is it legal following the GDPR law, to track anonymous data without consent?

I was reading many articles, but GDPR is so broad, there is so much information that receiving a simple answer as that, seems impossible.

The question is this:

Can I track anonymously, how many people refuse / accept the new cookie consent policy on my website? or do the ones who refuse fall into a black hole?



Article 4 GDPR Definitions

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Recital 26 Not applicable to anonymous data

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.


Yes it is legal. GDPR does not apply to anonymised data. Just be sure that is clear for you the difference between "pseudonymised" data (through which it is still possible to identify an individual and therefore still considered "personal") and "anonymised" data (through which is not possible, in any way, to identify an individual). GPDR defines both. Let me know if you need the specific reference to them within the regulation.


Yes You have that right, but please specify what data You collect to your customers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.