internet privacy european-union gdpr
Can I count unique users without a cookie warning?
<p>Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning?</p>

<p>The usual way to track unique users is to set a cookie. An alternative (less accurate) way is to store browser fingerprints server-side. These could be e.g. a hash of IP + UserAgent, or <a href="https://panopticlick.eff.org/" rel="nofollow noreferrer">something more advanced</a>.</p>

<p>Does the cookie law allow fingerprinting? More generally, does it allow any server-side analytics that don't store anything in the browser?</p>

<p>Bonus question: will GDPR change things?</p>

<p>GDPR is now in effect. A unique cookie used to count users is not a so-called "technical cookie", so you might think that a cookie bar is needed. However, I think that if you <strong>only</strong> use it (or other similar methods) to simply count the total users, then it might be considered a "legitimate interest" by GDPR and so you might be able to do it without the user's explicit consent.</p>

<p>Quoted from ico.org.uk, when legitimate interests might be appropriate:</p>

<blockquote>
  <ul>
  <li>the processing is not required by law but is of a clear benefit to you or others;</li>
  <li>there’s a limited privacy impact on the individual;</li>
  <li>the individual should reasonably expect you to use their data in that way; and</li>
  <li>you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.</li>
  </ul>
</blockquote>

<p>You should probably mention this in your privacy policy though, saying that you use such a cookie only for such a purpose, for legitimate interests such as counting the total number of visitors. It is definitely your legitimate interest to be able to know some anonymized data that can help you manage and optimize your services.</p>
