5 ms·

It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to soli

It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information. Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.

sigwinch28 6y ago
I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.
- ThePhysicist 6y ago
  I think OPs question was if you can really collect "anonymous" analytics data from a client device without asking for consent, which you cannot really answer based on the GDPR alone. Yes, anonymous data is exempt from the GDPR, but the question is just if a HTTP request to a tracking service that contains the IP address and user agent of a persons' browser can be considered anonymous already (in most cases not). Some companies like Matomo (and Fathom, Simple Analytics, Plausible, ...) argue that you can collect tracking data without consent if you offer an opt-out to the user, I haven't been able to find a legal basis for this though. Even Microsoft asks you for consent before enabling their anonymous telemtry collection in Windows now.
  - sigwinch28 6y ago
    Yes, I think opt-out is specifically forbidden when consent is used as a legal basis, at least under the GDPR...

sigwinch28 6y ago

I feel like you've moved the goalposts on me since the parent was referring to GDPR, and so was I, and now you've brought up the ePrivacy stuff. Furthermore, it only counts as processing under the GDPR if anonymisation was performed as a step on some data already covered on the GDPR. Ergo, if the data originally collected qualifies as anonymous data, then processing it is not covered by the GDPR.

ThePhysicist 6y ago
I think OPs question was if you can really collect "anonymous" analytics data from a client device without asking for consent, which you cannot really answer based on the GDPR alone. Yes, anonymous data is exempt from the GDPR, but the question is just if a HTTP request to a tracking service that contains the IP address and user agent of a persons' browser can be considered anonymous already (in most cases not). Some companies like Matomo (and Fathom, Simple Analytics, Plausible, ...) argue that you can collect tracking data without consent if you offer an opt-out to the user, I haven't been able to find a legal basis for this though. Even Microsoft asks you for consent before enabling their anonymous telemtry collection in Windows now.
- sigwinch28 6y ago
  Yes, I think opt-out is specifically forbidden when consent is used as a legal basis, at least under the GDPR...