data collection without consent for web analytics

[itsMeTechy]

is it a possible option to collect data for the purpose of web analytics like "average time spent on page" even without user consent. we can consider collecting data without an ability to track back to the user. for ex: instead of collecting ECID as an identity, we can consider some other random identity and so this identity wont have an ability to track back to the user. 

reason asking this question because significant amount of user browsing is without consent, which means we also lose the ability to run visitor and page level metrics.

Thanks

[bjoern__koth · Accepted solution]

Hi @itsMeTechy 

it depends, with the classic AppMeasurement library, you can set the cookieLifeTime to "session" which essentially places a non-persistent cookie that is removed when the session ends and per se (double-check with legal) may be legal according to GDPR.

In my opinion, a cookie is a cookie, and it does not matter how long it is persisted. But some argue that if it is only accessible during the same session, a cookie consent is not needed. So you better want to talk to your legal department to get their take on this.

This feature, however, is no longer possible with Web SDK where a cookie is persisted for longer than the session duration.

But (or rather BUT), and this is my personal opinion, I would not try to track the user until consent is given. Yes, you won't be able to track the user, but to me it always feels dodgy if a website is asking me whether they may track me and at the same time I see all kinds of tracking pixels fired in Omnibug.

I typically urge my clients to respect the users and accept analytics data as what it is: trends on the website and not exact numbers which can be affected by ad blockers, browsers, etc. If you want absolute page views, look into server logs.

@Jennifer_Dungan your two cents on this?

[JohnMa9]

With a previous analytics tool, we were able to track the visit but pass no personalized information by anonymizing the visitor information.  We ran into an issue with Adobe in that in the raw data, the MCID remains consistent.  Additionally, when a customer arrives through marketing and is prompted to opt-in, we would lose the marketing credit for the landing, which makes sense, but the "business" did not understand why because they could see the customer in the raw data using the MCID.  While our implementer told us that the MCID could be anonymized, it seems it cannot be