0

If a website never assigns a user a unique identifier, does the website need to get explicit consent from the user before collecting non-personal information?

Examples of non-personal information that the website collects:

  • the URL of the page that the user is on
  • what browser the user is using
  • the resolution of the user's screen

The website does not collect names, emails, IP addresses, location, or anything else that could tie the data back to a natural person.

I've seen a number of websites ask explicit permission before collecting this kind of non-personal information with a browser cookie. I'm assuming that the websites that use these browser cookies need to ask permission because they have the capacity to track individual users between webpages.

I haven't seen any websites ask for permission to collect non-personal information without a cookie. I'm unsure whether this is due to non-compliance or whether these websites truly do not need to get permission to collect non-personal information.

5
  • In many circumstances GDPR does not require consent to process personal information, either.
    – phoog
    Oct 27, 2023 at 22:50
  • @phoog can you elaborate on that? Everything I've read suggests that GDPR requires that personal information not be processed until either the user gives explicit consent or consent through some other positive action, (e.g. a user creates an account on a website). What are the types of situations in which GDPR allows processing of personal data without either explicit consent or consent through a positive action? Oct 28, 2023 at 0:21
  • 1
  • @AaronStanek Art 6(1) GDPR lists potential legal bases. Aside from "consent", a "legitimate interest" and "necessary for performance of a contract" are common. LI requires balancing the competing rights and interests, typically only covers processing that data subjects can reasonably expect, and typically requires you to offer an opt-out. But some of your interests might be so overriding that no opt out would be appropriate. For example, you wouldn't ask hackers/trolls/adversaries for consent and wouldn't offer them an opt-out for safety and security features.
    – amon
    Oct 28, 2023 at 14:03
  • 1
    The tricky part with client-side data collection is that this isn't just a GDPR thing (when "personal data" is involved), but also an ePrivacy thing (regardless of personal data status). You can collect client-side data (such as cookies or screen size) when necessary for the user-desired site features to work, or when given GDPR-strength consent. There is currently no exception for legitimate interests or for analytics (except in NL, but that might be invalid).
    – amon
    Oct 28, 2023 at 14:06

1 Answer 1

3

Does GDPR require consent to collect non-personal information?

No. As long you process no data that meets the GDPR definition of personal information then the GDPR does not apply to you.

The tricky thing is what is personal information. You should know about browser fingerprinting, you mention "resolution of the user's screen" and that is a big one. However, if you are careful, and if only need things like "How many people were phone, tablet, laptop, big screen" an you have full control over the server it should be quite possible to collect what you need without processing any personal data in a way that requires consent.

You will need to turn off or in pipe sanitise a lot of logging.

2
  • You should point out that an IP address is personal information.
    – Dale M
    Oct 27, 2023 at 4:05
  • @DaleM The question specifies those are not collected.
    – User65535
    Oct 27, 2023 at 5:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .