While some aspects of this might be OK, this sounds like a bad idea overall: such honeypot strategies are unlikely to yield useful information in a legal manner.
I asked about this topic on the data protection board and would like to highlight some relevant aspects here.
What is the exact purpose?
Under GDPR, every processing of personal data must have a clear purpose. Collecting personal data because it might come in handy is not OK. Your suggested purpose is to identify stalkers or hackers. However, this is still fairly vague. What would you do with potentially identifying information?
For this answer, I'll assume that the goal is to collect enough information in order to file charges. Typically, an IP address is sufficient for this and the court can then subpoena the internet service provider for information on the subscriber for that IP address.
Do you have a Legitimate Interest for such measures?
The GDPR requires that every processing of personal data has a “legal basis”. Consent of the data subject is the most famous basis, but is not useful here.
Instead, we can consider whether this could be a legitimate interest (LI).
Art 6(1)(f) GDPR provides three criteria for a LI:
the purpose must be legitimate,
the processing must be necessary for this purpose,
and this interest must not be overridden by the rights and freedoms of the data subject.
This last point requires a balancing test between the different interests and rights:
your interest to make a police report, the stalkers interest in privacy.
To determine whether the purpose of collecting this data is legitimate, I think it is important to consider whether the threat posed by a stalker or hacker is real and current, or speculative. In a similar context – video surveillance – the EDPB writes in its guidelines 3/2019:
20. The legitimate interest needs to be of real existence and has to be a present issue (i.e. it must not be fictional or speculative). A real-life situation of distress needs to be at hand – such as damages or serious incidents in the past – before starting the surveillance. In light of the principle of accountability, controllers would be well advised to document relevant incidents […] and related criminal charges.
So I do not think it is compliant to say “if there are any stalkers, I want to gather any data about them”. However, if there have been stalking or hacking incidents in the past which you haven't been able to pursue due to lack of evidence, then this would shift the balance of the LI test to your favour.
In general, the GDPR does recognize that security measures (cf. Recital 49) and data necessary to establish legal claims can be covered by a LI – but this doesn't absolve you from carrying out the balancing test.
Which concrete measures would be compliant?
You have suggested various measures in order to identify attackers. However, the GDPR will only cover measures that are adequate and necessary to achieve the stated purpose, see also the Art 5(1)(b) data minimization principle. Here, “adequate” means that that the measure is actually able to achieve the stated purpose. And you are only allowed to collect what is necessary for your purpose, not more.
Files with tracking pixels are adequate to disclose the attacker's public IP and will not yield unnecessary data. However, the same information could be obtained without tracking pixels by logging the IP in the web server's access logs when the attacker accesses a web page. Under certain circumstances, technologies like WebRTC might yield the visitor's real IP address even if they use a VPN.
Google Drive might not actually yield any useful information – this approach might not be adequate. In particular, it will not log certain information from visitors that are external to the Google Workspace domain. The Drive Audit Log is also only available at higher Google Workspace subscription tiers and is not part of Google's B2C free tier. I don't buy the argument that the stalker would have given consent to tracking through the Google Drive user interface. “Consent” has a very specific meaning in a GDPR context.
Google Analytics is quite unlikely to produce useful information. For starters, many browsers block such analytics outright. Even if the analytics work, the data is unlikely to enable identification. GA will not show you the visitor's IP address. The estimated location is derived from the IP address, but often extremely inaccurate (I've seen errors of ~300km, due to network topologies of residential ISPs). Demographics information are an extremely rough estimate that relies on sharing visitor data with Google, which goes beyond what is necessary. This estimate will be too unreliable to assist with prosecution.
What other compliance hurdles could there be?
Some of the data you would collect would fall under the scope of the ePrivacy directive. For example, you can only set cookies if this is strictly necessary for the service explicitly requested by the user, or when the user has given their consent. For example, this means your proposed Google Analytics solution would require the purported stalker's consent to properly work.
Speaking of using Google services, it should be noted that these involve processing of personal data in countries that do not offer an adequate level of data protection. The continued use of such services might not be compliant following the 2020 “Schrems II” ruling.
I also have doubts how you could fulfil your transparency requirements in this context. Per Art 13 GDPR, the data subject must receive transparent information about what is being done with their data. Usually, this would be satisfied with a privacy notice that is linked from every web page. However, this will mean that your honeypot cannot be fully covert.
Conclusion
Some aspects of these proposed honeypots sound quite reasonable.
For example, keeping web server access logs for a short duration is likely to fall under a legitimate interest, likely to be permitted by ePrivacy, and likely to yield an IP address that could help with a useful police report.
Other proposed methods such as misusing Google Analytics is less likely to work for technical reasons. All these methods must consider what is adequate and necessary for the actual purpose, and not just speculatively gather data.
Finally, all of the compliance work should be done before the honeypot is set up. Done carelessly, such surveillance measures could be illegal which could backfire.
This answer has focused on stalkers because identifying those might be useful and possible. In contrast, professional hackers will know how to cover their tracks and will often be beyond the reach of the law. It is very good cybersecurity practice to detect attacks, and honeypots could be part of that. But in that context, it wouldn't be very useful to identify the persons behind an attack.
