1

We are currently using google analytics to track our site.

The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the tracking cookies have to be blocked initially until the consent is given. In our case it's a soft opt-in on continual use.

So I was wondering. Can I add some in house code directly on the server to record landing page hits. only recording say the page name & time. Maybe even a couple of element clicks.

This way no cookies are used and there is 0 chance of identifiable relational data being used other than reading the php session. Which doesn't count as UI.

And more importantly I don't need consent and can start getting the data I need right off the bat?

  • 1
    What difference would that make? – DCdaz Oct 13 '18 at 21:48
  • 1
    The reason is that this question could be closed as off-topic. But so far there are only 3 votes, so I removed my comment and posted an answer instead. – wimh Oct 14 '18 at 22:23
0

The so called "cookie law" is Article 5(3) of Directive 2002/58/EC:

  1. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

So this does not only apply to cookies, but to any way to store or retrieve information on/from the equipment of the user.

When you use a PHP session, the session ID is stored in a session cookie or URL parameter. If a URL parameter is used, it is also stored on the equipment of the user, so the "cookie law" would also apply to that, but I am not sure about that.

The Article 29 Data Protection Working Party (Art. 29 WP) has written Opinion 04/2012 on Cookie Consent Exemption. It considers a session-ID to be exempted from the requirement of informed consent:

3.1 “User-input” cookies

The term “user input cookies” can be used as a generic term to describe session cookies that are used to keep track of the user’s input in a series of message exchanges with a service provider in a consistent manner. These would be expected to be first party cookies typically relying on a Session-ID (a random temporary unique number) and expire when the session ends at the latest.

First party user input session cookies are typically used to keep track of the user’s input when filling online forms over several pages, or as a shopping cart, to keep track of the items the user has selected by clicking on a button (e.g. “add to my shopping cart”).

These cookies are clearly needed to provide an information service explicitly requested by the user. Additionally, they are tied to a user’s action (such as clicking on a button or filling a form). As such these cookies are exempted under CRITERION B.

So basically, a PHP session ID cookie does not require consent.

However as soon as a session id is used for analytics, it is not exempted:

4.3 First party analytics

Analytics are statistical audience measuring tools for websites, which often rely on cookies. These tools are notably used by website owners to estimate the number of unique visitors, to detect the most preeminent search engine keywords that lead to a webpage or to track down website navigation issues. Analytics tools available today use a number of different data collection and analysis models each of which present different data protection risks. A firstparty analytic system based on “first party” cookies clearly presents different risks compared to a third-party analytics system based on “third party” cookies. There are also tools which use “first party” cookies with the analysis performed by another party. This other party will be considered as a joint controller or as a processor depending on whether it uses the data for its own purposes or if it is prohibited to do so through technical or contractual arrangements.

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

However, the Working Party considers that first party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by websites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards. Such safeguards are expected to include a user friendly mechanism to opt-out from any data collection and comprehensive anonymization mechanisms that are applied to other collected identifiable information such as IP addresses.

In this regard, should article 5.3 of the Directive 2002/58/EC be re-visited in the future, the European legislator might appropriately add a third exemption criterion to consent for cookies that are strictly limited to first party anonymized and aggregated statistical purposes. First party analytics should be clearly distinguished from third party analytics, which use a common third party cookie to collect navigation information related to users across distinct websites, and which pose a substantially greater risk to privacy.

So Art. 29 WP does not consider it a privacy risk under the conditions in the last two paragraphs. At least in some EU countries (Like the Netherlands) you would be exempted from the requirement of informed consent because of that.

In your question you also mention you use "a soft opt-in on continual use". That is not sufficient to obtain consent.

  • Is GDPR actually relevant to this question? The Cookie Law governs the storage/retrieval of information in general, not personal data as GDPR does. – Greendrake Oct 16 '18 at 10:20
  • @Greendrake The question is basically about Directive 2002/58/EC. Article 2(f) and recital 17 of Directive 2002/58/EC define the notion of consent in reference to the one set forth in Directive 95/46/EC. Art. 94 GDPR includes: Directive 95/46/EC is repealed with effect from 25 May 2018. References to the repealed Directive shall be construed as references to this Regulation. So the GDPR is only relevant on how to obtain consent. – wimh Oct 16 '18 at 10:42
  • soft opt in on continual use is allowed under certain circumstances. This is down to cookiebot. Are you saying they have it wrong? – DCdaz Oct 23 '18 at 11:01
  • Yes cookiebot is wrong. (And not only in that regard, there is more incorrect on their website). See also GDPR, is scrolling the page can mean cookie acceptance? – wimh Oct 23 '18 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.