Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Google Analytics without GDPR consent

evrim.io

Post reply on HN
Print view View original

31–40 of 118 posts

Re: Using Google Analytics without GDPR consent

#31

Post by ddevault »

Tracking users is unethical. The law is there not so that you can wiggle your way around it, but to make a statement about this behavior. Laws are not scripts and they are not interpreted by computers. You are going to get fined for doing this, and it'll be well deserved.

Do not spy on people.

It's that simple.

Don't use google analytics. Don't use any of the dozens of alternatives which are selling you "pro-privacy" analytics, which is a contradiction of terms. Just don't spy on people.

Re: Using Google Analytics without GDPR consent

#32

Post by krsdcbl »

tlarkworthy wrote: post #27

This is great info on how to substitute IP address or turn off user tracking. I do think the replacement is dubious ( especially forwarding to CF) and not GDPR compliment so I would use something else like user agent, timezone, languages to form a hash. It's doesn't need to be precise and in some ways it's good if it's a bit rough. I only want general trends on a website.

in fact it can't and shouldn't be precise, as this would still make the iser clearly identifiable. You have to discern between GDPR (which governs tracking purposes as well) and E-Privacy laws (which concern PII) here

Re: Using Google Analytics without GDPR consent

#33

Post by eclat »

grabeh wrote: post #10

Love the contrast between the title and the text. This isn't even about GDPR, it's about a completely different piece of legislation, the E-Privacy Directive. This is completely agnostic on personal data and so the post is largely flawed. Even if you're not dealing with any personal data, if you're placing a cookie (or doing anything analogous device fingerprinting etc) you are in scope of the Directive and need cons…

[dead]

Re: Using Google Analytics without GDPR consent

#34

Post by Dayshine »

rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

No, in the majority of cases, cookies required for the website to function do not require prior consent nor notification.

You should still have a notice somewhere that explains this though.

Re: Using Google Analytics without GDPR consent

#35

Post by eclat »

Dayshine wrote: post #29
simpss wrote: post #15

Earlier quoted context omitted.

log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.

The key caveat here is: Unless it's necessary. The legitimate interests basis of the GDPR allows you to make a balanced decision of your business requirements against user privacy expectations.

[dead]

Re: Using Google Analytics without GDPR consent

#36

Post by simpss »

Dayshine wrote: post #29
simpss wrote: post #15

Earlier quoted context omitted.

log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.

The key caveat here is: Unless it's necessary. The legitimate interests basis of the GDPR allows you to make a balanced decision of your business requirements against user privacy expectations.

yes, and you have to line out how the processing is necessary for providing the service, there has to be no less-intrusive method of achieving the desired result and be ready to prove it.

hint, user-level analytics rarely is. And in this specific example, repurposing logs kept for one purpose(ex, security/auditing) to user analytics is definitely not something you can just do

Re: Using Google Analytics without GDPR consent

#37

Post by brtkdotse »

krsdcbl wrote: post #13

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr. correct me if I'm making wrong assumptions here, as s…

This is my understanding as well - no matter how obfuscated the final identifier is, if you derived it from PII then it’s considered PII as well.

However, IANAL.

Re: Using Google Analytics without GDPR consent

#38

Post by simpss »

rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

exactly, this does not require a cookie notice. See here for explanations: https://europa.eu/youreurope/business/dealing-with-customers...

Consent is mainly required for cookies that are not technical requirements for providing the service.

Re: Using Google Analytics without GDPR consent

#39

Post by SquareWheel »

ddevault wrote: post #31

Tracking users is unethical. The law is there not so that you can wiggle your way around it, but to make a statement about this behavior. Laws are not scripts and they are not interpreted by computers. You are going to get fined for doing this, and it'll be well deserved. Do not spy on people. It's that simple. Don't use google analytics. Don't use any of the dozens of alternatives which are selling you "pro-privacy"…

Calling it spying is hyperbole, and thrusting your personal ethics on others is nonproductive.

If analytics turn you off, there are plenty of browser extensions which will block them on your behalf. uBlock Origin is the most common example.

https://github.com/gorhill/uBlock

Re: Using Google Analytics without GDPR consent

#40

Post by yostrovs »

krsdcbl wrote: post #25
yostrovs wrote: post #20

Earlier quoted context omitted.

You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?

"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.

If it simply stated what you say (may I have the quote?), few would be in violation of it, again as you say.
Post reply on HN