gdpr consent
google analytics cookie consent with anonymized ip on
<p>I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time. </p>

<p>BUT, on top of that, according to GDPR I would need to collect and store records that cookie consent from a particular user was obtained. </p>

<p>Well, lets say "user A" has agreed for my website to use cookies and later on "Mr XXX" who is actually "user A" is trying to be funny and he has emailed me saying he will complain to ICO as he can see these cookies are set but he has not provided a consent.</p>

<p>Because the IP is anonymized, I could not prove that the guy emailing me has actually provided consent as "user A" and "Mr XXX" are not associated on my records, whilst they are the same person.</p>

<p>Any ideas how to solve this puzzle?</p>

<p>Simply use a cookie to store consent.</p>

<p>First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie.</p>

<p>You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website.</p>

<p>Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate <a href="https://gdpr-info.eu/art-11-gdpr/" rel="nofollow noreferrer">Art. 11(1) GDPR</a>:</p>

<blockquote>
  <ol>
  <li>If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.</li>
  </ol>
</blockquote>

<p>Notice it is possible to configure google analytics in a way so you don't need any consent. See <a href="https://law.stackexchange.com/a/30638/18215">my answer to this question</a>. Just IP anonymization is not sufficient.</p>
