I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time.

BUT, on top of that, according to GDPR I would need to collect and store records that cookie consent from a particular user was obtained.

Well, lets say "user A" has agreed for my website to use cookies and later on "Mr XXX" who is actually "user A" is trying to be funny and he has emailed me saying he will complain to ICO as he can see these cookies are set but he has not provided a consent.

Because the IP is anonymized, I could not prove that the guy emailing me has actually provided consent as "user A" and "Mr XXX" are not associated on my records, whilst they are the same person.

Any ideas how to solve this puzzle?

  • Maybe store consent by IP address + username? – Ron Beyer Jul 26 '18 at 19:12
  • sorry I forgot to mention, I am talking about users that are not logged in/registered. I've got system im place for logged in users. – Oful Jul 26 '18 at 19:31
  • Maybe then just store it based on IP? I assume you are storing the consent inside a cookie, and checking that cookie next time to display the consent form or not? Store the IP with it as well, or make consents time-out for not logged-in customers (like 1 day or so), in case it is different people at the same computer... – Ron Beyer Jul 26 '18 at 19:35
  • 1
    What happens when a person's IP changes? What if they give consent on one WiFi network but complain from another? – interfect Jul 28 '18 at 16:31

Simply use a cookie to store consent.

First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie.

You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website.

Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate Art. 11(1) GDPR:

  1. If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.

Notice it is possible to configure google analytics in a way so you don't need any consent. See my answer to this question. Just IP anonymization is not sufficient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.