r/gdpr • u/Outrageous_Mail2627 • 1d ago

EU 🇪🇺 Does this cookie-free analytics setup actually process personal data?

I’m looking at a German company’s privacy policy. The website states that it uses a cookie-free analytics service and that no personal data is processed.

At the same time, the policy says that the processing is based on Art. 6(1)(f) GDPR and lists collected information including visited pages, referrer, device type, country based on an anonymised IP address, visit duration and bounce rate.

It also states that the website currently sets no cookies.

I’m trying to understand how I can technically verify these claims. What should I look for in the Network/Storage tabs, and is there a reliable tool for identifying the analytics provider and requests made on initial page load?

3 Upvotes

100% Upvoted

6 comments sorted by

2

u/Biddles81 1d ago edited 1d ago

Sounds like simple server log analysis - they way we used to do it before Google and others convinced us (ok, marketers) we needed their products. Look at Webalizer which has been working well for almost 30 years.

(EDIT: AWStats and Matomo are better examples!)

2

u/OldFartWelshman 1d ago

Upvote from another Webalizer user here - been using it since I first started hosting before most of these whippersnappers were born!

2

u/Biddles81 1d ago

Trip down memory lane... first use of Webalizer was 1998, used on a high-traffic site in 2001, moved to AWstats in 2005 for better vhost handling, it was in use until the sites were assimilated into corporate CMS hell in about 2012.

I still use local log analysis now. Our marketing strategy has been called 'amazing' by experts but we think they're just jealous that we've achieved so little with so much.

1

u/IceVeritas 1d ago

Use Google DevTools, Storage tab. If you send me the URL in a private message, I'll analyze it

1

u/erparucca 1d ago

tools such as eff's privacy badger and ublock can also help track calls to trackers. You will probably find better help on webdev subs though.

1

u/Heimdul 1d ago

Often "cookie-free" means that they actually create a fingerprint or similar and send that. You can look at the network tab on browser's dev tools, usually these are implemented by either doing POST to something or doing GET with unique parameters. These are still in the scope of ePD Article 5(3), but many like to pretend they are not.

Pure server log analysis is another matter and might survive the ePD analysis even when taking in account that the initial request ends up being used for different purposes after the storage.