EU Cookie Law can I use cookies before users&#39; consent? I am trying to get my website to be EU Cookie compliant and I have encountered some plugins which have something called "implied consent" in other words a popup appears on the website saying something like Cookies help us deliver our services. By using our services, you agree to our use of cookies. along with two buttons: "Read more" and "Got it". So my question is: Can I use cookies before the user has clicked on any of the buttons?
The ePrivacy directive (Article 5(3)) requires prior informed consent for storage (or access) of information stored on a user's terminal equipment. In other words - you must ask users if they agree to most cookies and similar technologies before the site starts to use them. That is not always technically possible or creates catastrophic UX, so take a close look at which cookies are exempt from consent according to the EU advisory body on data protection: Opinion 04/2012 on Cookie Consent Exemption (original, dead link) (user‑input cookies (session-id), authentication cookies, user‑centric security cookies, multimedia content player cookies, user‑interface customisation cookies, third‑party social plug‑in content‑sharing cookies etc.). Update 2019: Europe’s top court says active consent is needed for tracking cookies. There are few exemptions of cookies that generally do NOT require consent: User input cookies, for the duration of a session Authentication cookies, for the duration of a session User centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration Multimedia content player session cookies, such as flash player cookies, for the duration of a session Load balancing session cookies, for the duration of session. User interface customisation cookies, for a browser session or a few hours, unless additional information in a prominent location is provided (e.g. “uses cookies” written next to the customisation feature
GDPR Article 4 paragraph 1 says: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Recital 26 says Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. ... The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. Recital 30 says: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. An IP address hashed through a cryptographically secure one-way hash cannot reasonably be used to establish the original IP address, nor to geolocate, nor to directly identify the data subject. However if such addresses are stored in a database with a link to the subject's individual record, or to other data which identify the data subject, then they would clearly be personal information. The ICO's page on &quot;What is personal data&quot; says: ‘Online identifiers’ includes IP addresses and cookie identifiers which may be personal data. The page from GDPR.EU on &quot;Personal Data&quot; says: Any information that can lead to either the direct or indirect identification of an individual will likely be considered personal data under the GDPR. ... Any data that relate to an identifiable individual is personal data. The page on &quot;Personal Data&quot; from gdpr-info.eu says: Personal data are any information which are related to an identified or identifiable natural person. The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons. In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data. Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. This is also suggested in case law of the European Court of Justice ... See also &quot;Can a dynamic IP address constitute personal data?&quot; If a hashed IP address is stored so that it can be related to a specific individual, it is personal data. as such, it would be subject to the GDPR. To store it one would need to identify a lawful basis under GDPR Article 6 This could be the Data subject's consent, or the Controller's legitimate interest. In either case the information should be included in the list of personal information collected (often in a privacy policy document), disclosed to the subject on request, adn deleted on request if possible. If that is done, such a use of a hashed IP, although personal information, would seem to be compliant. If a hashed IP is stored in such a way that it cannot be related to any particular user, then it would not constitute personal information, and no compliance issue would seem to exist. Limiting the retention time of a hashed IP is a good practice which would reduce any possible impact it might have.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another support channel. (But Google offers infamously bad support.) In some cases, the service may legitimately decide that they cannot give you access to the data, for example if they believe that you are not the actual data subject (e.g. if they think that you hacked the account). The right to access must not adversely affect other people (Art 15(4)). If they have doubts about your identity, they can require further information to verify you (Art 12(6)). If your requests are excessive or unfounded (if you are spamming them), they can also turn down the requests (Art 12(5)).
Consent for cookies is not mandated by the GDPR, but by some member states' implementation of the ePrivacy directive. Specifically, cookie consent isn't required for processing personal data (which the GDPR is about), but for storing anything on the user's device unless this cookie is technically necessary (e.g. session cookies, preferences). This leads to a situation where you might not need consent for the analytics themselves, but still need consent for the cookies that are used to track a user for analytics. In practice, the cookie consent requirements are handled very differently. Some sites ignore this requirement, others show a notification banner that doesn't collect active consent like the GDPR would require. Yet other sites bundle cookie consent with other consent issues into a single consent management solution. Currently, the passive notification looks like a best practice in general. However, the actual privacy laws in your member state might have more specific requirements. With regards to consent for Google Analytics, note that the use of anonymizeIP does not directly affect whether you have to collect consent. The purpose of collecting site analytics might fall under your legitimate interest either way (consent is just one among many legal bases). But using the anonymizeIP feature conforms to the GDPR's data minimization principle. Some optional GA features (that share this data, or enrich it from other sources, or use it to target ads) might still require consent. The GA documentation doesn't always make this distinction clear.
The question says: But by hashing a IP address you process the personal information and that you can't do without the user's permission! But processing personal data (PI) is covered not by the e-Privacy Directive (ePD) but by the GDPR. Under the GDPR processing may be lawful if it is done under any of the six lawful bases specified by Article 6. Consent is one of these. But paragraph (f) permits processing when: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject ... This is generally known as the &quot;legitimate interest&quot; basis for processing. It normally requires a balancing against the privacy interests of the data subject. Where, as here, the processing is specifically to remove any traceability of the subject, and hence to protect the privacy of the subject, there doesn't seem to be much conflict, so I suspect such processing would be lawful. I have not found, after a brief search, an actual case where this has been tested, so my conclusion might be mistaken. Personal Data under the GDPR and hashing GDPR Quotes Article 4 of the GDPR defines &quot;Personal data&quot; (in paragraph (1) as follows: personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; The term &quot;pseudonymisation&quot; is defined in paragraph 5 of article 4 as follows: ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; GDPR recital 26 reads: The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Hashing If a cryptographically secure hash function is used to convert an identifier, such as an IP address, into a replacement hash, there is no practical way from the hash value alone to recover the identifier. However, if a particular identifier value is compared with a stored hash value, it is easy to tell if there is a match. Finding a match does not prove that the identifier is the same -- depending on the length of the hash value being used and of the identifier, there may be many values that would give the same hash. But the chance of two random IDs having matching hashes is very small. Thus, if a controller were to store hashed versions of the IP addresses, no one could convert that back to a list of visiting IP addresses. But if soemoen had the IP address of a suspected visitor, and access to the hash function, it would be easy to check if that IP was on the list. If a keyed hash function were used, only someone with access to the key could perform this check. It is not feasible to hash all possible IP addresses as there are over 4 billion possible IPv4 addresses, and over 10^38 IPv6 addresses (over one thousand decillion). Thus creating a table to reverse the hashing in general is not feasible. Whether the possibility of checking for a match makes a hashed IP &quot;reasonably identifiable&quot; as representing a specific natural person under the GDPR and related laws has not, as far as I know, been authoritatively decided. Note that at most it would reveal that a person using a certain internet connection had (probably) visited a particular site.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the security of processing I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is adequate to ensure security of processing as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord). As for Facebook Analytics, I think you've simply misunderstood their policy. Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information". AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways. What they actually say about PII in the context of Analytics is this: We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission. Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy. OK, moving on to cookie compliance. To you (the controller), both Google and Facebook are processors. Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data. So if I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV). As for Facebook, the fact that they promise not to share PII with third parties is irrelevant because they collect personal data. You will always need consent from your users to hand over their PII to Facebook in the first place. This is not optional. PS: If was a user, that consent would never been granted, no matter how great or valuable your site might be. If you have any sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.