search

usefathom / fathom

Fathom Lite. Simple, privacy-focused website analytics. Built with Golang & Preact.
https://usefathom.com/
MIT License
7.55k stars 368 forks source link

Is a self-hosted version of fathom GDPR compliant and do I need a consent form for users? #313

Closed Micromegass closed 4 years ago

Micromegass commented 4 years ago

I am planning to use a self hosted fathom instance. My server will run in Germany and I am having some doubts about Fathom's use of cookies and tracking policies. For my company it is very important that we can offer our customers a clean website on which they do not need to agree or disagree with any cookie consent policies. On fathom's website (https://dev.to/hmhrex/a-comparison-of-the-top-3-privacy-focused-analytics-platforms-209m), it is written that fathom does not use cookies of any kind.

I know that they don't for the paid product, but how is this for the open source code?

From what I can read from this discussion on github: https://github.com/usefathom/fathom/issues/40, Fathom does indeed use a tracker cookie. Granted, only for 30 minutes, but it's still a cookie. So I am not sure anymore if I need a cookie policy to be completely GDPR compliant. So, my question is, if there is a way to use a self hosted Fathom instance, compliant with GDPR norms, and not have a cookie consent policy for the user.

I would be very grateful for any clarification provided. Thank you very much in advance!

JackEllis commented 4 years ago

GDPR != not using cookies.

We believe that Fathom Lite is GDPR compliant but it isn't PECR Compliant (UK regulation) since it uses cookies.

Micromegass commented 4 years ago

Thank you for the clarification!