Remember the time when every serious homepage had a visitor counter? I don't recall any issues with privacy laws in those days. I think "tracking" back then was decentralized?
Using Google Analytics without GDPR consent
41–50 of 118 posts
Re: Using Google Analytics without GDPR consent
#42Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
honestly this is terrible advice. I know it's annoying to many people, but the EU isn't autonomously pursuing corps big or small - its legislation will kick into action if _anyone_ files a complaint after visiting your website, and you'll be subject to the same possible penalties as anyone.
Iirc, though, the law states that the fine will come only if you don’t comply with an initial warning, which will always have to be the first step. In that case, you can easily comply and not be fined.
Re: Using Google Analytics without GDPR consent
#43Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
Do you really need Google Analytics if you just have a small personal website?
Now that we know the privacy cost, is it worth sending yet another node of a user’s browsing behavior from a presumably well intended personal website?
Re: Using Google Analytics without GDPR consent
#44What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent. What he is doing is illegal.
Doesn't that make access log files illegal?
If they contain IPs, and are stored for >30 days, they're automatically illegal, yes.
Below 30 days it's a grey area as long as you only store as much information as is technically necessary (so e.g. for 14 days IP addresses could be okay, ask your lawyer about specifics), but you definitely need to inform your users about this.
Re: Using Google Analytics without GDPR consent
#45Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
This is vapid reactionary nonsense of the worst kind: The kind that gives you bad advice and appeals to you to accept it from a position of outrage. Anyone can and should make an informed choice not to follow rules they find problematic, that decision should not be based on how upset you feel.
Re: Using Google Analytics without GDPR consent
#46Earlier quoted context omitted.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.
Just read up on it and it's actually a bit more detailed, it requires active consent.
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
Statement 82 reads:
"The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions thatrequire an intervention from the data subject to prevent agreement(for example ‘opt-out boxes’)."
This in my mind pretty much invalidates most of the existing cookie banners out there, not to mention the multi layered messes some sites do (oath comes to mind).
Re: Using Google Analytics without GDPR consent
#47Earlier quoted context omitted.
You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?
The position was “don’t break laws that provide my right to privacy” The response is “what about all these laws you break yourself?” I don’t think that’s particularly valuable.
I think it is helpful to point out that some laws are poorly written, are pointless, too aggressive, or impossible to comply with properly. When someone realizes that there are laws they themselves break, hopefully they tone down their conviction that they're law abiding and others are not. This then helps to process the actual problems with individual laws.
Re: Using Google Analytics without GDPR consent
#48Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…
Additionally you are now doing an additional request to Cloudflare, which probably requires you to link to their privacy policy for that service?
Re: Using Google Analytics without GDPR consent
#49The GDPR is quite strict in that states in no uncertain terms when one needs to ask for consent. The notion "personal data" and "anonymized data" are quite clearly defined. [1][2]
> Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.
[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo... [2] https://gdpr.eu/eu-gdpr-personal-data/
Especially that last part is important. If the output of the algorithm can be reversed in a way that it can be tied to a person, you're violating the GDPR. The responsibility of choosing a good algorithm is very much yours. And so, that algorithm is a liability on your part.
Implementing a proper consent banner and adding a page with the correct GDPR information poses less of a liability when it comes to becoming GDPR compliant. There's plenty of information out there on how to do that properly. The EC even has a handy checklist just to get started: [3]
[3] https://gdpr.eu/checklist/
The notion "personal data" should also be interpreted in the broadest terms possible. Barring a few exceptions, the definition of "personal data" is really a limited set of principles that you are required to apply to a dataset rather then "these types and groups of data are protected, these aren't". The GDPR acts akin to a "right of way" principle which you are required to apply regardless of the context.
The nuclear way of becoming GDPR compliant without consent banners or GDPR notice pages is to not collect anything at all. Or even closer to home: not share anything with third party services.
I've done that exercise for myself, and that's something to take extremely literal when you start to think hard about it.
No Google Fonts. No analytics whatsoever. No using CDN's. No hotlinking. No embeds - No YouTube, Instagram, Google Maps, Vimeo,... - No collecting e-mail addresses for newsletters. No Avatars - no Gravatar - No comments - Not locally, not via Disquss. No keeping server side logs with IP addresses or any identifiable names.
It's not mentioned all too often, but the GDPR isn't about restricting what you can and can't do. It tries to enforce website owners to make conscious choices over the technologies and the platforms they use and the content strategy they would like to apply.
Looking at the author's site. Google Fonts is used, CloudFlare sets a cookie and the bottom of the page has a "subscribe to my newsletter" with a third party service. All of which are GDPR concerns.
Re: Using Google Analytics without GDPR consent
#50Peripherally related question. Is it GDPR compliant to hash a user's IP address to just a wide region and store only that? e.g. "Finland", "California", "Chennai". Just to get an idea of from where visitors come?
I'd like to add only usage tracking to my sites to see how they are used, but I have zero interest in selling or using user data for any other purpose. I could add a pop-up banner, but that's for consent on using personally identifiable information (and I associate it with sleaze, to be honest).