GDPR - Default Opt-Out

·GDPR - Default Opt-Out

·Hi!

·I yesterday came across your product and I am already in love with it (as well as the company). Really great job all of you are doing!

·I do have a question (well, actually it is a ton of questions 😂) related to GDPR. I am trying to understand, how I can legally implement Web Analytics (for the website). Product Analytics will follow later on.

·From my readings so far related to GDPR, a user by design must be "opt outed" (if that is the correct term in English). When reading your above suggestions, one solution is to call posthog.opt_out_capturing(). But this would imply, that before calling opt_out_capturing, data capturing is happening. This would not be compliant with GDPR.

·Then my next question is, if a user does not accept consent (and cookies) I would need to switch everything to anonymous and usage of different approach than local storage / cookies (e.g. query params with anonymous session id, or other memory based approach). So at least I could track interactions with the side on an anonymous base (no IP, no browser fingerprint, no location, ...).

·How would I tackle such an approach in a Next.js application? Thanks for your help, Thierry

·Originally posted on posthog.com/docs/privacy/gdpr-compliance

·Thierry3Author2 years agoSolutionWell, one should read the whole page 🤦. https://posthog.com/tutorials/react-cookie-banner solves my question. Sorry!

·Well, one should read the whole page 🤦. https://posthog.com/tutorials/react-cookie-banner solves my question. Sorry!

·PostHog AI2 years agoFor GDPR compliance with PostHog, there are several key requirements: Consent Requirements Implementation Options PostHog offers two main approaches for GDPR compliance: For Initial Setup If you're not using cookies, you should: For more detailed implementation guidance, I recommend checking out the tutorial you found on building a React cookie banner and the cookieless tracking documentation.

·For GDPR compliance with PostHog, there are several key requirements: Consent Requirements

·You must acquire "unambiguous consent" that is "freely given, specific, informed and unambiguous" (1)

·Consent requests must be "clearly distinguishable from other matters" and presented in "clear and plain language" (1)

·Users can withdraw consent at any time (1)

·Implementation Options PostHog offers two main approaches for GDPR compliance:

1Cookieless Tracking:

·PostHog can be configured not to use cookies (2)

·Data is stored in a JavaScript object in memory that only lasts the duration of the pageview (2)

1EU Data Hosting:

·PostHog Cloud EU, hosted in Frankfurt, Germany, ensures data stays within EU jurisdiction (2)

·This is recommended as the best option for most users requiring GDPR compliance (2)

·For Initial Setup If you're not using cookies, you should:

·Do not load the PostHog SDK until consent is given (1)

·Or do not initialize the PostHog SDK via the call to init until consent is given (1)

·Ensure your application logic always performs conditional checks regarding the initialization state of the PostHog SDK (1)

·For more detailed implementation guidance, I recommend checking out the tutorial you found on building a React cookie banner and the cookieless tracking documentation.