2

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow:

  1. Cookie is used to uniquely identify anonymous visitor (random visitor ID);
  2. Cookie is persisted for the duration of the session;
  3. Cookie can not (easily) directly be linked to a user (e.g. there is another technical session cookie that stores user ID for authentication purposes, but the two are issued by separate systems, and have no relation except that they are stored in the same browser);
  4. Cookie is used to track and relate behavior of the visitor (pages visited, buttons clicked, general behavior stuff. etc.). The most sensitive information I can imagine stored using this identifier would be resolved Country/City, tops (no IP stored). The rest is just usage information related to the website.
  5. Data stored with the identifier held by the cookie never leaves first-parties control, it is stored on servers controlled by the site owner.

Clearly this all needs to be written down in privacy policy, but do I need explicit consent for such a cookie also?

In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.

  • Can you clarify what you mean by "tops (no IP stored)" and how and why you collect the country and city of the visitor (since this purpose is not an information related to the behavior in relation to your site, you must have a different purpose in collecting this information – Tardis Jun 6 '18 at 12:27
  • Not entirely sure what to clarify there. What I meant is, we are not going to store unique IP addresses, but will geolocate them and record the approximate location, be it country and region or city. The purpose (why) is to analyze behavior on the site in context of approximate geographical location - clearly, users from Brazil might have different usage patterns than ones from Japan, in the same manner as users from Juneau, Alaska would have different interests than those in LA, California. How - IP geolocation. There is no different purpose other than that. – Matiss Jun 6 '18 at 12:45
3

The GDPR only require explicit (hard) consent if you use the cookie to store personal data.

Given the conditions you cite, the data you store is not personal data, so this cookie does not require consent.

In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.

You may have to do DPIA to demonstrate that this is non-trivial, or that you have mitigation in place to mitigate staff abusing such access. But provided things are as you say, the "analytics" cookie does not require consent.

  • Cookies requirements as per European laws are currently dealt by Directive 2002/58/EC ("ePrivacy Directive"), and not RGPD. This Directive is current law for this matter, and WP 29 Opinion 04/2012 on Cookie Consent Exemption should apply until other guidelines are adopted pursuant to GDPR or until the awaited "ePrivacy Regulation" is finally adopted. – Tardis Jun 6 '18 at 13:37
  • @Tardis I know, See for instance this answer from nearly a month ago. However, this time I just felt like giving a concise answer addressing the concerns that made this question different from that previous one. – Free Radical Jun 6 '18 at 13:58
1

Your question is partially answered in this other post: GDPR Compliance: Do all Cookies require Opt-In?

As mentioned there, WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194 interprets the two criteria for Cookie Consent Exemption:

(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:

CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”.

CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”.

It interprets these requirements deriving from Directive 2002/58/EC in relation to First party analytics in Section 4.3, as follows:

4.3 First party analytics

Analytics are statistical audience measuring tools for websites, which often rely on cookies. These tools are notably used by website owners to estimate the number of unique visitors, to detect the most preeminent search engine keywords that lead to a webpage or to track down website navigation issues. Analytics tools available today use a number of different data collection and analysis model s each of which present different data protection risks. A first-party analytic system based on “first party” cookies clearly presents different risks compared to a third-party analytics system based on “third party” cookies. There are also tools which use “first party” cookies with the analysis performed by another party. This other party will be considered as a joint controller or as a processor depending on whether it uses the data for its own purposes or if it is prohibited to do so through technical or contractual arrangements.

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

However, the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards. Such safeguards are expected to include a user friendly mechanism to opt-out from any data collection and comprehensive anonymization mechanisms that are applied to other collected identifiable information such as IP addresses.

(...)

Provided the data you collect is effectively aggregated, and that you do not keep the IP address or another way to directly or indirectly identify the user, it seems that you would meet the requirements of WP29 expressed in this Opinion for consent exemption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.