# Session ID and GDPR? **URL:** \ **Category:** Privacy\ **Created:** [October 14, 2022, 6:35pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135 "2022-10-14T18:35:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![optipiwik](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/optipiwik/32/806_2.png) [@optipiwik](https://community.piwik.pro/u/optipiwik)\ **Post date:** [October 14, 2022, 6:35pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/1 "2022-10-14T18:35:10Z")
Hello, On this page: > **[Collect data in a privacy-friendly way | Piwik PRO help center](https://help.piwik.pro/support/privacy/collect-data-in-a-privacy-friendly-way/)** > > In Piwik PRO, you can collect data while respecting visitors’ privacy and staying compliant with various privacy laws. In this article, we’ll show you a few privacy-focused ways to set up your data collection. But before you decide on one, consult... I read this: **Note:** Piwik PRO doesn’t use device fingerprinting. Instead it uses a [session ID](https://help.piwik.pro/support/questions/how-is-a-session-counted-in-piwik-pro/). A session ID is a more privacy-friendly way to recognize visitor’s sessions. But on this page: > **[What is a session and how is it counted? | Piwik PRO help center](https://help.piwik.pro/support/questions/how-is-a-session-counted-in-piwik-pro/)** > > A session is a visit to your site or app from a single visitor. It consists of events like page views, downloads, ecommerce conversions and the like. A session starts with the first event and ends 30 minutes after the last event. This means that when... I read this: **Session ID:** Our backend tracker creates a hash for each session based on the visitor’s IP address, operating system, browser name, browser version, browser language, enabled browser plugins and salt (random data that is used as an additional component). The tracker uses that hash to recognize events belonging to the same session. So tracking visitor’s IP address, operating system, browser name, browser version, browser language, enabled browser plugins… that looks like fingerprinting to me but maybe I misunderstood? Can someone please explain why the method PiwikPro uses is not fingerprinting? And is my website GDPR compliance when I: - turn ON Use a session ID - turn OFF Use visitor cookies - turn OFF Ask visitors for consent Thanks a lot for the help 🙂 Alwin ---
**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\ **Post date:** [October 14, 2022, 6:39pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/2 "2022-10-14T18:39:00Z")
Hi. The biggest difference is a random salt that practically resets the session ID after 30 min, so there’s no way to recognize returning individuals. As for your question, we always recommend setting up consent when the data is not anonymized. See also this guide from the French CNIL that allows gathering aggregated data without asking for consent under certain conditions: [How to make your website compliant with CNIL | Piwik PRO help center](https://help.piwik.pro/support/privacy/how-to-make-your-website-compliant-with-cnil/) ---
**Author:** ![optipiwik](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/optipiwik/32/806_2.png) [@optipiwik](https://community.piwik.pro/u/optipiwik)\ **Post date:** [October 14, 2022, 6:50pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/3 "2022-10-14T18:50:48Z")
There’s no way to recognize returning individuals, but it is fingerprinting an individuals browser the start with? - If I enable Comply with CNIL guidelines I do have GDPR compliance? I can’t see Session logs anymore and no Tracker Debuger but the rest of my reports data stay the same? ---
**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\ **Post date:** [October 14, 2022, 7:02pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/4 "2022-10-14T19:02:22Z")
Fingerprint does not contain randomized elements. If the user comes back the next day using same workstation and IP address, the hash won’t change. That’s the main difference. I’m not a lawyer, you have to decide yourself or ask lawyer for an opinion if it’s compliant. Regarding your question - you have GDPR compliance according to French DPA. Unfortunately, other countries haven’t published similar guides yet. ---
**Author:** ![optipiwik](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/optipiwik/32/806_2.png) [@optipiwik](https://community.piwik.pro/u/optipiwik)\ **Post date:** [October 14, 2022, 7:09pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/5 "2022-10-14T19:09:01Z")
Thanks kuba for your fast replies 😀 - If I enable Comply with CNIL guidelines the only difference in my reports data will be that I can’t see Session Logs anymore and no Tracker Debugger, but the rest of my reports data stay the same? - If I enable Don’t collect visitor’s device data my reports can be a little less accurate? IP address, operating system, browser name, browser version, browser language will still be used but screen resolutions and browser plugins are not used anymore? - ---
**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\ **Post date:** [October 14, 2022, 7:23pm UTC](https://community.piwik.pro/t/session-id-and-gdpr/1135/6 "2022-10-14T19:23:36Z")
1. More or less yes. There are also other constraints like not merging data (e.g. by using integrations that enrich the reports) and not using raw data APIs. 2. Yes. Device data is anything that can be gathered via JavaScript, so things like cookies, localStorage or screen resolution. IP address, user agent and browser language are always available since we’re using HTTP protocol.