Hi Tim, Thanks again - this is super helpful information. I appreciate the additional GDPR links as well.
And just to confirm - looking ahead to D9 and beyond, the opt-in behaviour will continue for any statistical services that are configured for the site. For the Correlation ID <https://github.com/DSpace/dspace-angular/pull/3889> (new as of D9), this will be enabled by default for debugging purposes, but can be turned off by the user? Have a nice afternoon! Julia On Monday, 16 February 2026 at 16:13:38 UTC-5 DSpace Technical Support wrote: Hi Julia, I dug around into this a bit more and realized that GDPR *requires opt-in functionality* when it comes to *any cookies which are not "strictly necessary"*. See the GDPR guide to Cookies at https://gdpr.eu/cookies/ , especially this text (under "Cookie compliance"): To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: - Receive users’ consent before you use any cookies except strictly necessary cookies. Just above that, GDPR defines what is considered "strictly necessary" cookies and it does NOT include statistics cookies. So, this is why for *both* Google Analytics and Matomo, we have an "opt-in" policy in place. In my prior messages, I had forgotten this decision was based on the GDPR requirements. At this time, there are no configurations in DSpace to switch either Google Analytics or Matomo cookies to being "opt-out". That would be *possible* to implement, but it seems like it would break GDPR compliance (at least based on what I'm understanding). All this said, I'm not a GDPR expert. This is just my basic understanding of the regulations. All that said, I *believe* with both Google Analytics and Matomo *all file downloads* will still be tracked for everyone (regardless of whether they accept the cookies). These cookie settings only impact the statistics which are tracked via browser cookies (e.g. things like seeing their page visits, browser stats, etc). (As a side note, it looks like Matomo now has a "cookieless tracking" option <https://matomo.org/faq/how-to/how-do-i-enforce-tracking-without-cookies/> where it can retain GDPR compliance *without cookies*, but data will be less accurate. However, I don't believe DSpace supports this option yet. Though you could submit a feature request ticket if that's of interest.) Hopefully that gives you a bit more information. Tim On Monday, February 16, 2026 at 10:50:15 AM UTC-6 [email protected] wrote: Hi Tim and Mark, Thank you both for your responses. I took a look at some of the sites we host that have Google Analytics enabled and the Statistical section and Google Analytics service are both toggled off. We spoke with one institution that has Google Analytics enabled and while they do see some stats appearing in their GA dashboard, the numbers are lower than expected and support the thinking that these stats are not being recorded for most users (who, in the current set-up, would need to opt in to having their site traffic recorded). One theory is that the numbers that do appear in the dashboard may be coming from direct downloads of the bitstream URL (e.g., if accessed from an external site) where the cookie settings would be skipped, or, as this ticket <https://github.com/DSpace/DSpace/issues/9211> suggests, that for users who have previous session settings cached. Taking a look at both the DSpace demo site (D9) and another institution on D9 that has Google Analytics set up, the Statistical settings appear to be enabled by default. There is another another Statistical service (Correlation ID) that also appears and is enabled out of box. This change however may be attributed to the switch to Orejime (replacing the Klaro tool) as of D9: https://github.com/DSpace/dspace-angular/issues/2718. We would like to confirm the following: a) Is there a configuration setting to change the Google Analytics behaviour to 'opt out' (and given GDPR regulations, is this even a recommended change?) b) In D9, cookie collection for Google Analytics switches to being 'opt out' (is this then out of alignment with privacy recommendations, where DSpace should not be doing any tracking until the user grants permissions?) c) In D9, is the behaviour the same for the Matomo integration? I.e., if a user selects *'That's ok'* for the cookie pop-up, their site visits are recorded? Related ticket: https://github.com/DSpace/DSpace/pull/10435 Thanks again for any advice you can provide. We would like to accurately communicate what/when/where site vists are being recorded, and if that behaviour is changing from D8 to D9. Have a nice day! Julia On Thursday, 5 February 2026 at 13:08:43 UTC-5 [email protected] wrote: On Wed, Feb 04, 2026 at 08:03:28PM +0000, DSpace Technical Support wrote: > Hi Julia, > > Yes, if a user opts out of Google Analytics tracking then their visits will not be recorded in Google Analytics. This was added to align with privacy regulations like GDPR, as those regulations require an ability to opt-out of any non-required "tracking" cookies. As the Google Analytics tracking cookie is not required to make DSpace function, users are able to opt-out of it. > > The logic for this is all in the "google-analytics.service.ts" class< https://github.com/DSpace/dspace-angular/blob/dspace-8_x/src/app/statistics/google-analytics.service.ts> in the frontend. > > Tim This might be an opportune moment to underscore what that means: there are sizable jurisdictions in which the ability to easily render download statistics incomplete is a legal requirement. Together with the tremendous growth in bot traffic, this ought to call the whole practice of download counting seriously into question. We need another way to demonstrate the value of repository content. We need to measure that which tells us what we want to know, not that which is easy to (mis)measure. -- Mark H. Wood Lead Technology Analyst University Library Indiana University Indianapolis 755 W. Michigan Street Indianapolis, IN 46202 317-274-0749 library.indianapolis.iu.edu ORCiD: 0000-0002-9558-3768 -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/0a011c03-bfd4-4c57-a3b8-9fe824e84770n%40googlegroups.com.
