GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

Question

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics.

From what I can understand, any website which uses Google Analytics needs to first get the users consent before storing a cookie on their browser?

I have implemented this in a cookie notice when the user first goes to the site and by default no tracking is enabled. Once they click agree, the page reloads with Analytics tracking.

However, since I have implemented this onto my websites the drop in traffic is huge and really makes it hard to optimise and understand how the website is performing.

My question is, Is it ok if in my cookie notice text said something like this..

'By clicking agree or continuing to use this site you agree to our privacy policy'

This way if they completely ignore the notice (which a lot of people do) and navigate to another page, then at least I am able to track more visits.

Is this still considered clear consent?

Answer 1

Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this.

'By clicking agree or continuing to use this site you agree to our privacy policy'

Neither of theses options is considered clear consent.

• Continuing to use the site, is implied consent, which is not sufficient. Also it does not give you the option to reject.
• Clicking agree to agree the privacy policy is not specific enough. You must offer a separate opt-in box for everything for which you need consent. The privacy policy is just a text in which you explain your privacy policy. It is not a contract which needs agreement.
• Also keep in mind that withdrawal of consent must be as easy as giving it. So you must be able to return to the settings and change them.

Having said that, it is possible to configure Google Analytics in a way you don't need consent;

1. Accept the Data Processing Amendment
   • Go to Admin
   • Choose Account Settings
   • Scroll down to the data processing amendment
   • Accept it
   • Click Save
2. Disable Data Sharing
   • Go to Admin
   • Choose Account Settings
   • Scroll down to the data sharing settings
   • Uncheck all checkboxex
   • Click Save
3. Disable Data Collection for Advertising
   • Go to Admin
   • Choose Account Settings
   • Choose Property settings
   • Choose Tracking info
   • Choose Data collection
   • Turn off these two options
   • Click Save
4. Disable the User-ID feature
   • Go to Admin
   • Choose Account Settings
   • Choose Property settings
   • Choose Trackinginfo
   • Choose User-ID
   • Turn off these options
   • Click Save
5. Anonymize your visitors IP Address
   • Add { ‘anonymize_ip’: true } to the tracking code on your website

Even though you don't need consent, you still need to add a few lines to your privacy policy:

• You are using Google Analytics cookies.
• You have a data processing agreement with google.
• You have enabled IP anonymization/masking.
• You have disabled data sharing.
• You are not using any other google services in combination with Google Analytics.

The Dutch DPA has a more complete manual, but unfortunately it is not available in English.

Answer 2

I don’t see the basis for the accepted answer saying that a Google Analytics cookie does not require user prior consent—even after the modifications that answerer proposed. Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Data Protection Working Party, adopted 7 June 2012, addresses the question of “First party analytics” (see page 10 of the pdf):

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

The CRITERIA A and B referenced are the only conditions under which a cookie could be exempted from the requirement of informed consistent, according to the ePrivacy Directive (Article 5.3 of Directive 2002/58/EC, as amended by Directive 2009/136/EC).

Whether the Google Analytics cookie is seen as a first-party cookie (with the analysis outsourced) or as a third-party cookie, it would definitely not be treated more leniently than this first-party analysis.

Regarding what constitutes sufficiently explicit consent, see Neil Ford, “The GDPR’s Six Lawful Bases For Processing – With Examples,” IT Governance, 21 June 2021, which cites Recital 32, which says in part:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

An ‘affirmative act’ means the data subject has to opt-in – you cannot assume their consent, for example, by using pre-ticked boxes on your website.

This would call into question your hope that:

My question is, Is it ok if in my cookie notice text said something like this..

'By clicking agree or continuing to use this site you agree to our privacy policy'

This way if they completely ignore the notice (which a lot of people do) and navigate to another page, then at least I am able to track more visits.