gdpr cookies
Is the creation of a cookie with a anonymous id a violation of GDPR even if it&#39;s not used until consent?
<p>We run a website with a global user base and need to respect GDPR compliance for those visitors that the law applies too. Since we are on Shopify we are currently making a front-end request to check the visitors GDPR profile and if they are in a non-applicable area, we then load tracking (GA, Optimizely, Heap, etc.).</p>
<p>Unfortunately since Shopify only allows client-side manipulation, the call to check visitor GDPR requirements severely delays the JavaScript we need to run A/B testing without massive flicker.</p>
<p>To avoid this with other clients we have loaded Optimizely upon landing, which creates the anon cookie, however, we configure this to hold all tracking/events until consent can be given.  If it is not given the cookie is deleted and Optimizely is unloaded. Does this approach comply with GDPR?</p>
<p>Note: Optimizely does not track any PII or full IP addresses.</p>

<p>The cookie consent requirement comes from the ePrivacy Directive, not from the GDPR. While the GDPR defines consent, cookie consent is required regardless of whether the cookie actually contains personal data. Instead, it says we can access information stored on an end users device under the following circumstances.</p>
<ul>
<li>Technical access to the information is used for the sole purpose of performing a transmission over a network, e.g. using a browser cache.</li>
<li>Accessing the information is strictly necessary for providing a service explicitly requested by the user, e.g. session cookies or a consent-declined cookie.</li>
<li>The user has given consent to the access, where consent is defined by the GDPR (freely given, informed, specific, …).</li>
</ul>
<p>The first scenario likely doesn't apply because your cookies aren't likely to be “technical storage or access” in the sense of ePrivacy, and because the tracking cookies wouldn't be used for the sole purpose of carrying out a transmission.</p>
<p>The second scenario doesn't apply because tracking cookies are not strictly necessary to interact with the webshop, as evidenced by the possibility to opt out. The service explicitly requested by the user is the webshop or website, not the A/B testing.</p>
<p>This only leaves consent as possible grounds for storing or accessing information on the user's device. It is already the storing or access that is covered by ePrivacy, not only later use as a persistent identifier.</p>
<p>Your suggestion – to first set the cookie and then delete it if it shouldn't have been set – is more compliant than many set-ups I've seen, but is still technically non-compliant. It is also likely to fail in practice under non-ideal network conditions: if the request to see whether GDPR applies times out, or if the user closes the browser tab before the cookie will be deleted, the tracking cookie will remain without consent.</p>
<p>I would instead suggest to consider the following points.</p>
<ul>
<li>It seems that by itself, Optimizely Web <em>cannot</em> be used in a compliant manner since it doesn't provide sufficient control over how cookies are managed.</li>
<li>Thus, you should avoid loading such tracking scripts unless consent has been given, or unless this processing falls outside of EU/UK law.</li>
<li>Currently, you defer loading of tracking scripts until you know if you have to ask for consent.</li>
<li>This can be avoided if you <em>always</em> ask for consent :)</li>
<li>This can also be avoided if you load the tracking scripts from a server that can independently determine whether the requests comes from the EU. For non-EU requests and for users with opt-in, the server can return the original tracking scripts. Otherwise, the server returns a dummy script. This server can be independent from your website's hosting. By combining the jurisdiction decision with the loading of the script, one roundtrip is saved and latency is reduced.</li>
</ul>
<p>Finally, no one is forcing you to use Shopify, and ePrivacy/GDPR is not required to accommodate their limitations. You do have different choices:</p>
<ul>
<li>use Shopify, at the cost of slow pages and limited A/B tests</li>
<li>use a different A/B test provider that can be used without setting cookies</li>
<li>use edge computing to do stuff in between of the browser and the original server</li>
<li>use a different webshop platform</li>
<li>ignore EU laws</li>
</ul>
<p>Well, one of them is clearly unethical. But you do have choices, and which choice you take is a <em>business decision</em>. Slow pageloads and consent banners are likely costing you conversions, but Shopify might be providing massive value that outweighs all that.</p>
