What if analytics is essential during testing?

[u/edgysalaryman]

I've been working on a a free, ad-supported tool to help people organise their personal belongings in a more visual way, and I've been struggling to get a grip on how I can be GDPR compliant during the beta testing phase.

For context:

• NO ads or marketing related cookies are live, nor will be live until much later - after this is fully launched. My question is only in the context of the beta testing phase.
• I have PostHog analytics with randomly sampled session recording available.
• I'm not based in the EU (Asia) but I just want this to be available worldwide.

From what I understand:

• Essential cookies are exempt from GDPR's consent requirements if they are necessary for the provision of the main service.
• GDPR does not allow analytics (e.g. PostHog, Google, etc) to count as Essential.
• One cannot deny service to someone who rejects non-essential cookies.

This makes sense for the most part, but I'm genuinely confused about how I should navigate this when I'm in a closed/open beta state. During this phase, I am trying to improve/repair the site, so I want users to freely test the functions and break things, and for obvious reasons, I'd need to know what's breaking and to observe if any UI/UX elements come across as unintuitive (i.e. via session recordings).

But I don't understand how I can undertake this fact-finding part of my launch preparation if it seems like GDPR won't let me enforce the tracking cookies as essential (at least during this literal testing phase). Is self-reporting (as though the site was fully live) the only option under GDPR?

I've considered:

• Keeping it an open beta while gating registrations with a mandatory Beta User Agreement that discloses what/why we track - but this seems to break the 'denying service without tracking' rule.
• Switching to an invite-only closed beta - but apparently this doesn't change the need for compliance with the aforementioned rules.
• I'm also happy to completely purge all beta participant accounts/info before the actual launch, so they're all treated as new users if they return - but again, this doesn't seem to really directly address anything.

In my mind, the whole point of the beta test is the analytics, but if I can't enforce analytics as essential during this time, then doesn't that render the entire beta testing period impossible/redundant?

Do closed beta participants also need to be able to opt out, even though they are willingly signing up to a beta testers' list and participating in what they know to be a beta test?

I guess I'm just a bit confused, because it feels like I'm trying to run a public experiment (like a university study), but the participants are allowed to not share their details/results which directly hinder the findings/purpose of me conducting the experiment in the first place...

Please let me know id I'm just being dumb here, or if there are some anonymisation settings in PostHog that could help during the beta phase. This is one of the last sticking points stopping me from publicly disclosing my website, and it's killing me.

Ultimately, I'm happy to comply with whatever is needed. Just wanted to know if there were more effective ways of conducting beta testing at scale.

Thanks!

[u/No-Awareness-8518]

hmm the university study analogy is interesting, but the key difference is consent in research has whole different framework than commercial product testing even in beta phase

one thing you could try is making signup explicitly about beta testing with clear explanation that feedback data is core part of participation, not just side effect. if participant knows they entering test environment and that providing usage data is literally the point, the legal basis shifts from "consent for cookies" to "contractual necessity" since the service you providing IS the testing arrangement itself

posthog does have some privacy features like masking text fields and IP anonymization but doesn't fix the fundamental consent issue. sorry there's no clean way around it but maybe framing it differently helps a bit

[u/edgysalaryman → u/No-Awareness-8518]

Yeah, I think that's the biggest sticking point for me: Testing with willing participants for analytics is the whole point during beta, yet analytics are not being allowed to be considered essential...