I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy.

My goal is to avoid collecting any personal data for user privacy reasons and I don't want to bother visitors with consent. I have disabled cookies completely and I anonymize the last octet of IP-addresses (like Google Analytics), but for "User ID" Matomo only have the option to "Replace User ID with a pseudonym":

Note: replacing with a pseudonym is not the same as anonymisation. In GDPR terms: the User ID pseudonym still counts as personal data. The original User ID could still be identified if certain additional information is available (which only Matomo and your data processor has access to).

So since I can still identify people from this data collected I must inform the user? At the same time they have this section about consent on the same page:

When do I need to ask for user consent? To identify whether you need to ask for consent, you need to determine whether your lawful basis for processing personal data is "Consent" or "Legitimate interest", or whether you can avoid collecting personal data altogether. We recommend to learn more about the lawful basis under the GDPR for Matomo.

So, is it possible to not having to inform the user about data collection even though their User ID's are only pseudonymised? I guess there is no hope for tracking unique visitors either then?

EDIT: Is a Privacy Policy page in the footer enough, where I inform the user of the things above?

  • 1
    I think you answer your own question. Pseudonymisation of personal data is still personal data. To identify whether you need to ask for consent, you need to determine on which lawful basis your processing is based on.
    – wimh
    Aug 14 '19 at 17:24
  • @wimh Thanks for your response! Apparently this User ID data is not stored by default, the pseudonymisation is only IF I choose to store User ID, that made me feel better. If I where to use it, or something like it, only to identify recurring visitors i.e. unique pageviews, could that be considered legitimate interest do you think? I'm curious if there is any way (doesn't have to be through User IDs) of tracking unique hits without asking (or having to inform) the user about it. Aug 14 '19 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.