Short Links, Click Stats and GDPR: What You Need to Know

Is a click on a link personal data?

Not by itself, but what comes with it can be. When someone clicks, the service receives their IP address and information about their browser. The Court of Justice of the European Union ruled in the 2016 Breyer case that an IP address, even a dynamic one, can be personal data. The GDPR therefore applies as soon as a tool keeps such information about visitors located in the European Union.

In practice, the question is not whether to ban everything, but to collect little, keep it for a short time and explain it simply. This guide describes the French and EU context, where Qlynk operates. If your visitors are elsewhere, other rules may apply.

Who is responsible: you or the service?

In general, you decide to create a link and to measure its clicks, so you decide the purpose of the processing. The service that carries it out for you acts on your behalf. The exact roles depend on each tool’s terms, so you need to read them.

In practice, this leads to two steps: choose a provider that clearly explains what it does with the data, and mention links with stats in your own privacy policy.

Do you need a cookie banner to measure clicks?

It all depends on what the tool does. The rules on cookies and other trackers target storing or reading information on the visitor’s device. If the service sets no cookie and reads nothing from the device, those rules are not in play for simple click counting.

The CNIL, the French data protection authority, also accepts that some audience measurement can go without consent, under strict conditions: a purpose limited to audience measurement, anonymous data in the form of statistics, no global tracking of browsing, no cross-referencing with other processing or sharing with third parties, and tracker data kept no longer than 25 months. If even one condition is missing, consent is required. For a tool like Google Analytics, you should in principle count on collecting consent, unless you have checked otherwise with the CNIL.

What should you check with a link shortener?

Ask yourself these questions when you read the service’s privacy policy:

• Is the IP address stored in full, truncated or never stored?
• Is a cookie set on visitors who click?
• How long is the detail of each visit kept, and what remains afterward?
• Where is the data hosted, and who is it shared with?
• Are third-party tools (analytics, advertising, fonts) loaded on the pages?
• Do visitors have a simple way to exercise their rights (access, objection, erasure)?

What does Qlynk do with visitor data?

According to its privacy policy, Qlynk sets no cookie on people who open a link and loads no content from a third-party service. The IP address is never stored in full: only the first three blocks are kept. Unique visitors are counted with a fingerprint computed from a secret that changes every day, which prevents recognizing someone from one day to the next. The detail of each visit is kept for 13 months, after which only daily totals remain, with no personal data. Members never see an IP address. The service is hosted in France, with o2switch.

The stated legal basis is the legitimate interest in measuring link audience, with data reduced to the strict minimum. This does not exempt the member from informing their own visitors. These points reflect the policy currently in force: read it again, as it may change.

What should you do on your side?

Mention in your privacy policy that your links go through a short link service with stats, with the service’s name, the purpose (measuring interest in your content) and a pointer to its policy. Do not put personal data in addresses (an email address in a newsletter link, for example). And if you add an analytics tool to your own pages, treat it separately, with its own consent if needed. If you are unsure about your situation, talk to a lawyer or to your data protection authority (the CNIL in France).

What about stats by country and device?

The most common stats (country, device, browser, language) are aggregated data: you count how many visits come from France or from a mobile phone, without keeping anyone’s identity. It is the most privacy-friendly form of measurement, because it serves to understand an audience, not to follow a person.

The sensitive point is the level of detail. The more details a tool keeps per visit, the easier it becomes to cross-reference them to identify someone. A visitor’s location at the country level does not weigh the same as their location down to the street. A restrained tool limits itself to what answers a question that is useful to you.

Always ask yourself: do I really need this data to decide something? If the answer is no, do not turn the option on. That is the data minimization principle of the GDPR. Also think about what you promise your visitors, and stick to it.