Piwik sets Cookies without consent stg_

Privacy
1

Hi all,

im setting up my new Piwik Analytics. My setup is managed by Usercentrics consent manager.
I have custom triggers and setting for a cookieless variant and when consent is given the deanonymize function comes in place. The following sites I fire the Piwik Pro Tag with pk_id and pk_ses active.

The code for anonymous

/*
var _paq = _paq || ;
_paq.push([“setUserIsAnonymous”, true]);
_paq.push([“disableCookies”]);
_paq.push([“trackPageView”]);
_paq.push([“enableLinkTracking”]);
_paq.push([“setDomains”, [“.xxxxxx”]]);
(function() {
var u = “https://xxxxx.piwik.pro/”;
_paq.push([“setTrackerUrl”, u + “ppms.php”]);
_paq.push([“setSiteId”, “xxxxxxxx”]);
var d = document,
g = d.createElement(“script”),
s = d.getElementsByTagName(“script”)[0];
g.type = “text/javascript”;
g.async = true;
g.defer = true;
g.src = u + “ppms.js”;
s.parentNode.insertBefore(g, s);
})();

The setting runs BUT the following cookies are set by Piwik and return after deleting them :

|stg_externalReferrer
|stg_last_interaction
|stg_returning_visitor
|stg_traffic_source_priority|

I even tried a different PC and browser but they still appear.

Thanks Martin

2

Hi @Martin,

These cookies are optional and are added based on certain conditions used in the Tag Manager.

This article explains which conditions are responsible for setting those cookies:

3

So its

You use a multiplicity condition in a trigger and these two settings are turned off: Administration > Sites & apps > Privacy > Ask visitors for consent (off) and Administration > Sites & apps > Privacy > Use visitor cookies (off)

i guess.

That is absolutely not legal … if my setup says no cookies and anonymize the user … and cookies are set without me able to controll them … absolut no go.

How do i fix this?
Consent is given by my thirdparty Usercentrics and of course a trigger often has multiple conditions.

4

In your case only the stg_last_interaction is created because of using the multiplicity condition.

The multiplicity condition actually implies something else than a trigger having multiple conditions.

obraz
obraz1251×134 4.02 KB

You are also using functionalities that utilize stg_externalReferrer, stg_returning_visitor, stg_traffic_source_priority.

These are created if you use other trigger conditions described in the previously attached article (e.g. returning-visitor condition).

5

The only trigger that uses “many times during a session” - which sounds like nearly every trigger - is the all pages trigger, which is not in use.

my only settings for now are datalayer variables that listen to DL pushes from the consent manager and a click listener for shadowroot. and there is no option for multiplicity is this cases.

I really have no clue how Piwik is matching this all up.

Still, no matter what my trigger is … if my tracking code says no cookies at all … then why the hell should the tag manager set some.

6

You can send me your account name/URL, so I can check which tags/triggers create these cookies. Either here or in a private message.

The tracking/analytics part should be treated as a separate part of the product in my opinion. You can run the tag manager without the need of tracking visitors, e.g. to display some banners or add other content to your website. Or use the consent manager without using it’s anonymizing/deanonymizing capabilities. You can also use the tracking code without using Piwik PRO Tag Manager - e.g. by embeding the code on your website or using any other tag manager. The product is pretty modular.

You can choose which functionalities (conditions in this case) you want to enable or disable and based on that either remove or add cookies to your website.

7

I sent you a private message. Thanks

8

Try disabling this setting in the Administration module (privacy settings).

obraz
obraz763×150 5.8 KB

In general, when using a 3rd party consent manager I would advise to leave the Piwik PRO Consent Manager on, enable Use a custom consent form and connect them. This way you can still use the automatic anonymization/deanonymization mechanism which is based on the analytics consent type.

9

Thanks very much, I could solve the issue with disabling the cookie in the admin panel.
For now my developers are packed to the roof so there is no near slot to bring the code you mentioned onto the side. but using 2 custom scripts does the charm .

Thanks