Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent?
If so is there any way to use Google Analytics without having to ask for consent?
Consent for cookies is not mandated by the GDPR, but by some member states' implementation of the ePrivacy directive. Specifically, cookie consent
This leads to a situation where you might not need consent for the analytics themselves, but still need consent for the cookies that are used to track a user for analytics.
In practice, the cookie consent requirements are handled very differently. Some sites ignore this requirement, others show a notification banner that doesn't collect active consent like the GDPR would require. Yet other sites bundle cookie consent with other consent issues into a single consent management solution.
Currently, the passive notification looks like a best practice in general. However, the actual privacy laws in your member state might have more specific requirements.
With regards to consent for Google Analytics, note that the use of anonymizeIP does not directly affect whether you have to collect consent.
The GA documentation doesn't always make this distinction clear.
Cookies are 3rd party pieces of software that may gather Data that you are unaware of, so disabling the IP addresses on your end side, does not mean Privacy Assurance. You need to have a proper Cookies Policy, the ones which are "mandatory" as a Service Enabler need to be explained as such and all must have a manufacturer description of "purpose" and "scope, while enabling Data Subject to opt-out from all. The ones that are mandatory further should have a disclaimer stating that if opted-out the service may not be possible to deliver. Then, although in many cases it is of no avail, you need to have documented proof that you tried to get a DAta PRocessing Agreement with those manufacturers, for the will act as "processors" via their Cookies and you never know if they will gather and/ or share Data with unauthorized 3rd parties. And... yes, I know, many are not doing this... yet they need to.
