gdpr
GDPR - first party analytics cookies
<p>Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow:</p>

<ol>
<li>Cookie is used to uniquely identify anonymous visitor (random visitor ID);</li>
<li>Cookie is persisted for the duration of the session;</li>
<li>Cookie can not (easily) directly be linked to a user (e.g. there is another technical session cookie that stores user ID for authentication purposes, but the two are issued by separate systems, and have no relation except that they are stored in the same browser);</li>
<li>Cookie is used to track and relate behavior of the visitor (pages visited, buttons clicked, general behavior stuff. etc.). The most sensitive information I can imagine stored using this identifier would be resolved Country/City, tops (no IP stored). The rest is just usage information related to the website.</li>
<li>Data stored with the identifier held by the cookie never leaves first-parties control, it is stored on servers controlled by the site owner.</li>
</ol>

<p>Clearly this all needs to be written down in privacy policy, but do I need explicit consent for such a cookie also?</p>

<p>In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.</p>

<p>The GDPR <em>only</em> require explicit (hard) consent if you use the cookie to store personal data.</p>

<p>Given the conditions you cite, the data you store is <em>not</em> personal data, so this cookie does not require consent.</p>

<blockquote>
  <p>In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial.</p>
</blockquote>

<p>You may have to do DPIA to demonstrate that this is non-trivial, or that you have mitigation in place to mitigate staff abusing such access. But provided things are as you say, the "analytics" cookie does not require consent.</p>

<p>Your question is partially answered in this other post: <a href="https://law.stackexchange.com/questions/29083/gdpr-compliance-do-all-cookies-require-opt-in">GDPR Compliance: Do all Cookies require Opt-In?</a></p>

<p>As mentioned there, <a href="http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf" rel="nofollow noreferrer">WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194</a> interprets the <strong>two criteria for Cookie Consent Exemption</strong>:</p>

<blockquote>
  <p>(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:</p>
  
  <p>CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic
  communications network”.</p>
  
  <p>CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the
  subscriber or user to provide the service”.</p>
</blockquote>

<p>It interprets these <strong>requirements</strong> deriving from Directive 2002/58/EC in relation to <strong>First party analytics in Section 4.3</strong>, as follows: </p>

<blockquote>
  <p>4.3 First party analytics</p>
  
  <p>Analytics  are  statistical  audience  measuring  tools  for 
  websites,  which  often  rely  on  cookies. These tools are notably
  used by website owners to estimate the number of unique visitors, to
  detect the most preeminent search engine keywords that lead to a
  webpage or to track down  website  navigation  issues.  Analytics 
  tools  available  today  use  a  number  of  different  data
  collection and  analysis  model s each of  which present different
  data protection risks. A first-party analytic system based on “first
  party” cookies clearly presents different risks compared to  a 
  third-party analytics system based on “third party” cookies. There are
  also tools which use “first party” cookies with the analysis performed
  by another party. This other party will be  considered as a joint
  controller or as a processor depending on whether it uses the data for
  its own purposes or if it is prohibited to do so through technical or
  contractual arrangements.</p>
  
  <p>While they are often considered as a “strictly necessary” tool for
  website operators, they are not   strictly   necessary   to   provide 
  a   functionality   explicitly   requested   by   the   user   (or 
  subscriber).  In  fact,  the user  can  access  all the
  functionalities  provided by  the website  when such cookies  are 
  disabled.  As  a  consequence,  <strong>these  cookies  do  not  fall  under</strong>
  <strong>the exemption  defined in CRITERION A or B</strong>.</p>
  
  <p><strong>However,  the  Working  Party  considers  that  first  party 
  analytics  cookies  are  not  likely to create a privacy risk when
  they are strictly limited to first party aggregated statistical
  purposes and  when  they  are  used  by  websites  that  already 
  provide  clear  information  about  these  cookies</strong>  in  their  privacy
  policy  as  well  as  adequate  privacy  safeguards.  Such  safeguards
  are expected  to  include  a  user  friendly  mechanism  to  opt-out 
  from  any  data  collection  and comprehensive  anonymization 
  mechanisms  that  are  applied  to  other  collected  identifiable
  information such as IP addresses.</p>
  
  <p>(...)</p>
</blockquote>

<p>Provided the data you collect is effectively aggregated, and that you do not keep the IP address or another way to directly or indirectly identify the user, it seems that you would meet the requirements of WP29 expressed in this Opinion for consent exemption.</p>
