I was intrigued by this question: Why is the Google Analytics cookie defined as "strictly necessary" and saved without consent?, and how GDPR/E-Privacy applies to paying, corporate subscribers of a B2B website or platform, when:
- X licences are purchased through a business contract.
- Corporate email addresses are assigned to a licence and used to log in.
- There are no ads, marketing, nor recommendation features.
- There is no 'free' tier of the site.
Assume there is a single cookie that stores a unique ID and is passed to Google Analytics (GA) post-login. No other information is provided. Is consent required? Is it the fact that GA is involved the requirement for consent? Are any of the following legitimate interests?
- Provide usage statistics to clients. E.g to understand license occupation.
- Identify fraud. E.g if the same ID logs in from multiple locations.
- Understand engagement of site features. E.g how many IDs clicked something.
If a cookie banner is implemented as-is, and 'reject all' chosen, the above are no longer possible, which has a significant business impact. E.g if a client knows they cannot be tracked, what prevents them from sharing licences?
We have no need for PII and could even offer a completely anonymised experience. We simply need to know if licence X is in use or not, which we can only do by pushing an ID into GA. Whilst the site can function without this ID, are there mitigating circumstances here?