united-kingdom privacy gdpr european-union consent
Is a cookie notice required for analytics?
<blockquote>
<p><strong>Note:</strong> I've been directed here <a href="https://meta.stackexchange.com/q/355493/380081">from Meta.SE</a></p>
</blockquote>
<p>I'm using <a href="https://gosquared.com" rel="nofollow noreferrer">GoSquared</a> for my website analytics.</p>
<p>I've visited quite a few sites using Google Analytics but they don't have a cookie policy or a cookie banner/cookie notice, even though Google Analytics uses cookies to provide their services.</p>
<p>Do I need to make my own cookie policy or cookie notice if I use GoSquared Analytics (which also uses cookies to function)?</p>
<p>Note that these are non-essential cookies provided by a third party.</p>
<p>And does the fact that I am in the UK change anything?</p>

<p>Most likely yes if you are subject to UK or EU laws:</p>
<ul>
<li>The EU ePrivacy directive and implementing laws such as PECR in the UK require that you obtain consent before accessing information on a user's device, <em>unless</em> that access is strictly necessary to perform a service requested by the user.</li>
<li>Cookies and similar technologies such as LocalStorage are stored on the user's device.</li>
<li>Analytics are not strictly necessary to display a website.</li>
</ul>
<p>Thus, you need to obtain valid consent before setting any analytics cookies.</p>
<p>GDPR and ePrivacy/PECR have some interactions:</p>
<ul>
<li><p>Even though the cookies might technically be set by GoSquared, you as the website operator are responsible for compliance. You are the data controller, the third party analytics are usually a data processor who only process data on your behalf. You must ensure that the data processor is compliant. Even if they were a joint controller you'd be responsible for what happens on the website (relevant precedent is the Fashion ID case).</p>
</li>
<li><p>While ePrivacy originally had a fairly weak concept of consent (e.g. “by continuing to use this site, you consent …”). However, the GDPR updated the definition of consent, so that valid consent must be freely given, informed, actively given, and specific. If you set cookies for different purposes in addition to analytics, users should be able to give or withhold consent for analytics independently from other purposes. Since consent must be actively given, consent is never the default, e.g. pre-ticked checkboxes are not compliant (relevant precedent is the Planet49 case).</p>
</li>
<li><p>Like Google, GoSquared stores data in the US. You are causing personal data to be transferred into the US, which is an international transfer. Before it was invalidated earlier in 2020, such transfers were easy to do under the Privacy Shield adequacy decision. Now, such transfers are only legal if you sign SCCs with your data processor, and your risk assessment indicates that your user's data is sufficiently safe there, despite your processors potentially being legally unable to comply with the SCCs. Fortunately for you the UK's ICO has taken a more industry-friendly stance on this matter than other countrie's data protection agencies.</p>
</li>
</ul>
<p>Why do so many websites use Google Analytics (GA) without requesting proper consent? A variety of potential reasons:</p>
<ul>
<li>They are actually non-compliant.
<ul>
<li>After all, GA is not GDPR-compliant in default settings, and Google doesn't do a good job of providing essential information.</li>
<li>Many data protection agencies have indicated that cookie consent enforcement is not their focus.</li>
</ul>
</li>
<li>GA can be used <a href="https://developers.google.com/analytics/devguides/collection/analyticsjs/cookies-user-id#disabling_cookies" rel="noreferrer">without using cookies/LocalStorage/…</a>, and thus without requiring consent under ePrivacy or PECR.</li>
<li>The websites might not be subject to EU or UK laws such as ePrivacy.</li>
</ul>
