That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.
More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
What should matter is what’s logged. Every request contains an IP that’s how the web works.
https://ec.europa.eu/justice/article-29/documentation/opinio...
The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”.
Interesting. Maybe there is a possibility in the future.
https://digital-strategy.ec.europa.eu/en/library/proposal-re...
https://edpb.europa.eu/sites/default/files/files/file1/edpb_...
... because users absolutely love clicking through those annoying opt-in compliance boxes. So the admin now has the choice of no longer having that data or damaging UX.
The law seems pretty clearly bent on just not letting web admins collect that bedrock baby's-first-metric anymore for European users.
In the cookie case, you can detect a returning visitor by the presence of the cookie, you do not need to assign an unique identifier.
In the hashing case, the hash of the IP and UA counts as PII, at least for the 24 hours while you still have the salt.
NB: this is completely irrelevant except as a mathematical curiosity, because GDPR prohibits any processing of PII (in this case - the fingerprint), not just storing it anywhere, without a legal basis.
Hmm, but using PII in anonymized form is allowed, right? But how do you anonymize PII without processing it?
I use Plausible, which works by hashing IP addresses. Honestly, I disagree with the analysis as given: the claim is that we're assigning a unique ID to each user, but it's really not doing that -- the ID changes, and more than one user may have the same ID.
GDPR is a balancing act, between the rights of the people involved and the desires of data controllers to have useful data. In practice, Plausible presents (at least to my mind) a solution to my legitimate interests with a privacy impact that's suitably minimal for the level of interest I have in the statistics I collect. A cookie is arguably less privacy-preserving, as it has better specificity.