Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either:

  • The user consents to having that piece of data collected while being able to maintain access to the service if the decline to consent
  • There is a direct business need to store that data
  • There is a legal need to store that data

However, consider the following scenario:

  • There is a web app that requires users to log in to access
  • Users can not log in unless they agree to the terms and conditions
  • Once logged in all button clicks (and keystrokes on the site) by users are recorded (on the service operator's servers)
  • This recording behavior is described in the terms in conditions
  • The service operator needs to collect this data in order to identify how to improve their service in the future

Is such a scenario allowed? My gut inclination is that it would not be allowed since the need to identify future service offerings is not "direct" and that one of the benefits allowed by GDPR is that individuals have the right to opt out of analytics tracking while continuing to be able to use services. However, a counter argument that could be made is that this business need is direct. Which interpretation is correct?

  • "needs to collect this data in order to identify how to improve their service in the future" probably wouldn't stand up in court. They don't need that data for that purpose, they only want it. It is for the business to decide whether collecting the data is more important than the business they lose by refusing to allow users to opt out of its collection. I think the best argument is going to be that the behavior is described in the terms and conditions.
    – phoog
    Jul 6, 2019 at 0:27
  • @phoog It is NOT for the business to decide whether collecting the data is more important than the business they lose by refusing to allow users to opt out of its collection. GDPR forbids them that choice. If they need the data they can collect it. If they just want it, they cannot collect it without permission - and denying permission must allow continued use of the service. Jul 9, 2019 at 18:47
  • 1
    @MartinBonner where does the requirement that "denying permission must allow continued use of the service" come from?
    – phoog
    Jul 9, 2019 at 18:51
  • One of the checklists on the ICO website includes "We avoid making consent a precondition of a service." That is not quite as strong as I was expecting (and that is only one national body's interpretation), Jul 9, 2019 at 18:59
  • 1
    @MartinBonner It's not an interpretation, that's just a plain language summary of Art 7(4) “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” Also note that processing doesn't have to be necessary in order to be lawful. E.g. a legitimate interest can be sufficient grounds for processing, as long as it is balanced against the data subject's interests.
    – amon
    Jul 9, 2019 at 19:24

2 Answers 2


This would probably fall under the "legitimate interest" basis. However the service provider would need to show that the processing they did was aimed at this objective and in accordance with the data protection principles, particularly of data minimisation and storage.

They should consider what data they want to extract from the detailed logs, whether the logs can be anonymised, how long they need to keep them, and whether they can achieve their objectives by storing aggregate data (e.g. percentage of people who clicked this link when viewing this page) rather than individual clicks and key presses. They should also consider whether the logs might reveal special category data (e.g. health, sexuality, religion, politics). This can happen if, for instance, the site contains information about a particular disease; people who read it are likely to have that disease or know someone who does.

  • In fact, it is very likely not to fall under Legitimate Interest at all... service optimization needs to to crystal... and we do not know if it is or not without a LI impact assessment. Jul 11, 2019 at 19:07

You are correct that any processing needs a legal basis (although there are more than the three you listed, compare Art 6(1)). Strictly speaking, it is not the processing but the processing purpose that requires a legal basis.

There is also no legal basis that broadly allows any “business need” or requires that business needs be direct. Instead, there is:

  • necessity for performance of a contract, which is fairly narrow.
  • legitimate interest, which requires the legitimate interest to be balanced against the data subject's interests. Legitimate interest is an opt-out approach: the data subject must generally be able to object to this processing.
  • consent, which allows anything but requires the data subject's explicit, specific, informed, and freely-given opt-in.

Processing must also be known to the data subject (transparency principle) and must only collect data that is necessary for that purpose (data minimisation principle). The processing must be proportional to its purpose.

The purpose of improving services is clearly covered by legitimate interest, so that first-party website analytics are generally fine (as far as the GDPR is concerned, but note that any involved cookies may require consent under ePrivacy).

But the mechanism of capturing all clicks and keystrokes will generally be excessive for that purpose. Recall that legitimate interest requires the legitimate interest to be balanced against the data subject's interests. Here, the data subject's interests to not be subjected to that level of surveillance would probably outweigh any legitimate interest in these analytics.

That the data collection is disclosed in the terms of service does not matter here: that is required for transparency, but the agreement to these terms does not fabricate consent in the sense of the GDPR (the agreement is not sufficiently specific).

Since such keystroke tracking is highly invasive, the controller would likely have to write an Art 35 Data Protection Impact Assessment, regardless of the chosen legal basis. In general, it is the responsible data protection agency's call whether such DPIAs are required. A DPIA helps defend the controller's decisions before the DPA, and in some cases prior DPA approval is required (Art 36).

So are these mouse and keyboard analytics forbidden? Not outright. But to use them the controller would need to clear a very very high bar and the chance of that is quite slim. Most likely, the processing as described is a GDPR violation.

  • Good answer, yet it is wrong when you refer to ePrivacy... In these cases Cookies are automated Processing tools (of Personal Data) and it is not the ePrivacy which applies for it is a Directive and not a Regulation, yet GDPR itself. Jul 11, 2019 at 19:03
  • That is relevant because there are no direct penalties under ePrivacy, being a Directive it also depends from each Member Stated adherence to it. However since it is a case of GDPR and not really ePrivacy, there are direct penalties... Jul 11, 2019 at 19:04
  • Then the "keyboard analytics is in fact potentially "profiling" of a given Data Subject and that renders it as a Service on its own, that requires Consent as the Processing Lawful Base (in this case). Jul 11, 2019 at 19:05
  • @RuiFreitasSerrano The use of cookies is regulated both by the GDPR and by member state's implementation of the ePrivacy directive. Compliance is required regardless of whether fines are possible. I'm not sure I understand the distinction you're drawing. I do agree thought that these keyboard analytics would have to rely on consent.
    – amon
    Jul 11, 2019 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .