I'm an academic researcher looking into GDPR compliance specifically concerning gambling websites. While analyzing these sites, I've noticed that Google Analytics tracking (`collect` requests) is often triggered as soon as the page loads, even before users interact with consent banners. These requests send data like the `cid`, page title, screen size, and browser language. My main questions are: 1) Does firing these `collect` requests before consent constitute a GDPR/ePrivacy violation? 2) Could operators claim 'legitimate interest' for tracking data in this way? 3) Does the fact that Google might not use this data for advertising change anything in terms of compliance? I want to ensure my findings for a peer-reviewed publication are precise regarding non-compliance claims.
4 Answers
According to GDPR, it's most likely a breach when you don't get consent before processing personal data. If the site doesn't meet any of the legal bases they have to satisfy (like fulfilling a contract or vital interests), then it's against the law. So, for Google Analytics, I don't see any valid reason they could use to justify the data collection without consent.
It really depends on various factors. You should look into how different jurisdictions interpret these rules. Plus, if you publish your work, make sure your sources are reliable—don’t just lean on opinion sites.
I’d say it’s almost certainly a breach of GDPR as it’s currently interpreted. But in practice, enforcement on these minor violations is kind of selective, so they might not go after you unless you're a big player.
I’m not a lawyer, but different authorities have varying opinions on this. Some might argue it’s okay based on how your Google Analytics is set up. Just be prepared for policy shifts as regulations can change—especially with the EU rules on data like we saw with the end of the 'privacy shield' in 2020.
Haha, 'organisms,' right? It's definitely a mixed bag out there!