This article is quite fishy, by including the Google Analytics snippet you are always exposing your visitor's IP to Google.
Not only that, but you empower Google with data about your site (eg. visitor numbers).
Using Google Analytics without GDPR consent
61–70 of 118 posts
Re: Using Google Analytics without GDPR consent
#62Remember the time when every serious homepage had a visitor counter? I don't recall any issues with privacy laws in those days. I think "tracking" back then was decentralized?
I keep saying this: centralization is the core issue of privacy. If every website would keep their own visitors data to themselves, no one would care and businesses would thrive. This is why I think the future is self-hosted, where every site is a complete platform that locally contains all the services it needs (eg. analytics, chat, etc.).
Re: Using Google Analytics without GDPR consent
#63Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
If you're just a small personal website and still need analytics, than just use a self-hosted solution, as it will be really cheap (or even free) to host and your data is never sent to 3rd parties.
For example, if you have a WordPress site, you could install https://www.usertrack.net as a WP plugin and all data will be stored locally.
Re: Using Google Analytics without GDPR consent
#64Tracking users is unethical. The law is there not so that you can wiggle your way around it, but to make a statement about this behavior. Laws are not scripts and they are not interpreted by computers. You are going to get fined for doing this, and it'll be well deserved. Do not spy on people. It's that simple. Don't use google analytics. Don't use any of the dozens of alternatives which are selling you "pro-privacy"…
User tracking and analytics, like most technologies, is ethically neutral. It's how people utilise it that has an ethical/moral component.
Even if your use of the collected data is ethical, exposing your users to a third-party's unethical use of the collected data is itself unethical IMO.
Using Google Analytics and similar services from companies whose entire business is built on stalking people is unethical and should be avoided.
Re: Using Google Analytics without GDPR consent
#65Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…
This is how I understand GDPR as well. Just hashing the IP address along with other static values is too easy to reverse and not considered anonymization under GDPR.
For https://plausible.io we added a daily salt to the hash for this exact reason. By deleting the salt at the end of each day, the hash becomes impossible to reverse and visitor data can be considered anonymous.
We lose unique visitor tracking beyond one day, but for most sites this is a small price to pay to remove annoying consent banners.
Re: Using Google Analytics without GDPR consent
#66Remember the time when every serious homepage had a visitor counter? I don't recall any issues with privacy laws in those days. I think "tracking" back then was decentralized?
Many of those also were incredibly simple, just counting requests, or at max setting a non-unique cookie to indicate "counted already", which has little privacy implications. And of course yes, privacy legislation and people's awareness of these things has evolved over time.
Re: Using Google Analytics without GDPR consent
#67Earlier quoted context omitted.
Additionally you are now doing an additional request to Cloudflare, which probably requires you to link to their privacy policy for that service?
This is probably little of a grey area. I don't think that the IP-address by itself is considered personal data since it usually doesn't single out a specific living person. Unless you pair it with other information, like date and time. But if IP was considered personal data you would need an active consent from the user where you also inform them why you are doing this, which paragraph in GDPR gives you legal right…
IP-addresses (with date/time of access) are considered personal data as stated by the ECJ in the case C‑582/14 from 2016 http://curia.europa.eu/juris/document/document.jsf?docid=184...
Re: Using Google Analytics without GDPR consent
#68Earlier quoted context omitted.
Additionally you are now doing an additional request to Cloudflare, which probably requires you to link to their privacy policy for that service?
This is probably little of a grey area. I don't think that the IP-address by itself is considered personal data since it usually doesn't single out a specific living person. Unless you pair it with other information, like date and time. But if IP was considered personal data you would need an active consent from the user where you also inform them why you are doing this, which paragraph in GDPR gives you legal right…
My IP address hasn't changed in over a year. I am the only one using that IP address. So no, it is not a grey area and yes, it is personal data.
Re: Using Google Analytics without GDPR consent
#69Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
GDPR doesn't apply to personal websites where there is no company behind the website. edit: here's a source: https://gdpr-info.eu/art-2-gdpr/ This Regulation does not apply to the processing of personal data: (c) - by a natural person in the course of a purely personal or household activity;
"personal or household activity" is not the same as "not a company", so it really can depend on what you are doing with your personal website.
Re: Using Google Analytics without GDPR consent
#70Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…
GDPR doesn't apply to personal websites where there is no company behind the website. edit: here's a source: https://gdpr-info.eu/art-2-gdpr/ This Regulation does not apply to the processing of personal data: (c) - by a natural person in the course of a purely personal or household activity;
You have misinterpreted that (which I understand if you're American, since the word personal have a different legal definition there).
Purely personal activities is not really interpreted as "I have a personal blog" sense, but in "I need to call my friends" sense. If you are indiscriminately processing data of possibly hundreds of people (note that at least on cases in Austria, it can be as low as 50 individuals), it is no longer purely personal and is now partially commercial, and unless you have other reasons to collect the data (research or you have actively obtained consent), you cannot simply do this.