[gchambert]

What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent.

What he is doing is illegal.

[zepolen]

Doesn't that make access log files illegal?

[simpss]

log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.

[Dayshine]

The key caveat here is:

Unless it's necessary. The legitimate interests basis of the GDPR allows you to make a balanced decision of your business requirements against user privacy expectations.

[simpss]

yes, and you have to line out how the processing is necessary for providing the service, there has to be no less-intrusive method of achieving the desired result and be ready to prove it.

hint, user-level analytics rarely is. And in this specific example, repurposing logs kept for one purpose(ex, security/auditing) to user analytics is definitely not something you can just do

[GordonS]

An example that's explicitly called out as allowed is using logs for security purposes.

[PeterisP]

The main conceptual issue is that it's about the purpose of use rather than the technical implementation. Access log files used for debugging purposes only is one thing; but if the exact same access log gets forwarded to a data mart that later gets used for mining marketing analytics, that's a completely different issue.

[kuschku]

If they contain IPs, and are stored for >30 days, they're automatically illegal, yes.

Below 30 days it's a grey area as long as you only store as much information as is technically necessary (so e.g. for 14 days IP addresses could be okay, ask your lawyer about specifics), but you definitely need to inform your users about this.

[gchambert]

Processing PII doesn't need consent if it's necessary to provide the service. Keeping logs fits in this category: to run a website, you need the ability to debug problems, analyze frauds and attacks. Moreover, you have the responsibility to protect your users, hence be able to analyze attacks, and block malicious IP addresses. And lots of countries have laws that make it mandatory to keep these logs in case police needs them (e.g. France, 1 year mandatory retention).

To make this processing legal, then GDPR demands that you inform your users, minimize the amount of PII, anonymize as soon as possible, and most of all not use this PII for other purposes.