Opt-Out does not disable tracking / has no effect if IP-hashing is active

[adlerweb]

At the moment we've got a way to allow users to "opt-out" (398), according to the standard Text this is supposed to affect "any future tracking".

As far as I can see the Cookie however only hashes the users IP but doesn't prevent any other information to be recorded - right? So the plugin is still tracking the user, just not recording the unhashed IP (which results in no change if hashing is enabled globally). Shouldn't at least things like Referrer, User-Agent, etc also be stripped if a no-track-cookie is present?

[mostafasoufi]

As far as I can see the Cookie however only hashes the users IP but doesn't prevent any other information to be recorded - right?

Yes, That's right. Just the hashes IP address enabled in the plugin, because it is one of the GDPR criteria.

[adlerweb]

First of all: I am not a lawyer, just repeating things I picked up from other projects:
To be DSGVO/GDP-compliant IPs must always be anonymized when used for tracking/statistics. Additionally users must be able to fully opt-out of the tracking process. For me this sounds like the opt-out should not only enforce hashing but deactivate all recordings as far as possible.

[mostafasoufi]

To be more reliable, we can apply this in the next version.

[cgogolin]

Ouch. If the information in this bug report is correct then this is a rather serious problem. It is pretty mean to trick your users into thinking they can lawfully use the plugin while in fact they cannot, as the opt out does not actually do what it is supposed to do. This is definitely not an "improvement" but a serious bug and should not be labeled "wontfix".

[cgogolin]

I see that there have been a number of updates recently. Has this been resolved so that it is now again possible to use WPStatistics in a GDPR compliant way?

[mostafasoufi]

Thank you for your all comments and explanations about this problem. They will be considered in the next versions. We are trying hard to make WP Statistics GDPR compliant as soon as possible. We are going to represent our documents to explain the compliance soon.

[cgogolin]

Great that you are looking into this! I am looking forward to using WP-Statistics again once it it GDPR complaint. Please keep this issue open until the problem has actually been resolved, so that other users can see it. Thank you!

[cgogolin]

Also it would be good to remove the nofix tag, now that you are actually planing to fix this...