Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Google Analytics without GDPR consent

evrim.io

Post reply on HN
Print view View original

101–110 of 118 posts

Re: Using Google Analytics without GDPR consent

#101

Post by PeterisP »

simpss wrote: post #26
dustinmoris wrote: post #14

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…

GDPR doesn't apply to personal websites where there is no company behind the website. edit: here's a source: https://gdpr-info.eu/art-2-gdpr/ This Regulation does not apply to the processing of personal data: (c) - by a natural person in the course of a purely personal or household activity;

A personal blog would likely qualify for that, however, many personal websites would not pass the test of "no connection to a professional or commercial activity" (from https://gdpr-info.eu/recitals/no-18/) - if you sell something on that site, or have ad revenue, or use it as advertisement for your professional consultations, then it's not purely household activity.

If you have a bootstrapped web startup project that you want to launch (e.g. collecting "pre-sales" signups from a minimum viable product), then it's definitely not purely personal or household activity even before you have registered a company.

Re: Using Google Analytics without GDPR consent

#102

Post by mekkkkkk »

asdfasgasdgasdg wrote: post #88
krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

Seems like you could fix this issue by generating a random salt for the unique ID and placing it in local storage. Never send the salt value to the server, but incorporate it in the unique ID. This would keep the uniqueness property, but eliminate your ability to reverse the computation to retrieve PII.

Wouldn't that just be a contrived session ID?

Re: Using Google Analytics without GDPR consent

#104

Post by asdfasgasdgasdg »

mekkkkkk wrote: post #102
asdfasgasdgasdg wrote: post #88

Earlier quoted context omitted.

Seems like you could fix this issue by generating a random salt for the unique ID and placing it in local storage. Never send the salt value to the server, but incorporate it in the unique ID. This would keep the uniqueness property, but eliminate your ability to reverse the computation to retrieve PII.

Wouldn't that just be a contrived session ID?

I'm not sure exactly the definition of a session ID, but maybe? It would be what I described, and if I described a session ID, then yes.

Re: Using Google Analytics without GDPR consent

#105

Post by lucb1e »

mfontani wrote: post #95
lucb1e wrote: post #81

Earlier quoted context omitted.

Correct. You only need a banner for invasive tracking. Normal visitor counting, login handling, preference setting, etc. is all allowed by default. Only when you don't have a valid reason to process the user's data, then you need to ask them for consent , and that's the only time you need a cookie wall. Everything else is opt-out. Would be a crazy world if I ask the pizza store to deliver my pizza but I need to conse…

> Normal visitor counting To my knowledge that might need consent, depending on what do you mean / how it's performed.

Trying to track "return visits" often requires installing identifying tokens (cookies, localStorage, etc.). Even if no human ever looks at an individual person's data, you are processing it, so GDPR applies.

But that's where the last legal basis comes in:

> processing is necessary [for] the legitimate interests pursued by the [website], except where such interests are overridden by the interests [of] the data subject

So:

(1) on the one hand, the site owner has a legitimate interest in making the website better. This really can even solely benefit the user, e.g. if you're a non-profit like Wikipedia, but it might also just benefit you and that's okay.

(2) on the other, everyone has the right to privacy. Is privacy violated if you analyse this in an automated fashion? Is there any potential negative consequence for "private and family life, his home and his correspondence"[1]?

If the answer to (2) is a very clear "no" then here's your legal basis for data processing. Since it is not consent-based, you can do it without consent and without 'cookie wall'.

I'm no lawyer, I don't know if this is a clear "no" or if it's a "maybe somehow" or how a judge would rule that or what judges previously ruled on that. I don't have all the answers, but it should be clear not all tracking has to be consent-based, especially when you have the user's privacy at heart. Hence my phrasing of 'invasive tracking' earlier in the thread.

Also, if you're a small company or startup that really tries to do good but misinterpreted the law, the data protection agency is not going to give you a large fine. If there is neither an intention of violating privacy (in an ethical way, not a letter-of-the-law way) nor clear negligence, then the DPA will probably send you a warning. It's also a fundamental right to get a reasonable punishment, so they can't give you a fine that creates major issues if you didn't do anything majorly wrong (people often look at GDPR's vague clauses and €20 million fines and think "how could your mom and pop store ever pay that for small violations" while in practice that's not how this works).

[1] Article 8 "Privacy" from the European Convention on Human Rights: https://en.wikipedia.org/wiki/European_Convention_on_Human_R...

Re: Using Google Analytics without GDPR consent

#106

Post by lucb1e »

GordonS wrote: post #87
lucb1e wrote: post #81

Earlier quoted context omitted.

Correct. You only need a banner for invasive tracking. Normal visitor counting, login handling, preference setting, etc. is all allowed by default. Only when you don't have a valid reason to process the user's data, then you need to ask them for consent , and that's the only time you need a cookie wall. Everything else is opt-out. Would be a crazy world if I ask the pizza store to deliver my pizza but I need to conse…

I believe you are correct, but I believe you also need to have a cookie/privacy policy page, where you explain what data you are storing and processing. I forget off the top of my head if that's a requirement of GDPR or ePrivacy, but you need to comply with both.

Correct, you need a page but not a wall/banner unless you need to seek consent for something.

Again, the law is not all lawyerspeak and it's fairly easy to find if you click my link to the law above. Article 14(3):

> The [website] shall provide the information referred to in paragraphs 1 and 2:

> (a) within a reasonable period after obtaining the personal data [...]

> (b) [...] at the time of the first communication to [the user] [...]

Where "the information referred to in paragraphs 1 and 2" is the basics: who you are, what you collect, for what purpose (marketing or so), retention period, what the user's rights are, and other things that may apply from the lists in those paragraphs.

The easiest way to fulfill this is, of course, a nice little link at the bottom with this info laid out for everyone.

This is also perfect if you're Google and your products, taken together, process basically every piece of data about a human going about their daily life. Then you basically say "we collect basically every piece of data that you supply or that we can otherwise get our hands on" and the user is not only none the wiser when they use only reCAPTCHA, but they now also agreed to the rest because that's all in one policy.

By and large I'm still happy that it has improvements over the previous law (most notably enforcement and uniformity between member states) even if there are things to be improved, but I digress. Point is: policy available to read when desired: yes; annoying pop-up banner: NEIN :)

Re: Using Google Analytics without GDPR consent

#107

Post by d1sxeyes »

dmitriid wrote: post #82
rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

https://gdpr.eu/cookies/ Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent f…

Should is not the same as 'must'.

If the cookie is purely functional, and is not used for any other purposes, you are neither required to request consent nor inform, provided it is for a service the user explicitly requests.

For example, authentication, preference setting, form submission, etc. are all explicit requests.

If your cookies do not require consent, you are not required to explain them to the user (although personally I'd say it's a good practice).

EDIT: the above is not true, please check the comments below for further discussion.

Re: Using Google Analytics without GDPR consent

#108

Post by d1sxeyes »

rcMgD2BwE72F wrote: post #80
jassany wrote: post #71

Google has an extension on the Chrome Web Store that allows you to opt out of GA tracking. https://chrome.google.com/webstore/detail/google-analytics-o...

GDPR is neither opt-in nor opt-out. The users must consent or no personally identifiable data can be collected/processed.

This is not correct. There are six bases for processing personal data.

Consent is only one.

Re: Using Google Analytics without GDPR consent

#109

Post by d1sxeyes »

CaptArmchair wrote: post #49

The GDPR is quite strict in that states in no uncertain terms when one needs to ask for consent. The notion "personal data" and "anonymized data" are quite clearly defined. [1][2] > Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. [1] https://…

FYI, https://gdpr.eu is not the European Commission, it's run by the same folks the run Proton Mail. There's a banner at the bottom to that effect.

That checklist is not bad, but it's not legal advice, and it doesn't come from the EC (directly, anyway).

Re: Using Google Analytics without GDPR consent

#110

Post by lucb1e »

d1sxeyes wrote: post #107
dmitriid wrote: post #82

Earlier quoted context omitted.

https://gdpr.eu/cookies/ Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent f…

Should is not the same as 'must'. If the cookie is purely functional, and is not used for any other purposes, you are neither required to request consent nor inform, provided it is for a service the user explicitly requests . For example, authentication, preference setting, form submission, etc. are all explicit requests. If your cookies do not require consent, you are not required to explain them to the user (althou…

> you are not required to explain them to the user (although personally I'd say it's a good practice).

Nitpick: you are actually required to explain it, but not by shoving a banner in their face. You can explain it in the privacy policy, to be retrieved on demand by the user themselves.

See also GordonS' comment elsewhere in this thread, who is correct about the need for a privacy policy (and I posted a more elaborate comment with more info below it): https://news.ycombinator.com/item?id=25305722

Post reply on HN