2

I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time.

BUT, on top of that, according to GDPR I would need to collect and store records that cookie consent from a particular user was obtained.

Well, lets say "user A" has agreed for my website to use cookies and later on "Mr XXX" who is actually "user A" is trying to be funny and he has emailed me saying he will complain to ICO as he can see these cookies are set but he has not provided a consent.

Because the IP is anonymized, I could not prove that the guy emailing me has actually provided consent as "user A" and "Mr XXX" are not associated on my records, whilst they are the same person.

Any ideas how to solve this puzzle?

Improve this question
4
  • Maybe store consent by IP address + username?
    – Ron Beyer
    Jul 26, 2018 at 19:12
  • sorry I forgot to mention, I am talking about users that are not logged in/registered. I've got system im place for logged in users.
    – Oful
    Jul 26, 2018 at 19:31
  • Maybe then just store it based on IP? I assume you are storing the consent inside a cookie, and checking that cookie next time to display the consent form or not? Store the IP with it as well, or make consents time-out for not logged-in customers (like 1 day or so), in case it is different people at the same computer...
    – Ron Beyer
    Jul 26, 2018 at 19:35
  • 1
    What happens when a person's IP changes? What if they give consent on one WiFi network but complain from another?
    – interfect
    Jul 28, 2018 at 16:31

1 Answer 1

Reset to default
3

Simply use a cookie to store consent.

First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie.

You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website.

Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate Art. 11(1) GDPR:

  1. If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.

Notice it is possible to configure google analytics in a way so you don't need any consent. See my answer to this question. Just IP anonymization is not sufficient.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .