Using AI to identify similar browsing pattern
<p>I understand that storing any hash or IP that can identify &quot;user uniquely&quot; is against GDPR. I am planning to use user browsing patterns to see if a similar or the same user had previously visited the website. (Scroll pattern/click frequency and so on.) There will not be any hardware related information saved or any cookie saved on the client side, just the pages visited and &quot;way&quot; a user navigated the website.
Is such a method GDPR compliant?</p>

<blockquote>
<p>I understand that storing any hash or IP that can identify &quot;user uniquely&quot; is against GDPR.</p>
</blockquote>
<p>That is not correct. However any data which is identifiably associated with a an individual human, including any data which could be used to identify that human, is generally &quot;Personal data&quot;, and may not be processed (which includes storing it) without a lawful basis, if the GDPR applies. Any of the <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">six lawful bases</a> allowed by the GDPR may be used, including consent, and the legitimate interest of the data controller.</p>
<p>The GDPR does not generally specify that particular technological solutions are permitted or forbidden. If this usage pattern could reasonably be used to identify a particular person, or to single out a person from among a group of people, it is probably personal data, and a lawful basis would be required. Otherwise, not.</p>
<p>As for whether such a person is &quot;identifiable&quot; if use of this technique permits the Data Controller to identify two visits at separate times as having been made by the same person, when the later visit is still in progress or is recent, the IP for that visit will still be available, and thus could be associated with the first visit as well. And even if that is not done, such a technique could permit building a profile of such a person, including the actions taken on different visits. I think that would be enough to make this &quot;personal data&quot;.</p>

gdpr