Do I really have to log a user's IP address and a timestamp after they consent to a cookie?
Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted
I don't even need (I'm not using it in any way) personal data like IP address in my website.
-
Why are you asking this here on Law?– GreendrakeMay 21, 2018 at 12:32
-
3Where should I ask about GDPR I thought GDPR = law section. I'm not asking how to do it, I'm asking if I have to do it to comply with GDPR.– kironetMay 21, 2018 at 12:33
Add a comment
|
1 Answer
No.
That is spelled out pretty clear in Article 11.
In fact, if you want follow accepted data minimisation principles (and you should), you should not log anything about cookies at your or a third party's website.
-
-
1Where (in the GDPR) do you see a legal requirement to prove that the user consented to receive a cookie? Oct 14, 2018 at 15:42
-
1
-
2"Otherwise the user can simply state that it does not happened and you are in trouble." Thankfully, this is not how the law works. To be in trouble, the user must be able to prove to the regulatory authority (RA) that your website is not cookie compliant. Simply claiming that he/she was not presented with an option to consent to cookies will not do if software to do so is obviously installed on the website and working as it supposed to work. Oct 16, 2018 at 4:25
-
2Even if you would record the IP address, you still cannot prove user's consent, because you cannot prove the IP address belongs to a particular person. In particular when the user uses a mobile phone, he would be typically using a dynamic IP address issued by the mobile network operator, or he would be connected over wifi using an IP address shared by multiple users. In a similar question I suggested to use screenshots showing how your website works as a proof, that would also proof from which date your website is cookie compliant.– wimhOct 16, 2018 at 9:30