The concept of “personal data” was set out in 2016 by the General Data Protection Regulation (GDPR).  

In Article 4.1, “personal data” is understood as “any information relating to an identified or identifiable natural person” (referred to as “data subject”); an “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity. 

According to these conditions, all analytical data coming from an “online identifier” (ID cookie, mobile…) must be considered as personal data. Consequently, its collection, processing and storage are subject to all the requirements of the GDPR.  

Compliance with the obligations of the GDPR is an essential prerequisite to benefit from the exemption from prior collection of consent in France, as indicated by the CNIL in paragraph 52 of its latest guidelines on cookies and other trackers.

This is why it is important to know how your audience measurement provider manages your analytics data. You also need to document your use of personal data, and clearly inform your end users about it. 

Want to learn more about the GDPR? Check out these definitions: 

Data Protection Officer: A data protection officer is a role within a company or organisation whose responsibility is to ensure that the company…

Data Protection Impact Assessment: A data protection impact assessment (DPIA) is a privacy-related impact assessment whose objective is to identify…

ePrivacy: The proposed Regulation on Privacy and Electronic Communications, also known as the ePrivacy regulation, is a proposal from the EU Commission…