[Neikius]

you CAN use analytics! Just need to use first party analytics... it is not so hard to set up, there are many opensource self-hosted options.

I hate how everyone and their mother ships all my data to google and others just because they can.

[crazygringo]

Let's not deceive ourselves -- first-party analytics are much, much harder to set up, and a lot less people are trained on other analytics platforms.

They're also inherently less trustworthy when it comes to valuations and due diligence, since you could falsify historical data yourself, which you can't do with Google.

[joelanman]

The regulation is only concerned with cookies that are not required to provide the service. It makes no differentiation between first party and third party - if you use cookies for anything optional (like analytics) you need consent. So you can have third party non-cookie analytics for example without a banner.

[inkysigma]

Do you know an analytics service that actually does this? I've seen a bunch of "consentless" analytics solutions that seem to be violating GDPR one way or another because they use the IP address as an identifier (or as part of one).

[inkysigma]

Can you actually do meaningful analytics without the banner at all? You need to identify the endpoint to deduplicate web page interactions and this isn't covered under essential use afaik. I think this means you need consent though I don't know if this covered under GDPR or ePrivacy or one of the other myriad of regulations on this.

[mortarion]

So take the IP, browser agent, your domain name and some other browser identifiers, stick them together and run them through SHA3-256, now you have a hash you can use for deduplication. You can even send this hash to a 3rd party service.

Or assign the user an anonymous session cookie that lasts an hour but contains nothing but a random GUID.

Or simply pipe your log output through a service that computes stats of accessed endpoints.

None of this requires a cookie banner.

[rusk]

> You need to identify the endpoint to deduplicate web page

You can deduplicate but you cannot store or transmit this identity information. The derived stats are fine as long as it’s aggregated in such a way that preserves anonymity