3

I use a number of different cookies on my website for tracking and saving preference. I'm very confused about which can and cannot be set with and without consent under GDPR

I'm certain I need consent for personalized ads, but what about these other cookies?

1) Google analytics - To track devices and page views. (I don't link analytics with any personally identifiable information like login or email)

2) Adsense - To server personalized Ads

3) Google re-captcha v3 - I use this because I want to prevent spam bots from completing an AJAX requests and filling my server with spam data. Basically my website lets a user create a map, upload it to my server, and then use a link to open that map again.

4) Preference cookies - I save a cookie on the device that remember which theme has been set for the website so the user doesn't have to change it again on their next visit (This is not linked to any login information, its just a cookie that says theme=darkmode or something)

5) Session login cookies - When a user does login to my website I set a cookie for their Email and session ID

Improve this question
1
  • 2
    It makes sense to look at compliance obligations under GDPR separately from ePrivacy. The ePrivacy directive requires that you obtain consent prior to using cookies, unless this is strictly necessary for your service to work. E.g. session or preference cookies are strictly necessary, analytics or ads are not. The ePrivacy consent requirement does not depend on whether the cookies contain personal data.
    – amon
    Nov 23, 2019 at 7:57

1 Answer 1

Reset to default
1

GDPR covers all of it, including third party cookies. Tons of sites follow the GDPR rules with regard to Google ads and such. https://support.google.com/google-ads/answer/9028179?hl=en

Improve this answer
5
  • 1
    I've been reading many different articles that state that google analytics doesn't require consent if you disable the more advanced features. consent.guide/google-analytics-cookie-consent
    – Fish
    Nov 22, 2019 at 18:49
  • The are saying if you pass no personal or identifiable info than you don't have to, but really that would be hard to do and pointless.
    – Putvi
    Nov 22, 2019 at 18:51
  • I don't collect any personally identifiable information. I also anonymize the IP address of users. I turned off all the re-marketing, interest based data collection, and unlinked my adsense account from analytics. The only thing that google analytics collects is "A user from the UK viewed this specific webpage" There is no way for me to personally identify any one user and I don't give that information to any other 3rd party.
    – Fish
    Nov 22, 2019 at 19:09
  • Ok if it's anonymous.
    – Putvi
    Nov 22, 2019 at 19:10
  • 1
    Based on CJEU Case C‑673/17 (Planet49) (paragraphs 68-70), all cookies require explicit consent regardless of personal data is being processed. However, there are exceptions.
    – wimh
    Nov 22, 2019 at 23:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .