious ( especially forwarding to CF) and not GDPR compliment so I would use something else like user agent, timezone, languages to form a hash. It's doesn't need to be precise and in some ways it's good if it's a bit rough. I only want general trends on a website.
Re: Using Google Analytics without GDPR consent
#28Quick question on cookies in general:
Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages.
If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via bcrypt or some other password hashing scheme -> generates a long unique token and saves it in a DB -> sends it to the client via a cookie -> that cookie is looked up in the DB for a period of time which will then authenticate the incoming request.
This does not require a cookie banner whatsoever. Right?
Re: Using Google Analytics without GDPR consent
#29Earlier quoted context omitted.
Doesn't that make access log files illegal?
log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.
The key caveat here is:
Unless it's necessary. The legitimate interests basis of the GDPR allows you to make a balanced decision of your business requirements against user privacy expectations.
Re: Using Google Analytics without GDPR consent
#30Earlier quoted context omitted.
Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies. You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner. You can use your server logs to measure your audience.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
The position was “don’t break laws that provide my right to privacy”
The response is “what about all these laws you break yourself?”
I don’t think that’s particularly valuable.