Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Google Analytics without GDPR consent

evrim.io

Post reply on HN
Print view View original

81–90 of 118 posts

Re: Using Google Analytics without GDPR consent

#81

Post by lucb1e »

rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

Correct. You only need a banner for invasive tracking.

Normal visitor counting, login handling, preference setting, etc. is all allowed by default. Only when you don't have a valid reason to process the user's data, then you need to ask them for consent, and that's the only time you need a cookie wall. Everything else is opt-out.

Would be a crazy world if I ask the pizza store to deliver my pizza but I need to consent to them using my address to deliver it. It's obviously essential. Many people see it as such, though, and they resort to including weird clauses like "by hitting submit I consent to the processing of the data in the contact form for the purpose of fulfilling my request". That is like the definition of one of the legal bases you can use (aside from consent) and definitely does not require consent.

The law is quite readable and not overly elaborate, see Article 6(1) of the GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Example, 6(1)(a) says: "in order to take steps at the request of the data subject", so you don't need to have any GDPR checkboxes or banners when you have a contact form.

Re: Using Google Analytics without GDPR consent

#82

Post by dmitriid »

rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

https://gdpr.eu/cookies/

Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.

...

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

- Receive users’ consent before you use any cookies except strictly necessary cookies.

Re: Using Google Analytics without GDPR consent

#83

Post by tinus_hn »

krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

Googles system of removing the last part of the IP address exists specifically so you can be compliant. If you use tricks to store the data anyway, obviously you’re non compliant once more.

Re: Using Google Analytics without GDPR consent

#84

Post by damnencryption »

cooljacob204 wrote: post #77
Puts wrote: post #53

Earlier quoted context omitted.

Yes since GDPR states that personal data is any piece of information that uniquely identifies a living person, creating a unique identifier for each visitor by definition will make you a data processor.

So under GDRP are you not allowed to log who visits your site? For say... abuse protection? Assuming you do not share this data with any 3rd party.

No, GDPR explicitly carve out exception if for reasonable purposes. DDOS and abuse protection would fall under that. Marketing however won't.

Re: Using Google Analytics without GDPR consent

#85

Post by dkersten »

cooljacob204 wrote: post #77
Puts wrote: post #53

Earlier quoted context omitted.

Yes since GDPR states that personal data is any piece of information that uniquely identifies a living person, creating a unique identifier for each visitor by definition will make you a data processor.

So under GDRP are you not allowed to log who visits your site? For say... abuse protection? Assuming you do not share this data with any 3rd party.

You can, but you need to explicitly state in your data policy that this is what the data is used for and you can never use this data for any other purpose.

Re: Using Google Analytics without GDPR consent

#86

Post by marichards »

cooljacob204 wrote: post #77
Puts wrote: post #53

Earlier quoted context omitted.

Yes since GDPR states that personal data is any piece of information that uniquely identifies a living person, creating a unique identifier for each visitor by definition will make you a data processor.

So under GDRP are you not allowed to log who visits your site? For say... abuse protection? Assuming you do not share this data with any 3rd party.

IANAL: If you were allowed to use GDPR under an exemption, perhaps abuse protection, is that the only purpose the data will be used for by yourself and GA?

If you or a data processor you use, uses the data for secondary purposes not covered by any exemption to opt-in consent, I believe you would have to get opt-in consent for those secondary purposes beforehand.

Note: the cookie law is the ePrivacy directive (and national interpretations like PECR) and it goes beyond GDPR in some ways, as the ICO states "Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies." ( https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... )

Re: Using Google Analytics without GDPR consent

#87

Post by GordonS »

lucb1e wrote: post #81
rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

Correct. You only need a banner for invasive tracking. Normal visitor counting, login handling, preference setting, etc. is all allowed by default. Only when you don't have a valid reason to process the user's data, then you need to ask them for consent , and that's the only time you need a cookie wall. Everything else is opt-out. Would be a crazy world if I ask the pizza store to deliver my pizza but I need to conse…

I believe you are correct, but I believe you also need to have a cookie/privacy policy page, where you explain what data you are storing and processing. I forget off the top of my head if that's a requirement of GDPR or ePrivacy, but you need to comply with both.

Re: Using Google Analytics without GDPR consent

#88

Post by asdfasgasdgasdg »

krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

Seems like you could fix this issue by generating a random salt for the unique ID and placing it in local storage. Never send the salt value to the server, but incorporate it in the unique ID. This would keep the uniqueness property, but eliminate your ability to reverse the computation to retrieve PII.

Re: Using Google Analytics without GDPR consent

#89

Post by GordonS »

ratherbefuddled wrote: post #74

You don't need consent to share personally identifiable data like IP addresses with Google. For GDPR purposes you need a legal basis and "your legitimate interest" is one. You need to honestly assess - ideally write down - your determination of how your need to analyse website performance is balanced against the user's right to privacy. One thing you might consider here is the impact on the user. Then you need to ful…

> For GDPR purposes you need a legal basis and "your legitimate interest" is one. You need to honestly assess - ideally write down - your determination of how your need to analyse website performance is balanced against the user's right to privacy

Come on, analytics,especially 3rd party analytics, is never considered a "legitimate interest". As if it was needed, this is spelled out explicitly in the ePrivacy directive and official EU opinion documents.

Re: Using Google Analytics without GDPR consent

#90

Post by GordonS »

Dayshine wrote: post #29
simpss wrote: post #15

Earlier quoted context omitted.

log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.

The key caveat here is: Unless it's necessary. The legitimate interests basis of the GDPR allows you to make a balanced decision of your business requirements against user privacy expectations.

An example that's explicitly called out as allowed is using logs for security purposes.
Post reply on HN