When site analytics needs a separate consent
Contents
Share
Personal data in Article 3 of Federal Law 152-FZ is any information relating to a directly or indirectly identified or identifiable person. That person's consent is one ground for processing such data, not the only one. When you do rely on consent, it is drawn up separately from the other documents the person signs.
Article 3 does not list which visit fields already fall under that definition. A browser fingerprint as a technical method is covered in What a browser fingerprint is. Below are the statute's boundaries that change the consent text and the storage term, not a counter setting.
Who the operator is, and what counts as processing
The operator is the one who organizes or carries out the processing and defines its purposes and its composition. Processing is any action on the data, automated or not: collection, recording, storage, updating, use, transfer, anonymization, blocking, deletion, destruction.
Site analytics joins that list once it holds information about an identifiable person and you set the purposes and the composition. Article 3 does not split a "small counter" from a "large database". It splits on whether there is information about a person who can be identified directly or indirectly.
Purposes are set before collection
Article 5, in the wording ConsultantPlus ties to the amendment of 25 July 2011, No. 261-FZ, requires lawful and fair processing. Purposes must be specific, defined in advance and lawful. Processing incompatible with the purposes of collection is not allowed. Databases with incompatible purposes may not be merged.
Only data that answers the purposes is processed. Content and volume must not be excessive. The operator keeps data accurate and, where needed, up to date, and deletes or corrects incomplete and inaccurate data. Data may be stored in a form that identifies a person no longer than the purposes require, unless a statute or a contract sets the term. Once the purposes are met, or the need is gone, the data is destroyed or anonymized, unless the statute says otherwise.
For analytics that means: the purpose "see which campaign brought the order" is written down before collection, and the processing takes what answers that purpose. The period during which a person is still identifiable is tied to the same purpose, not to a habit of "let the logs sit".
Consent is not the only ground
Article 6 in the same wording lists cases where processing is allowed. Consent of the person is one of them. So is performance of a contract to which the person is a party or a beneficiary, or entering such a contract on the person's initiative. So is protection of life and health when consent cannot be obtained. So are the rights and legitimate interests of the operator or third parties, or socially important purposes, when the person's rights and freedoms are not violated. So are statistical and other research purposes, with mandatory anonymization, except for the purposes of Article 15.
The article's list is wider than these items: other grounds exist, including a statute and a court. The article does not pick which ground fits your collection. The operator's interest in that list is not permission to collect any technical data.
A contract with the person may not make the contract depend on the person's inaction, and may not limit the person's rights, unless the statute says otherwise. A checkbox that cannot be left empty, because otherwise the form will not submit, does not fit this rule unless a statute sets a separate requirement.
What consent must look like if you rely on it
Article 9 requires the person to give consent freely, by their own will and in their own interest. Consent must be specific, substantive, informed, conscious and unambiguous. It is drawn up separately from the other information and documents the person confirms or signs. Any form is acceptable if you can confirm that you received it and the statute does not require otherwise.
Consent can be withdrawn. Without it, the operator continues processing only on the other grounds of Article 6 and on the grounds the article names for special categories. The operator has to prove the consent or that other ground.
The rule does not describe a cookie banner, and it does not call a visit to the site consent. The sentence "by staying on the site you agree" does not follow from Article 9. If you rely on consent, you need a separate document or a separate action whose fact you can prove.
Biometrics is not a browser string
Article 11 calls biometric the information that characterizes a person's physiological and biological features, that can be used to establish their identity, and that the operator uses specifically to establish identity. Such processing is done with written consent, except for the cases part 2 lists separately: readmission, justice, mandatory fingerprint and genomic registration, and the branches of law the article names.
Outside those cases, providing biometrics cannot be made mandatory. Refusing service because someone refused biometrics or consent is not allowed, unless the statute requires consent. Browser technical traits, an address and a client string are not named in the article. The rule does not ask you to call them biometrics and demand written consent "because of Article 11".
What to write down before you turn a counter on
Whether the collection holds information about a person who can be identified directly or indirectly. If it does, Article 3 calls it personal data, even though the article does not list visit fields.
The purpose is written in advance, the composition is no wider than the purpose, and databases with incompatible purposes are not merged.
You choose the ground: consent, or another ground from Article 6. The article does not assign the ground for you.
If the ground is consent, it is separate, and you can prove it. The article does not call a visit to the site consent.
Storage in an identifiable form is no longer than the purpose, unless a statute or a contract set another term.
Browser traits, an address and a client string are not named in Article 11. Written biometric consent for them does not follow from that article.