4

Note: I've been directed here from Meta.SE

I'm using GoSquared for my website analytics.

I've visited quite a few sites using Google Analytics but they don't have a cookie policy or a cookie banner/cookie notice, even though Google Analytics uses cookies to provide their services.

Do I need to make my own cookie policy or cookie notice if I use GoSquared Analytics (which also uses cookies to function)?

Note that these are non-essential cookies provided by a third party.

And does the fact that I am in the UK change anything?

Improve this question
0

1 Answer 1

Reset to default
7

Most likely yes if you are subject to UK or EU laws:

  • The EU ePrivacy directive and implementing laws such as PECR in the UK require that you obtain consent before accessing information on a user's device, unless that access is strictly necessary to perform a service requested by the user.
  • Cookies and similar technologies such as LocalStorage are stored on the user's device.
  • Analytics are not strictly necessary to display a website.

Thus, you need to obtain valid consent before setting any analytics cookies.

GDPR and ePrivacy/PECR have some interactions:

  • Even though the cookies might technically be set by GoSquared, you as the website operator are responsible for compliance. You are the data controller, the third party analytics are usually a data processor who only process data on your behalf. You must ensure that the data processor is compliant. Even if they were a joint controller you'd be responsible for what happens on the website (relevant precedent is the Fashion ID case).

  • While ePrivacy originally had a fairly weak concept of consent (e.g. “by continuing to use this site, you consent …”). However, the GDPR updated the definition of consent, so that valid consent must be freely given, informed, actively given, and specific. If you set cookies for different purposes in addition to analytics, users should be able to give or withhold consent for analytics independently from other purposes. Since consent must be actively given, consent is never the default, e.g. pre-ticked checkboxes are not compliant (relevant precedent is the Planet49 case).

  • Like Google, GoSquared stores data in the US. You are causing personal data to be transferred into the US, which is an international transfer. Before it was invalidated earlier in 2020, such transfers were easy to do under the Privacy Shield adequacy decision. Now, such transfers are only legal if you sign SCCs with your data processor, and your risk assessment indicates that your user's data is sufficiently safe there, despite your processors potentially being legally unable to comply with the SCCs. Fortunately for you the UK's ICO has taken a more industry-friendly stance on this matter than other countrie's data protection agencies.

Why do so many websites use Google Analytics (GA) without requesting proper consent? A variety of potential reasons:

  • They are actually non-compliant.
    • After all, GA is not GDPR-compliant in default settings, and Google doesn't do a good job of providing essential information.
    • Many data protection agencies have indicated that cookie consent enforcement is not their focus.
  • GA can be used without using cookies/LocalStorage/…, and thus without requiring consent under ePrivacy or PECR.
  • The websites might not be subject to EU or UK laws such as ePrivacy.
Improve this answer
5
  • 1
    What's the worse that could happen if I don't create a cookie notice for my site? It's only a portfolio landing page and my other projects are only static sites. Would authorities care?
    – Aryan Beezadhur
    Oct 17, 2020 at 20:31
  • @AryanBeezadhur That would depend upon which authorities you're referring to, and, in any event, is a subject for politics.stackexchange.com, not Law.
    – DavidRecallsMonica
    Oct 17, 2020 at 23:29
  • 1
    @AryanBeezadhur The worst that could happen is that the ICO fines you €20M, but that is NOT a realistic outcome. The ICO is not actively looking for noncompliant cookie notices, and would likely just ask you to fix this if they receive a complaint against you. However, affected data subjects might sue you directly, or offer to settle with a cease-and-desist letter. It is thus best to avoid glaring mistakes. Potentially, reconsider whether you really need analytics or whether integrating third-party analytics is the easiest approach (taking into account the compliance effort).
    – amon
    Oct 18, 2020 at 9:27
  • 1
    @AryanBeezadhur It is my understanding that you don't need consent if cookies are deactivated. Then, every pageview should appear as a new user. And yes, you should anonymize IP addresses due to a different part of the ePrivacy directive (IP geolocation is unreliable anyways). I use Google Analytics in a comparable configuration. The remaining compliance concerns are that GS must be your data processor, that you must figure out a legal basis for international transfers, and of course a privacy policy. Arguably, you don't need consent/opt-in but you might need an opt-out solution.
    – amon
    Oct 19, 2020 at 10:28
  • 1
    @AryanBeezadhur From their docs, it looks like they got an external audit in 2018 to assess GDPR compliance. That's pretty good, but doesn't prove anything. (1) This doesn't mean that their services are compliant by default, just that they can serve as a “data processor”. You as the data controller would still be on the hook for configuring their services properly, e.g. by disabling cookies. (2) Since this assessment Privacy Shield was invalidated, which has added significant legal uncertainty when using US-based services. In both of these aspects, they are essentially equivalent to Google.
    – amon
    Oct 22, 2020 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .