Cookie compliance with GDPR when cookies don&#39;t collect the PII?
<p>We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics).</p>

<p>So here is the question with Google Analytics we are not assigning users with GA UserID and IP anonymization is turned on. So GA assigns the Client ID only, which is randomly generated to each visitor of our website.</p>

<p>Regarding to Facebook Analytics – Facebook states that they are not collecting Personal Identifiable Information in their Privacy Policy notice “Advertising, Measurement and Analytics Services (Non-Personally Identifiable Information Only).”.</p>

<p>So do we still need to get the consent from users as information that both Analytics services collect is not PII?</p>

<p>First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the <em>security of processing</em></p>

<p>I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is <em>adequate</em> to ensure <em>security of processing</em> as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord).</p>

<p>As for Facebook Analytics, I think you've simply misunderstood their <a href="https://www.facebook.com/policy.php" rel="nofollow noreferrer">policy</a>.</p>

<p>Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information".</p>

<p>AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways.</p>

<p>What they actually say about PII in the context of Analytics is this:</p>

<blockquote>
  <p>We do not <em>share</em> information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission.</p>
</blockquote>

<p>Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy.</p>

<p>OK, moving on to cookie compliance.</p>

<p>To you (the controller), both Google and Facebook are processors.</p>

<p>Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data.</p>

<p>So <em>if</em> I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV).</p>

<p>As for Facebook, the fact that they promise <em>not</em> to share PII with third parties is irrelevant because they <em>collect</em> personal data.  You will always need consent from your users to hand over their PII to Facebook in the first place.  This is not optional.</p>

<p>PS: If was a user, that consent would <em>never</em> been granted, no matter how great or valuable your site might be. If you have <em>any</em> sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.</p>

gdpr