Is consent required for paying, corporate subscribers of a B2B website?

Question

I was intrigued by this question: Why is the Google Analytics cookie defined as "strictly necessary" and saved without consent?, and how GDPR/E-Privacy applies to paying, corporate subscribers of a B2B website or platform, when:

• X licences are purchased through a business contract.
• Corporate email addresses are assigned to a licence and used to log in.
• There are no ads, marketing, nor recommendation features.
• There is no 'free' tier of the site.

Assume there is a single cookie that stores a unique ID and is passed to Google Analytics (GA) post-login. No other information is provided. Is consent required? Is it the fact that GA is involved the requirement for consent? Are any of the following legitimate interests?

• Provide usage statistics to clients. E.g to understand license occupation.
• Identify fraud. E.g if the same ID logs in from multiple locations.
• Understand engagement of site features. E.g how many IDs clicked something.

If a cookie banner is implemented as-is, and 'reject all' chosen, the above are no longer possible, which has a significant business impact. E.g if a client knows they cannot be tracked, what prevents them from sharing licences?

We have no need for PII and could even offer a completely anonymised experience. We simply need to know if licence X is in use or not, which we can only do by pushing an ID into GA. Whilst the site can function without this ID, are there mitigating circumstances here?

Answer 1

Under the EU e-privacy directive, consent for cookies (and other local storage) is required except for "strictly necessary" data. Data used in part for analytics is generally not considered to be strictly necessary. Thus if the ID is passed to GA, the cookie probably does not qualify as strictly necessary, so consent for it would b required, whether it stores any PI or not.

This is one reasons why compliant designs usually do not mingle data used for analytics and data used for essential license authorization. It might be wiser not to use GA for determining whether the user is properly authorized, and which lkicense the user is charged against. But if GA is used for that purpose, consent is probably required.

The problem with using a cookie that required consent for such a purpose is that the cookie must not be stored or read if consent is refused, and the site must still operate in such a case.

It woulds be more usual, and more compliant, to verify that a user is properly authorized through some login mechanism, and store a cookie that documents this authorization. That would be strictly necessary storage. Other cookies could be used for preference information that is perhaps not strictly necessary, and consent obtained. The same would be true for any desired analytics data. The lawfulness of processing any data under the GDPR is a separate issue, and might well not require consent, if another lawful basis is identified.