3

We are currently using google analytics to track our site.

The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the tracking cookies have to be blocked initially until the consent is given. In our case it's a soft opt-in on continual use.

So I was wondering. Can I add some in house code directly on the server to record landing page hits. only recording say the page name & time. Maybe even a couple of element clicks.

This way no cookies are used and there is 0 chance of identifiable relational data being used other than reading the php session. Which doesn't count as UI.

And more importantly I don't need consent and can start getting the data I need right off the bat?

Improve this question
2
  • 1
    What difference would that make? – DCdaz Oct 13 '18 at 21:48
  • 1
    The reason is that this question could be closed as off-topic. But so far there are only 3 votes, so I removed my comment and posted an answer instead. – wimh Oct 14 '18 at 22:23
3

The so called "cookie law" is Article 5(3) of Directive 2002/58/EC:

  1. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

So this does not only apply to cookies, but to any way to store or retrieve information on/from the equipment of the user.

When you use a PHP session, the session ID is stored in a session cookie or URL parameter. If a URL parameter is used, it is also stored on the equipment of the user, so the "cookie law" would also apply to that, but I am not sure about that.

The Article 29 Data Protection Working Party (Art. 29 WP) has written Opinion 04/2012 on Cookie Consent Exemption. It considers a session-ID to be exempted from the requirement of informed consent:

3.1 “User-input” cookies

The term “user input cookies” can be used as a generic term to describe session cookies that are used to keep track of the user’s input in a series of message exchanges with a service provider in a consistent manner. These would be expected to be first party cookies typically relying on a Session-ID (a random temporary unique number) and expire when the session ends at the latest.

First party user input session cookies are typically used to keep track of the user’s input when filling online forms over several pages, or as a shopping cart, to keep track of the items the user has selected by clicking on a button (e.g. “add to my shopping cart”).

These cookies are clearly needed to provide an information service explicitly requested by the user. Additionally, they are tied to a user’s action (such as clicking on a button or filling a form). As such these cookies are exempted under CRITERION B.

So basically, a PHP session ID cookie does not require consent.

However as soon as a session id is used for analytics, it is not exempted:

4.3 First party analytics

Analytics are statistical audience measuring tools for websites, which often rely on cookies. These tools are notably used by website owners to estimate the number of unique visitors, to detect the most preeminent search engine keywords that lead to a webpage or to track down website navigation issues. Analytics tools available today use a number of different data collection and analysis models each of which present different data protection risks. A firstparty analytic system based on “first party” cookies clearly presents different risks compared to a third-party analytics system based on “third party” cookies. There are also tools which use “first party” cookies with the analysis performed by another party. This other party will be considered as a joint controller or as a processor depending on whether it uses the data for its own purposes or if it is prohibited to do so through technical or contractual arrangements.

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

However, the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards. Such safeguards are expected to include a user friendly mechanism to opt-out from any data collection and comprehensive anonymization mechanisms that are applied to other collected identifiable information such as IP addresses.

In this regard, should article 5.3 of the Directive 2002/58/EC be re-visited in the future, the European legislator might appropriately add a third exemption criterion to consent for cookies that are strictly limited to first party anonymized and aggregated statistical purposes. First party analytics should be clearly distinguished from third party analytics, which use a common third party cookie to collect navigation information related to users across distinct websites, and which pose a substantially greater risk to privacy.

So Art. 29 WP does not consider it a privacy risk under the conditions in the last two paragraphs. At least in some EU countries (Like the Netherlands) you would be exempted from the requirement of informed consent because of that.

In your question you also mention you use "a soft opt-in on continual use". That is not sufficient to obtain consent.

Improve this answer
4
  • Is GDPR actually relevant to this question? The Cookie Law governs the storage/retrieval of information in general, not personal data as GDPR does. – Greendrake Oct 16 '18 at 10:20
  • @Greendrake The question is basically about Directive 2002/58/EC. Article 2(f) and recital 17 of Directive 2002/58/EC define the notion of consent in reference to the one set forth in Directive 95/46/EC. Art. 94 GDPR includes: Directive 95/46/EC is repealed with effect from 25 May 2018. References to the repealed Directive shall be construed as references to this Regulation. So the GDPR is only relevant on how to obtain consent. – wimh Oct 16 '18 at 10:42
  • soft opt in on continual use is allowed under certain circumstances. This is down to cookiebot. Are you saying they have it wrong? – DCdaz Oct 23 '18 at 11:01
  • 1
    Yes cookiebot is wrong. (And not only in that regard, there is more incorrect on their website). See also GDPR, is scrolling the page can mean cookie acceptance? – wimh Oct 23 '18 at 11:16
3

The ePrivacy directive (“cookie law”) requires consent when accessing or storing information on a user's device, unless that access is strictly necessary for a service explicitly requested by the user. This means you can use purely functional cookies, but otherwise need consent. The ePrivacy directive applies regardless of whether the cookies contain personal data.

On the other hand, processing of personal data falls under the GDPR. Since IP addresses are usually personal data, servers-side processing of access logs would be processing of personal data and would require a legal basis. But GDPR is more flexible than ePrivacy – instead of consent, a “legitimate interest” might be sufficient. Furthermore, GDPR does not apply to truly anonymous data, such as aggregate statistics. E.g. a classic page view counter would likely be out of scope for the GDPR.

So yes, you can do some server side data collection to augment your client-side analytics. You can likely collect some data without consent. The tricky question would be how much you can collect on the server. Whereas aggregate statistics like counts are likely fine, using additional data for analytics could bring ePrivacy back into play.

The GDPR also doesn't distinguish between client-side and server-side processing, indicating that you might be able to collect basic data for Google Analytics without consent. For example, the following flow might be ePrivacy- and GDPR-compliant:

  • when the page loads, Google Analytics is also loaded
  • if cookies had previously been set, GA is initialized with a client ID from a cookie
  • otherwise, a random client ID is generated and held in a variable (not in a cookie)
  • this new client ID is used to send a pageview event
  • if the user accepts analytics cookies, the client ID is stored in a cookie so that a profile for that client ID can be created across later pageviews

This hinges on the theory that the other information captured (like screen resolution) does not fall under ePrivacy. But since the temporary client ID is not persisted on the users' device until consent is given, pageview-level analytics are possible without consent. The consent is only necessary to capture session-level analytics.

(Of course, there are more general issues from both the legal and technical side: GA uses US servers which might no longer be legal in the wake of the 2020 Schrems II ruling, and adblockers are becoming increasingly popular which can heavily distort analytics on some websites.)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.