privacy gdpr website
If we anonymize Google Analytics IPs do we still need to ask for Cookie consent?
<p>Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent.  If we turn on <a href="https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization" rel="nofollow noreferrer">IP Anonymization</a> do we still need to ask for consent?</p>

<p>If so is there any way to use Google Analytics without having to ask for consent?</p>

<p>Consent for cookies is not mandated by the GDPR, but by some member states' implementation of the ePrivacy directive. Specifically, cookie consent</p>

<ul>
<li>isn't required for <em>processing personal data</em> (which the GDPR is about),</li>
<li>but for <em>storing</em> anything <em>on the user's device</em> unless this cookie is technically necessary (e.g. session cookies, preferences).</li>
</ul>

<p>This leads to a situation where you might not need consent for the analytics themselves, but still need consent for the cookies that are used to track a user for analytics.</p>

<p>In practice, the cookie consent requirements are handled very differently. Some sites ignore this requirement, others show a notification banner that doesn't collect active consent like the GDPR would require. Yet other sites bundle cookie consent with other consent issues into a single consent management solution. </p>

<p>Currently, the passive notification looks like a best practice in general. However, the actual privacy laws in your member state might have more specific requirements.</p>

<p>With regards to consent for Google Analytics, note that the use of anonymizeIP does not directly affect whether you have to collect consent.</p>

<ul>
<li>The purpose of collecting site analytics might fall under your <em>legitimate interest</em> either way (consent is just one among many legal bases).</li>
<li>But using the anonymizeIP feature conforms to the GDPR's <em>data minimization principle</em>.</li>
<li>Some optional GA features (that share this data, or enrich it from other sources, or use it to target ads) might still require consent.</li>
</ul>

<p>The GA documentation doesn't always make this distinction clear.</p>

<p>Cookies are 3rd party pieces of software that may gather Data that you are unaware of, so disabling the IP addresses on your end side, does not mean Privacy Assurance.
You need to have a proper Cookies Policy, the ones which are "mandatory" as a Service Enabler need to be explained as such and all must have a manufacturer description of "purpose" and "scope, while enabling Data Subject to opt-out from all.
The ones that are mandatory further should have a disclaimer stating that if opted-out the service may not be possible to deliver.
Then, although in many cases it is of no avail, you need to have documented proof that you tried to get a DAta PRocessing Agreement with those manufacturers, for the will act as "processors" via their Cookies and you never know if they will gather and/ or share Data with unauthorized 3rd parties.
And... yes, I know, many are not doing this... yet they need to.</p>
