Do i need User consent for Google Analytics to be GDPR complaint

Question

I am using GA on website as everyone out there does same. In order to be GDPR complaint i had used "https://cookie-script.com" script to for user consent for one of my website and i notice for last two month my web stats have gone down almost by 80% as i am asking for explicit user consent. I implemented user consent since 1 july 2018.

My understanding was that i still need explicit user consent for using GA even of i have IP Anonymized & Advertising Features turned off in GA.

recently i came across few articles which say if we IP Anonymized & turn off Advertising Features then we don't need user consent is this the fact or still need user consent for using GA tracking.

My GA Script when asking user for explicit consent

<script async src="https://www.googletagmanager.com/gtag/js?id=UA-xxxxxxx-x"></script>
<script type="text/plain" data-cookiescript="accepted">

    window.dataLayer = window.dataLayer || [];
    function gtag() { dataLayer.push(arguments); }
    gtag('js', new Date());
    gtag('config', 'xxxxxxx-x', { 'anonymize_ip': true });

</script>

NORMAL GA CODE

 <script async src="https://www.googletagmanager.com/gtag/js?id=UA-xxxxxxx-x"></script>
<script type="text/plain" >

    window.dataLayer = window.dataLayer || [];
    function gtag() { dataLayer.push(arguments); }
    gtag('js', new Date());
    gtag('config', 'xxxxxxx-x', { 'anonymize_ip': true });

</script>

This script will allow tracking only when user agrees to cookies.

Based on my question can i use google analytics based on above setting without user consent?

Answer 1

First of all, I'm not a lawyer but after reading the new law and analyzing Analytics, that's how I've been working since GDPR. The problem is that you can't track any user information without their consent, so, I started turning down all tracking functions.

This is my roadmap:

• Avoid cookies using the function: storage: none
• Anonymize the IP with anonymizeIp:true

• In case we use adverting, turn Advertising Features off

   ga('create', 'UA-XXXXX-Y', {
    'storage': 'none',
    'anonymizeIp': true
   });
  

At this point, Google Analytics will not be able to use client-ID (there are no cookies) so no user could be tracked. Make sure you are not using user-ID either.

Some articles say that you can use localStore instead of Analytis cookies but that is also against GDPR policies so the only way is not saving any information related to our visitors at all.

Without cookies you will not be able to know:

• Returning visitors. All visits will be considered as a new user.
• Correct attribution in multichannel conversion.
• Average time on page. It will be 0 for all sessions.

But you can have other metrics and dimensions without asking consent. This solution was checked by a lawyer but I'll recommend you to do the same before using it.