european-union gdpr website
GDPR: what can I record about website visitors?
<p>My use case is very simple. I have a website, on which I have articles that I wrote. It behooves me to learn about the people who visit my site so that I know what articles are popular and why, mainly. I want to record the following:</p>

<ol>
<li>time/date of visit</li>
<li>what browser they used, and what OS</li>
<li>what their ISP is (or other type of host), which seems hard to determine so usually I don't have this info.</li>
<li>what webpage they visited.</li>
</ol>

<p>Noticed I do not record:</p>

<ul>
<li>IP address </li>
<li>GPS coordinates (no drone strike possible)</li>
<li>any username or password</li>
<li>the person's name, because I don't know it</li>
</ul>

<p>And there are no cookies.</p>

<p>Does the GDPR allow this limited recording?</p>

<p>Feel free to record what you are about to, and even feel free to add IP addresses and GPS coordinates without even letting visitors know. You have these 2 defenses:</p>

<ol>
<li>You are not offering goods or services to your visitors (like if
you were charging subscription fees to access your articles),
therefore your site falls under <a href="https://gdpr-info.eu/recitals/no-18/" rel="nofollow noreferrer">Recital 18 — Not applicable to
personal or household activities</a>;</li>
<li>You are not able to identify the real persons behind the data you record at reasonable time and costs, therefore it is not personal data (<a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Recital 26 — Not applicable to anonymous data</a>).</li>
</ol>

<p>Feel free to record the personal data you mention (in general the GDPR does limit your ability to record personal data - the GDPR only tell you what you must do <em>if</em> you collect personal data.  I.e. you don't <em>need</em> any "defenses" in order to legally do this.</p>

<p>However, I do not think you are <em>exempt</em> from the GDPR if you collect the personal data you list about the people who visit your website.</p>

<p>Whether a personal website is covered by "personal use exemption" or whether a IP-address is personal data is currently contested in answers to other questions on Law stack exchange. See, for instance <a href="https://law.stackexchange.com/q/28668/957">Are server-logs reckoned as storing of personal data by website?</a>.</p>

<p>I think you should read the linked, and related, Q&amp;As, and the make up your own mind about whether you have to comply with the GDPR if you record this personal data.</p>
