Hi Julia, All new development for DSpace is done by volunteers with the directions approved by Committers & Steering. So, I cannot really give you a definitive answer that current behaviors will never change. But, at this time, I'm not aware of any plans to change the opt-in behavior for Google Analytics & Matomo cookies in DSpace because of those GDPR rules. However, if anyone discovers there's a way to change behavior and still comply with GDPR, then I'm sure we'd want to add that to DSpace. Overall, the goal is to ensure we are complying with GDPR and similar privacy regulations at all times.
I do want to stress though that, obviously,* the GDPR compliance issue has to do with the usage of Cookies and nothing to do with statistical services themselves being opt-in/opt-out *. Statistics tools that don't rely on cookies would not be "opt-in". For example, DSpace's internal statistics (stored in Solr) *don't* have an opt-in/opt-out option. DSpace's internal statistics are always enabled for everyone because because they doesn't use cookies. (As a sidenote, there will be enhancements to DSpace internal statistics coming with the DSpace-CRIS merger, see https://github.com/DSpace/DSpace/issues/11782 which should make these statistics more useful.) With regards to the "Correlation ID" cookie, it is also a non-essential cookie. So, it acts the same as Google Analytics and Matomo cookies. All of these options are "opt-in" because all non-essential cookies must be "opt-in" to comply with GDPR. Tim On Wednesday, February 18, 2026 at 1:02:36 PM UTC-6 [email protected] wrote: > Hi Tim, > > Thanks again - this is super helpful information. I appreciate the > additional GDPR links as well. > > And just to confirm - looking ahead to D9 and beyond, the opt-in behaviour > will continue for any statistical services that are configured for the > site. For the Correlation ID > <https://github.com/DSpace/dspace-angular/pull/3889> (new as of D9), this > will be enabled by default for debugging purposes, but can be turned off by > the user? > > Have a nice afternoon! > > Julia > > On Monday, 16 February 2026 at 16:13:38 UTC-5 DSpace Technical Support > wrote: > > Hi Julia, > > I dug around into this a bit more and realized that GDPR *requires opt-in > functionality* when it comes to *any cookies which are not "strictly > necessary"*. See the GDPR guide to Cookies at https://gdpr.eu/cookies/ , > especially this text (under "Cookie compliance"): > > To comply with the regulations governing cookies under the GDPR and the > ePrivacy Directive you must: > > - Receive users’ consent before you use any cookies except strictly > necessary cookies. > > Just above that, GDPR defines what is considered "strictly necessary" > cookies and it does NOT include statistics cookies. > > So, this is why for *both* Google Analytics and Matomo, we have an > "opt-in" policy in place. In my prior messages, I had forgotten this > decision was based on the GDPR requirements. > > At this time, there are no configurations in DSpace to switch either > Google Analytics or Matomo cookies to being "opt-out". That would be > *possible* to implement, but it seems like it would break GDPR compliance > (at least based on what I'm understanding). All this said, I'm not a GDPR > expert. This is just my basic understanding of the regulations. > > All that said, I *believe* with both Google Analytics and Matomo *all > file downloads* will still be tracked for everyone (regardless of whether > they accept the cookies). These cookie settings only impact the statistics > which are tracked via browser cookies (e.g. things like seeing their page > visits, browser stats, etc). > > (As a side note, it looks like Matomo now has a "cookieless tracking" > option > <https://matomo.org/faq/how-to/how-do-i-enforce-tracking-without-cookies/> > where it can retain GDPR compliance *without cookies*, but data will be > less accurate. However, I don't believe DSpace supports this option yet. > Though you could submit a feature request ticket if that's of interest.) > > Hopefully that gives you a bit more information. > > Tim > On Monday, February 16, 2026 at 10:50:15 AM UTC-6 [email protected] > wrote: > > Hi Tim and Mark, > > Thank you both for your responses. I took a look at some of the sites we > host that have Google Analytics enabled and the Statistical section and > Google Analytics service are both toggled off. We spoke with one > institution that has Google Analytics enabled and while they do see some > stats appearing in their GA dashboard, the numbers are lower than expected > and support the thinking that these stats are not being recorded for most > users (who, in the current set-up, would need to opt in to having their > site traffic recorded). One theory is that the numbers that do appear in > the dashboard may be coming from direct downloads of the bitstream URL > (e.g., if accessed from an external site) where the cookie settings would > be skipped, or, as this ticket > <https://github.com/DSpace/DSpace/issues/9211> suggests, that for users > who have previous session settings cached. > > Taking a look at both the DSpace demo site (D9) and another institution on > D9 that has Google Analytics set up, the Statistical settings appear to be > enabled by default. There is another another Statistical service > (Correlation ID) that also appears and is enabled out of box. This change > however may be attributed to the switch to Orejime (replacing the Klaro > tool) as of D9: https://github.com/DSpace/dspace-angular/issues/2718. > > We would like to confirm the following: > a) Is there a configuration setting to change the Google Analytics > behaviour to 'opt out' (and given GDPR regulations, is this even a > recommended change?) > b) In D9, cookie collection for Google Analytics switches to being 'opt > out' (is this then out of alignment with privacy recommendations, where > DSpace should not be doing any tracking until the user grants permissions?) > c) In D9, is the behaviour the same for the Matomo integration? I.e., if a > user selects *'That's ok'* for the cookie pop-up, their site visits are > recorded? Related ticket: https://github.com/DSpace/DSpace/pull/10435 > > Thanks again for any advice you can provide. We would like to accurately > communicate what/when/where site vists are being recorded, and if that > behaviour is changing from D8 to D9. > > Have a nice day! > > Julia > > > > On Thursday, 5 February 2026 at 13:08:43 UTC-5 [email protected] wrote: > > On Wed, Feb 04, 2026 at 08:03:28PM +0000, DSpace Technical Support wrote: > > Hi Julia, > > > > Yes, if a user opts out of Google Analytics tracking then their visits > will not be recorded in Google Analytics. This was added to align with > privacy regulations like GDPR, as those regulations require an ability to > opt-out of any non-required "tracking" cookies. As the Google Analytics > tracking cookie is not required to make DSpace function, users are able to > opt-out of it. > > > > The logic for this is all in the "google-analytics.service.ts" class< > https://github.com/DSpace/dspace-angular/blob/dspace-8_x/src/app/statistics/google-analytics.service.ts> > > in the frontend. > > > > Tim > > This might be an opportune moment to underscore what that means: > there are sizable jurisdictions in which the ability to easily render > download statistics incomplete is a legal requirement. > > Together with the tremendous growth in bot traffic, this ought to call > the whole practice of download counting seriously into question. We > need another way to demonstrate the value of repository content. We > need to measure that which tells us what we want to know, not that > which is easy to (mis)measure. > > -- > Mark H. Wood > Lead Technology Analyst > > University Library > Indiana University Indianapolis > 755 W. Michigan Street > Indianapolis, IN 46202 > 317-274-0749 > library.indianapolis.iu.edu > > ORCiD: 0000-0002-9558-3768 > > -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/0a7a7c4a-3d70-411f-a0e4-f5195940e993n%40googlegroups.com.
