4 ms·

The answer is: it depends. The GDPR allows for collection and processing without consent for several reasons including (but not limited to) legal requirement (

The answer is: it depends. The GDPR allows for collection and processing without consent for several reasons including (but not limited to) legal requirement (e.g. anti-fraud) and legitimate interests (e.g. app install conversions). The GDPR is also quite clear that consent is not required to collect _anonymous_ data, i.e. data which in no way can be traced back to the individual, but this requires balancing with the other principles of the regulation. Recital 26 of the GDPR states: “…The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”

ThePhysicist 6y ago
It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information. Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.
- sigwinch28 6y ago
  I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.
  - ThePhysicist 6y ago
    I think OPs question was if you can really collect "anonymous" analytics data from a client device without asking for consent, which you cannot really answer based on the GDPR alone. Yes, anonymous data is exempt from the GDPR, but the question is just if a HTTP request to a tracking service that contains the IP address and user agent of a persons' browser can be considered anonymous already (in most cases not). Some companies like Matomo (and Fathom, Simple Analytics, Plausible, ...) argue that you can collect tracking data without consent if you offer an opt-out to the user, I haven't been able to find a legal basis for this though. Even Microsoft asks you for consent before enabling their anonymous telemtry collection in Windows now.
    - sigwinch28 6y ago
      Yes, I think opt-out is specifically forbidden when consent is used as a legal basis, at least under the GDPR...

ThePhysicist 6y ago

It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information. Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.

sigwinch28 6y ago
I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.
- ThePhysicist 6y ago
  I think OPs question was if you can really collect "anonymous" analytics data from a client device without asking for consent, which you cannot really answer based on the GDPR alone. Yes, anonymous data is exempt from the GDPR, but the question is just if a HTTP request to a tracking service that contains the IP address and user agent of a persons' browser can be considered anonymous already (in most cases not). Some companies like Matomo (and Fathom, Simple Analytics, Plausible, ...) argue that you can collect tracking data without consent if you offer an opt-out to the user, I haven't been able to find a legal basis for this though. Even Microsoft asks you for consent before enabling their anonymous telemtry collection in Windows now.
  - sigwinch28 6y ago
    Yes, I think opt-out is specifically forbidden when consent is used as a legal basis, at least under the GDPR...