0

I've been reading about GDPR a lot, and I have a bit of a confusion. I know I have to show a consent banner with an opt-in for enabling cookies related to Google Analytics.

Frankly I would like to avoid the consent banner, and I don't need very detailed statistics.

I found that there is a "cookie-less" mode of Google Analytics:

ga('create', 'UA-XXXXXXX-XX', {
    'storage': 'none',
    'clientId': MY_GENERATED_CLIENT_ID
});

My question is as follows - If I use something like fingerprintjs (as described here) to generate the clientId (based on a number of parameters that identify a client - os, browser, resolution etc.) + anonymize the IP (i.e. - remove the last octet).

Do I still need consent banner on my site? Also do I need consent for my own cookies that are essential (login, preferences etc.), and if that is the case, would a simple banner that has a link to the privacy policy/cookie policy with an "Accept" button (without "Reject") be sufficient?

Any help would be highly appreciated!

EDIT

Would I still need consent if I don't store/generate a clientId at all - but instead have it being generated on each page load? This will skew my statistics quite a lot, but I suppose it's better than nothing. Would that + an anonymized IP address be ok to be used without consent?

3
  • Generating a new one for each payload gives you an argument for anonymity but not a guarantee of anonymity - the identifier + action combination would need to be unique enough that you cant track the user across multiple requests to your site. At this point, you have to ask yourself what analytics you are getting from GA that you couldnt get from your own servers logs (btw, if you are logging IP address there, it makes all this moot because thats an online identifier also covered under the GDPR...).
    – Moo
    Nov 4 '20 at 20:37
  • @Moo That's a very good point, thank you. I see that no matter what, if I want to have analytics I would have to get an explicit consent from the user. Honestly during my research on this topic, I was shocked to see many established websites not implement their "cookie banners" correctly. Nov 4 '20 at 20:41
  • @Moo That is including - this very site that we're on. Based on my research it appears that the cookie banner is not compliant (no way to reject cookies, no way to turn them off, no explicit consent etc.) Nov 4 '20 at 20:45
1

The consent requirement doesn't come from using cookies, but from the ePrivacy directive's rules on accessing information on the user's device, unless that access is strictly necessary for the service requested by the user. The law is not specific to any technology.

Fingerprinting generally accesses information on the user's device, and is therefore equivalent to setting a cookie with an ID: you're going to need consent. Generating a new random ID upon each pageload avoids this problem (GA will do this automatically if no existing ID is found). Additionally, a random ID that won't be reused likely isn't personal data in the sense of the GDPR, which simplifies compliance.

You do not need consent for setting/accessing cookies that are strictly necessary, e.g. for preferences. While GDPR requires that you are transparent about your processing activities, this doesn't necessarily require you to show a cookie banner. In my opinion, showing a cookie banner only for essential cookies would be confusing because there's no action the user can take. Where you see cookie banners that don't collect valid consent, this is typically either cargo cult compliance (imitating compliance without understanding actual requirements), or following pre-2018 rules on cookie consent which had a much laxer concept of “consent”. Of course, you should still explain your use of cookies and similar technologies in your privacy policy.

1

Do I still need consent banner on my site?

Yes.

The "cookie banner" name is a bit of a misnomer, because the GDPR (Article 4 Section 1) specifically calls out "online identifiers" as something you need a legal basis to process - thus you need a "consent banner" or a banner which identifies to the user the legal basis for processing.

"Online identifiers" may indeed include device fingerprinting (the UKs ICO calls this out) because you are building the fingerprint with the intent of identifying that user across separate requests to the backend.

3
  • Thanks for the answer, I might get rid of analytics altogether, frankly this is too much of a hassle. Do I still need consent (or a at least a notification the first time a user visits the site - until said notification is dismissed) for the "essential" cookies? Nov 4 '20 at 20:17
  • 1
    You dont need consent, but you do need to notify the user that they exist and your policy surrounding the data - the user may still have rights under the GDPR with regard to accessing that data or requiring correction or deletion.
    – Moo
    Nov 4 '20 at 20:22
  • Thank you so much for the help. I've edited (added to) my question - could you take a look if you have the time? Nov 4 '20 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.