We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics).

So here is the question with Google Analytics we are not assigning users with GA UserID and IP anonymization is turned on. So GA assigns the Client ID only, which is randomly generated to each visitor of our website.

Regarding to Facebook Analytics – Facebook states that they are not collecting Personal Identifiable Information in their Privacy Policy notice “Advertising, Measurement and Analytics Services (Non-Personally Identifiable Information Only).”.

So do we still need to get the consent from users as information that both Analytics services collect is not PII?


1 Answer 1


First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the security of processing

I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is adequate to ensure security of processing as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord).

As for Facebook Analytics, I think you've simply misunderstood their policy.

Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information".

AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways.

What they actually say about PII in the context of Analytics is this:

We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission.

Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy.

OK, moving on to cookie compliance.

To you (the controller), both Google and Facebook are processors.

Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data.

So if I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV).

As for Facebook, the fact that they promise not to share PII with third parties is irrelevant because they collect personal data. You will always need consent from your users to hand over their PII to Facebook in the first place. This is not optional.

PS: If was a user, that consent would never been granted, no matter how great or valuable your site might be. If you have any sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.

  • Thanks for your answer @Free Radical it's nice and clear. I understood that in any way we need to get consent from users before Analytics start tracking users. Then i being left with another question if you could help me to answer, which is "The right to erasure is also known as ‘the right to be forgotten".
    – CodeDoctor
    May 23, 2018 at 14:09
  • How can we achieve that from Google Analytics as we do not store User ID and IP addresses anonymized. Only information GA store about the users is the Client ID which is randomly generated to visitors of our site. And if the user "A" would ask their data to be erased from GA database we wouldn't know to which Client ID is associated with that user "A" and which one is to delete.
    – CodeDoctor
    May 23, 2018 at 14:09
  • Second Facebook Analytics they do not share any PII with the us (website operators) and there is no way where we can see that data and ask Facebook to delete PII about our users (which was retrieved through the cookie or their own system) as they use "shadow profiles".
    – CodeDoctor
    May 23, 2018 at 14:10
  • As they hold information about the users (everybody) before they even arrive to our site. So i am just wondering how can users' data be deleted because it's almost impossible to relate back in those Analytic tools. Probably they will need ask Facebook themselves (users) to delete data about them. Correct me if i am right? Thanks.
    – CodeDoctor
    May 23, 2018 at 14:10
  • 3
    All of these are separate questions and they are also quite complex. Comments are simply not suitable for asking, or answering those. The short answer is that GDPR, if the EU is serious about enforcing it, will be very disruptive to the business practices of companies like Facebook and Google. May 23, 2018 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .