Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Google Analytics without GDPR consent

evrim.io

Post reply on HN
Print view View original

91–100 of 118 posts

Re: Using Google Analytics without GDPR consent

#91

Post by krsdcbl »

herio wrote: post #46
krsdcbl wrote: post #25

Earlier quoted context omitted.

"the banner" is nowhere stated in the law. it's a way people have chosen to comply with the law, and most of the implementations currently out there are still in violation of what the law states. The law simply mandates you get informed, "written" consent from any visitor before tracking them or collecting PII in any form or function.

Just read up on it and it's actually a bit more detailed, it requires active consent. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... Statement 82 reads: "The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions thatrequire an intervention from the data subject to prevent agreement(for example ‘opt-out boxes’)." This in my mind pretty much invalidates most of the existing…

yep, that's exactly what i mean by "informed & written" - quite literally it must be active by definition of "informed", but furthermore in a way that is clear to the user of WHAT he actively consented to, and written meaning "proveable".

Re: Using Google Analytics without GDPR consent

#92

Post by krsdcbl »

toomanybeersies wrote: post #57
herio wrote: post #46

Earlier quoted context omitted.

Just read up on it and it's actually a bit more detailed, it requires active consent. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... Statement 82 reads: "The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions thatrequire an intervention from the data subject to prevent agreement(for example ‘opt-out boxes’)." This in my mind pretty much invalidates most of the existing…

Cookie banners predate GDPR by a decade or two.

and most importantly, don't suffice to fulfill gdpr. User must not only be informed OF the usage of cookies, but of any means of tracking, and must be presented a way to access the content WITHOUT having to load said cookies or tracking measures

Re: Using Google Analytics without GDPR consent

#93

Post by xxs »

rendall wrote: post #50

Peripherally related question. Is it GDPR compliant to hash a user's IP address to just a wide region and store only that? e.g. "Finland", "California", "Chennai". Just to get an idea of from where visitors come? I'd like to add only usage tracking to my sites to see how they are used, but I have zero interest in selling or using user data for any other purpose. I could add a pop-up banner, but that's for consent on…

>Is it GDPR compliant to hash a user's IP address

It is not, hashing would be pretty much a bijection, anyways. Storing state would be fine, though.

Re: Using Google Analytics without GDPR consent

#94

Post by krsdcbl »

camillomiller wrote: post #42
krsdcbl wrote: post #18

Earlier quoted context omitted.

honestly this is terrible advice. I know it's annoying to many people, but the EU isn't autonomously pursuing corps big or small - its legislation will kick into action if _anyone_ files a complaint after visiting your website, and you'll be subject to the same possible penalties as anyone.

Iirc, though, the law states that the fine will come only if you don’t comply with an initial warning, which will always have to be the first step. In that case, you can easily comply and not be fined.

absolutely, but that hardly means OPs approach of "just fk it" is sane advice

Re: Using Google Analytics without GDPR consent

#95

Post by mfontani »

lucb1e wrote: post #81
rzwitserloot wrote: post #28

Quick question on cookies in general: Let's say I write a site that doesn't set any cookies when you load it, but, it does have a login form on a few pages. If you fill in the form and click submit, a cookie is set by that site (not by some auth server, SSO system, adserver, etc) which keeps you logged in for future visits. It contains a unique token. You know, the usual way to do basic web form -> server checks via…

Correct. You only need a banner for invasive tracking. Normal visitor counting, login handling, preference setting, etc. is all allowed by default. Only when you don't have a valid reason to process the user's data, then you need to ask them for consent , and that's the only time you need a cookie wall. Everything else is opt-out. Would be a crazy world if I ask the pizza store to deliver my pizza but I need to conse…

> Normal visitor counting

To my knowledge that might need consent, depending on what do you mean / how it's performed.

Re: Using Google Analytics without GDPR consent

#97

Post by rendall »

xxs wrote: post #93
rendall wrote: post #50

Peripherally related question. Is it GDPR compliant to hash a user's IP address to just a wide region and store only that? e.g. "Finland", "California", "Chennai". Just to get an idea of from where visitors come? I'd like to add only usage tracking to my sites to see how they are used, but I have zero interest in selling or using user data for any other purpose. I could add a pop-up banner, but that's for consent on…

>Is it GDPR compliant to hash a user's IP address It is not, hashing would be pretty much a bijection, anyways. Storing state would be fine, though.

> hashing would be pretty much a bijection

By "hash" I just meant its broader meaning of "converting": "IP address" to "broad geographical region". There would be no way to convert, say, "Monaco" back to an IP address

Re: Using Google Analytics without GDPR consent

#98

Post by munchbunny »

I think there are two misconceptions in this post.

1. Cookies do not automatically require consent. If you use a session cookie to remember someone's login session, that does not require consent. It's when you use that session cookie for analytics, advertising, etc. that consent enters the picture.

2. The fact that you can uniquely identify the user on an ongoing basis, even if you're not tying it to any actual personal details or an IP address, is what makes that identifier personal information. Just because you obfuscate it does not change that. A hash hides the original data but it does not change the fact that it's a unique identifier, and therefore it's still personal information.

You have to anonymize the data in such a way that you couldn't pick out the specific individual from any stored data. A lossy anonymization step is one way to do it. A hash of a browser thumbprint is not, unless that hash also pools multiple users together and mixes the data up so that you can't pick them apart again.

Re: Using Google Analytics without GDPR consent

#99

Post by ratherbefuddled »

GordonS wrote: post #89
ratherbefuddled wrote: post #74

You don't need consent to share personally identifiable data like IP addresses with Google. For GDPR purposes you need a legal basis and "your legitimate interest" is one. You need to honestly assess - ideally write down - your determination of how your need to analyse website performance is balanced against the user's right to privacy. One thing you might consider here is the impact on the user. Then you need to ful…

> For GDPR purposes you need a legal basis and "your legitimate interest" is one. You need to honestly assess - ideally write down - your determination of how your need to analyse website performance is balanced against the user's right to privacy Come on, analytics, especially 3rd party analytics, is never considered a "legitimate interest". As if it was needed, this is spelled out explicitly in the ePrivacy directi…

Legitimate interest is a GDPR thing and you can indeed choose to share personal information under legitimate interest and you can do so for analytics. There are countless examples of privacy policies all over the web doing exactly that.

The ePrivacy directive is much more proscriptive about consent but applies only very narrowly - to cookies and similar technology.

Conflating GPDR and ePrivacy leads to much confusion, they are to all intents and purposes separate.

Re: Using Google Analytics without GDPR consent

#100

Post by PeterisP »

zepolen wrote: post #11
gchambert wrote: post #9

What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent. What he is doing is illegal.

Doesn't that make access log files illegal?

The main conceptual issue is that it's about the purpose of use rather than the technical implementation. Access log files used for debugging purposes only is one thing; but if the exact same access log gets forwarded to a data mart that later gets used for mining marketing analytics, that's a completely different issue.
Post reply on HN