Does anonymised Google Analytics require positive opt-in under GDPR/PECR?

Question

The EU defines personal data as:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Thinking about Google Analytics: Provided PII is not pushed through a website's URL, then Google Analytics's only way of identifying a user is through their IP address, but GA has the ability to anonymize their IP Address.

So if there's no way to see "any information relating to an identified or identifiable natural person" because their IP address has been anonymized, then do you need a user's consent to enable GA on your website?

Answer 1

Yes, GA requires consent even when only collecting anonymous data. The issue is that GA stores a client identifier as a cookie in the visitor's browser.

PECR/ePrivacy require consent if you access any data on a users device where that data is not strictly necessary. Analytics are not strictly necessary, therefore you need consent when using analytics cookies (or similar technologies such as Local Storage or fingerprinting techniques).

You can configure GA to not store cookies, e.g. by setting storage: 'none' in analytics.js or client_storage: 'none' in gtag.js. This will cause a new client ID to be generated at every page load, which means that you will no longer get meaningful statistics about sessions, repeat or new users, or bounce rates.