GDPR compliance cookie-less Google Analytics and consent banner
<p>I've been reading about GDPR a lot, and I have a bit of a confusion. I know I have to show a consent banner with an opt-in for enabling cookies related to Google Analytics.</p>
<p>Frankly I would like to avoid the consent banner, and I don't need very detailed statistics.</p>
<p>I found that there is a &quot;cookie-less&quot; mode of Google Analytics:</p>
<pre><code>ga('create', 'UA-XXXXXXX-XX', {
    'storage': 'none',
    'clientId': MY_GENERATED_CLIENT_ID
});
</code></pre>
<p>My question is as follows - If I use something like <a href="https://github.com/fingerprintjs/fingerprintjs" rel="nofollow noreferrer">fingerprintjs</a> (as described <a href="https://github.com/f055/cookieless-google-analytics" rel="nofollow noreferrer">here</a>) to generate the <code>clientId</code> (based on a number of parameters that identify a client - os, browser, resolution etc.) + anonymize the IP (i.e. - remove the last octet).</p>
<p>Do I still need consent banner on my site? Also do I need consent for my own cookies that are essential (login, preferences etc.), and if that is the case, would a simple banner that has a link to the privacy policy/cookie policy with an &quot;Accept&quot; button (without &quot;Reject&quot;) be sufficient?</p>
<p>Any help would be highly appreciated!</p>
<p><strong>EDIT</strong></p>
<p>Would I still need consent if I don't store/generate a <code>clientId</code> at all - but instead have it being generated on each page load? This will skew my statistics quite a lot, but I suppose it's better than nothing. Would that + an anonymized IP address be ok to be used without consent?</p>

<blockquote>
<p><strong>Do I still need consent banner on my site?</strong></p>
</blockquote>
<p>Yes.</p>
<p>The &quot;cookie banner&quot; name is a bit of a misnomer, because the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504" rel="nofollow noreferrer">GDPR (Article 4 Section 1) specifically calls</a> out &quot;online identifiers&quot; as something you need a legal basis to process - thus you need a &quot;consent banner&quot; or a banner which identifies to the user the legal basis for processing.</p>
<p>&quot;Online identifiers&quot; may indeed <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-are-identifiers-and-related-factors/" rel="nofollow noreferrer">include device fingerprinting</a> (the UKs ICO calls this out) because you are building the fingerprint with the intent of identifying that user across separate requests to the backend.</p>

<p>The consent requirement doesn't come from using cookies, but from the ePrivacy directive's rules on accessing information on the user's device, unless that access is strictly necessary for the service requested by the user. The law is not specific to any technology.</p>
<p>Fingerprinting generally accesses information on the user's device, and is therefore equivalent to setting a cookie with an ID: you're going to need consent. Generating a new random ID upon each pageload avoids this problem (GA will do this automatically if no existing ID is found). Additionally, a random ID that won't be reused likely isn't personal data in the sense of the GDPR, which simplifies compliance.</p>
<p>You do not need consent for setting/accessing cookies that are strictly necessary, e.g. for preferences. While GDPR requires that you are transparent about your processing activities, this doesn't necessarily require you to show a cookie banner. In my opinion, showing a cookie banner only for essential cookies would be confusing because there's no action the user can take. Where you see cookie banners that don't collect valid consent, this is typically either cargo cult compliance (imitating compliance without understanding actual requirements), or following pre-2018 rules on cookie consent which had a much laxer concept of “consent”. Of course, you should still explain your use of cookies and similar technologies in your privacy policy.</p>

privacy gdpr consent