When you use Consent Manager and ask visitors for consent to data collection and usage, some of them won’t agree. So can you collect any data from these visitors? It depends on privacy laws and how your legal team interprets them.
In Piwik PRO, you can choose to collect some data from these visitors or don’t collect any of their data.
To set data collection for visitors who don’t consent, follow these steps:
- Go to Menu > Administration.
- Navigate to Websites & apps.
- On the left, pick a website or app you want to work with.
- In Settings, scroll until you see Privacy.
- Ask visitors for consent needs to be turned on because only then you’re showing a consent form on your site.
- In When visitors don’t consent, you can pick one option:
- Collect data using a 30-minute cookie: You’ll use a 30-minute cookie to collect session data. You won’t recognize new and returning visitors. Visitors’ IP addresses will be fully masked.
- Collect data without using cookies (beta): You won’t create or store any cookies on visitors’ browsers. Nothing will be stored on visitors` devices. You won’t recognize new and returning visitors. Visitors’ IP addresses won’t be masked, but you can mask them under Administration > Platform > Privacy settings.
Note: Some triggers in Tag Manager create cookies to work correctly. If you use one of the following conditions in triggers, we’ll set a cookie:
- Event condition > Traffic source
- Event condition > Returning visitor
- Event condition > Campaign
- Event condition > External referrer
- Multiplicity > Fire tag once per session
- Multiplicity > Fire tag multiple times per session, excluding first
- Multiplicity > Fire tag once per page view
Make sure that tags with those triggers are set with the right consent type.
We also set essential cookies that store visitor’s consent decision. More about cookies
- Don’t collect data: The tracking code won’t be fired for visitors.
- Click Save.
Here is a comparison that can help you decide which option to choose. Each setting uses different mechanisms for collecting data, recognizing visitors and their sessions. It also affects what data you will collect.
|When visitors agree||When visitors don’t agree|
|Cookies & device fingerprint||30-minute cookie||No cookies||Don’t collect data|
|Mechanisms used to collect data|
|Visitor’s IP address||Yes / No (4)||Yes / No (4)|
|Capture all traffic|
|New vs. returning visitors|
|Visitor’s location||Country, city||Country||Country, city|
|Channel attribution||Last-click, position-based, first-click, last-non-direct-click, time-decay, linear and custom models||Last-click||Last-click|
|Compliant with||LGDP, PDPA, GDPR, UK GDPR/ PECR||LGDP, PDPA, GDPR (6)||LGDP, PDPA, GDPR (6)||LGDP, PDPA, GDPR, UK GDPR/PECR, CCPA|
- You’ll use a 30-minute cookie to collect session data.
- We’ll set essential cookies that store visitor’s consent decision. Also some triggers in Tag Manager set cookies to work correctly. Make sure that tags with those triggers are set with the right consent type.
- We create a device fingerprint to recognize the visitor’s session. We use it only for 30 minutes.
- You can mask IP addresses for visitors under Administration > Platform > Privacy settings. The IP address informs about visitor’s location. Masking it can enhance visitors privacy because you won’t recognize their full location.
- You won’t collect any consent stats about people who don’t consent to analytics.