I am a part of developers team in a software as service project hosted and HQ-ed in United States.
Why I asking my question
I personally tasked to improve our analytics and one of tasks is to find an alternative or develop in-house solution to be used instead of Google Analytics.
Main expected requirements are:
- be able to gather aggregated analytics data scoped only to our website, like visitors total count and by referrer websites, pages popularity, and like/dislike ratings overall (users able to set these ratings on our blog posts, FAQ, etc.),
- and e-commerce-related events for aggregated subscriptions, purchases and payments attribution to campaigns, affiliates, referrals, etc.) to be shown at a dashboard.
Implementation aspects in question: There is an option to use a special first-party cookie with sliding expiration like 4-8 hours, generated on our servers in case of its absence, so this is not a permanent device id or something bound to a user, his/her IP address or location. This cookie will have strictly set sliding lifetime adjusted to last time of interaction with website. This analytics cookie is a separate from auth (session cookie) whose sole purpose to remember signed in user if user signed in.
Should our website show a popup about cookies in this setup, and if so, what is should be stated there in accordance with latest GDPR, ePrivacy Initiative, UK PECR and CCPA?