I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, too. The resulting data should be combined with the tracking. E.g. for visitors from industry sector X we would check their tracking data to observe their behavior on the website. Would that be legal with respect to gdpr?

1 Answer 1


The answer is most likely NO, since you are likely to not have done a DPIA (Data Protection Impact Assessment) or you wouldn't be asking this question.

So piece by piece...

ClickStream is the process by which visited content is assessed, so a certain visitor is profiled as having "interacted" and HOW did it interacted with WHICH content (time spend; additional clicks; etc...).

Now I have mentioned "...HOW did it interacted..." and not he/ she, so at that stage you are not certain if it was a human or machine...

If you know it is a given specific person (because he/ she is authenticated or you have a way to cross-reference the IP address with a name) the it becomes he or she and in that case we have Personal Data being processed by you, for all of that gathered clickStream data will be Profiling a Natural Person.

Profiling needs at least to be informed to the Data Subject and if done via automated processing (common examples Hadoop or other big data analytics) or shared with 3rd party entities (your corporate clients) it definitely requires Consent.

So, do yourself a favor a do a GDPR Compliance Project... quickly, because it really sounds you are at risk of getting a unpleaseant ticket or one of your Corporate Clients getting one due to your non-compliance as a Processor under GDPR.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .