0

I can't seem to find a reliable answer to this question. As IP addresses are considered PII under the EU's GDPR, it seems important that Google Analytics tracking is placed behind a cookie consent banner.

However GA has the options to anonymize IP addresses using:

ga('set', 'anonymizeIp', true);

If this feature is enabled, the last three digits of a users IP address are no longer stored. However a cookie IS still installed to help track that user's behaviour across your website.

In this situation do you still need to require user consent? If so, why?

Improve this question

1 Answer 1

Reset to default
1

Per the ePrivacy Directive you need consent to store non-necessary cookies client-side. E.g. Google Analytics cookies.

You're inadvertently confusing two different but somewhat related pieces of legislation.

"Cookie consent" banners and such are intended to address the requirements of the ePrivacy Directive. That requires you to get active, explicit consent from users when you want to store non-necessary cookies (or Storage or whatever) on their devices - client-side. In this context analytics cookies are not considered necessary. So if you want to use Google Analytics in the standard way you must ask for the user's consent to store Google Analytics cookies. If you don't get that consent then you are not allowed to store those cookies.

GDPR relates to 'personal data' stored organisation-side. There are six lawful bases (i.e. reasons) an organisation must choose from to store personal data. But it should not be storing any 'personal data' in Google Analytics "that Google could use or recognize as personally identifiable information" (my emphasis).

Your country should have some kind of data protection authority like the UK's Information Commissioner's Office and they ought to have produced guides to (A) the ePrivacy Directive and (B) GDPR.

Improve this answer
2
  • I think you're half right. The impending ePrivacy Regulation is about to change the law in this regard, however the current ePrivacy Directive is more open to interpretation. See: ukandeu.ac.uk/fact-figures/what-are-eu-directives Everyone is regulating to reach what they think the ePR is going to announce, but it's been a long time coming, and nobody knows for sure of what it will finally contain.
    – Django Reinhardt
    Jul 14, 2020 at 20:46
  • @DjangoReinhardt I don't know why you're talking about future law in this context. The ePrivacy Directive aka PECR aka Privacy and Electronic Communications Directive 2002/58/EC has been implemented into the national laws of a number of member states (if not all of them by now. E.g. the UK ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr. The GDPR does not demand that consent is asked when storing cookies - the PECR does.
    – Lag
    Jul 15, 2020 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.