GDPR - first party analytics cookies

Question

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow:

1. Cookie is used to uniquely identify anonymous visitor (random visitor ID);
2. Cookie is persisted for the duration of the session;
3. Cookie can not (easily) directly be linked to a user (e.g. there is another technical session cookie that stores user ID for authentication purposes, but the two are issued by separate systems, and have no relation except that they are stored in the same browser);
4. Cookie is used to track and relate behavior of the visitor (pages visited, buttons clicked, general behavior stuff. etc.). The most sensitive information I can imagine stored using this identifier would be resolved Country/City, tops (no IP stored). The rest is just usage information related to the website.
5. Data stored with the identifier held by the cookie never leaves first-parties control, it is stored on servers controlled by the site owner.

Clearly this all needs to be written down in privacy policy, but do I need explicit consent for such a cookie also?

In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.

Answer 1

The GDPR only require explicit (hard) consent if you use the cookie to store personal data.

Given the conditions you cite, the data you store is not personal data, so this cookie does not require consent.

In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.

You may have to do DPIA to demonstrate that this is non-trivial, or that you have mitigation in place to mitigate staff abusing such access. But provided things are as you say, the "analytics" cookie does not require consent.

Answer 2

Your question is partially answered in this other post: GDPR Compliance: Do all Cookies require Opt-In?

As mentioned there, WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194 interprets the two criteria for Cookie Consent Exemption:

(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:

CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”.

CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”.

It interprets these requirements deriving from Directive 2002/58/EC in relation to First party analytics in Section 4.3, as follows:

4.3 First party analytics

Analytics are statistical audience measuring tools for websites, which often rely on cookies. These tools are notably used by website owners to estimate the number of unique visitors, to detect the most preeminent search engine keywords that lead to a webpage or to track down website navigation issues. Analytics tools available today use a number of different data collection and analysis model s each of which present different data protection risks. A first-party analytic system based on “first party” cookies clearly presents different risks compared to a third-party analytics system based on “third party” cookies. There are also tools which use “first party” cookies with the analysis performed by another party. This other party will be considered as a joint controller or as a processor depending on whether it uses the data for its own purposes or if it is prohibited to do so through technical or contractual arrangements.

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

However, the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards. Such safeguards are expected to include a user friendly mechanism to opt-out from any data collection and comprehensive anonymization mechanisms that are applied to other collected identifiable information such as IP addresses.

(...)

Provided the data you collect is effectively aggregated, and that you do not keep the IP address or another way to directly or indirectly identify the user, it seems that you would meet the requirements of WP29 expressed in this Opinion for consent exemption.