Is the user agent string considered personal data?

Question

I have a website. I would like to store the user agent string, current time and opened url (not the IP address or something else) in a database for each page visit to be able to build some statistical measurements.

The user agent string looks like:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/83.0.4103.61 Chrome/83.0.4103.61 Safari/537.36

Is this considered storing personal data? Do I need user's consent?

Thank you!

Answer 1

Is X considered personal data?

Can you use X to directly or indirectly identify a natural person? In the data to which you have access can X be related to an identifiable natural person?

If you answer yes to either of those questions then X is personal data.

Article 4(1):

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Scenario 1: you want to count each user agent that comes to your site, that's the only data you have, then the user agent is not personal data (it cannot be used to identify someone - unless it has a name and address etc, which seems highly unlikely - and you cannot relate it to anyone).

Scenario 2: you have customer records with names, addresses etc (clearly personal data) and want to record each customer's user agent then the user agent is personal data (it relates to the identifiable natural person).

Scenario 3: in one dataset you record that a user agent was associated with order ID 123456 and in another dataset you record that order ID 123456 was for John Smith (plus address etc), then the user agent is personal data (it relates to the identifiable natural person).

Is this considered storing personal data?

If X is personal data.

Do I need user's consent to record X?

If you want to record X and X is personal data, then you must have an Article 6 lawful basis for recording X. Consent is one of the six lawful bases.

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

Answer 2

A user agent string may be personal data depending on how it is processed. Aggregate statistics of user agent strings are not personal data. But if you combine user agent records with IP addresses or other identifiers, the user agent string would relate to a data subject that you can single out/identify.

While user agent strings can contain arbitrary text (someone could override their user agent to put their name, street address, and tax ID there), this does not seem to be particularly relevant. For GDPR compliance, it matters more how you process the data.

While GDPR is a foundational data privacy law in the EU, the ePrivacy directive goes into more detail for internet and telecommunication services. A user agent string would usually fall under it's definition of “traffic data” because it's generally transmitted as a HTTP header. Per ePrivacy Art 6, traffic data can only be processed:

• for transmitting a communication, e.g. to have your web server respond with different content depending on mobile or desktop user agents;
• when the data is made anonymous, e.g. as part of aggregate statistics on browser versions;
• for billing purposes;
• or when the user consents, where “consent” is defined by the GDPR.

However, the ePrivacy directive is not immediately applicable law, and every EU member state has its own law implementing this directive. Thus, you should look at the laws in the country in which you reside. These laws do not override GDPR but augment it, so you still have to ensure GDPR compliance (such as having a legal basis per GDPR Art 6 for every processing of such data).

I think that recording {url, date, user agent} tuples for the purpose of building statistics is not personal data in your context, or is at least a processing of personal data that doesn't require identification per GDPR Art 11. Such records would likely count as “anonymous” in the sense of ePrivacy, so that you can collect such statistics without having to ask for consent.

However, if a user agent is rare relative to the traffic volume on your site, it would still be possible to single out a particular user. Thus, it could make sense to break the connections between date and user agent or to never store individual records, just aggregate data. Speaking as a software developer, reasonable solutions might include:

• using streaming Bloom filters to avoid storing unique records, or using other privacy-preserving probabilistic data structures
• only storing denormalized records, and truncating/rounding timestamps to avoid linking events via their time. Instead of one table with a {url, timestamp, user agent} per event you might have separate tables with {url, time slot, counter} and {user agent, time slot, counter} aggregate records were the time slots are appropriately spaced for the traffic of the site.

Answer 3

Is this considered storing personal data? Do I need user's consent?

No. Article 4(1) of the GDPR defines personal data as "any information relating [directly or indirectly] to an identified or identifiable natural person" (brackets added). The closest your sample gets to that is the IP address. Due to how IP addresses are managed, typically an IP address alone is not enough for identifying a natural person.

Recital 30 mentions internet protocol addresses as an example of data which might identify natural persons "when combined with unique identifiers and other information received by the servers". The sample you show does not contain other information that used in combination with the IP address would result in, or facilitate, that identification.