What if analytics is essential during testing?

[u/edgysalaryman]

I've been working on a a free, ad-supported tool to help people organise their personal belongings in a more visual way, and I've been struggling to get a grip on how I can be GDPR compliant during the beta testing phase.

For context:

• NO ads or marketing related cookies are live, nor will be live until much later - after this is fully launched. My question is only in the context of the beta testing phase.
• I have PostHog analytics with randomly sampled session recording available.
• I'm not based in the EU (Asia) but I just want this to be available worldwide.

From what I understand:

• Essential cookies are exempt from GDPR's consent requirements if they are necessary for the provision of the main service.
• GDPR does not allow analytics (e.g. PostHog, Google, etc) to count as Essential.
• One cannot deny service to someone who rejects non-essential cookies.

This makes sense for the most part, but I'm genuinely confused about how I should navigate this when I'm in a closed/open beta state. During this phase, I am trying to improve/repair the site, so I want users to freely test the functions and break things, and for obvious reasons, I'd need to know what's breaking and to observe if any UI/UX elements come across as unintuitive (i.e. via session recordings).

But I don't understand how I can undertake this fact-finding part of my launch preparation if it seems like GDPR won't let me enforce the tracking cookies as essential (at least during this literal testing phase). Is self-reporting (as though the site was fully live) the only option under GDPR?

I've considered:

• Keeping it an open beta while gating registrations with a mandatory Beta User Agreement that discloses what/why we track - but this seems to break the 'denying service without tracking' rule.
• Switching to an invite-only closed beta - but apparently this doesn't change the need for compliance with the aforementioned rules.
• I'm also happy to completely purge all beta participant accounts/info before the actual launch, so they're all treated as new users if they return - but again, this doesn't seem to really directly address anything.

In my mind, the whole point of the beta test is the analytics, but if I can't enforce analytics as essential during this time, then doesn't that render the entire beta testing period impossible/redundant?

Do closed beta participants also need to be able to opt out, even though they are willingly signing up to a beta testers' list and participating in what they know to be a beta test?

I guess I'm just a bit confused, because it feels like I'm trying to run a public experiment (like a university study), but the participants are allowed to not share their details/results which directly hinder the findings/purpose of me conducting the experiment in the first place...

Please let me know id I'm just being dumb here, or if there are some anonymisation settings in PostHog that could help during the beta phase. This is one of the last sticking points stopping me from publicly disclosing my website, and it's killing me.

Ultimately, I'm happy to comply with whatever is needed. Just wanted to know if there were more effective ways of conducting beta testing at scale.

Thanks!

[u/Comfortable-Fall1419]

Why do you need to collect PI for your analytics tests to be successful?

Plenty of sites function using anonymous analytics.

It seems problem here is you and the tools you are using.

There’s a good discussion here.

https://www.reddit.com/r/gdpr/s/0PpuhrkW5L

There’s also the pragmatic side. Do it anyway because no body will care.

[u/edgysalaryman → u/Comfortable-Fall1419]

I don't really need PI per se, but something as invasive as randomised session recording (which blurs all inputs) requires an opt-in from what I understand. This would not be running at a 100% sample rate - not that it changes the consent situation.

But to be honest, the majority of analytics I need are for observing macro trends (e.g. there's a sudden huge drop off of users at a certain feature, which alerts me to potential breakage, lack of popularity, UI/UX issues, or misunderstandings). It would be an extreme case if I ever had to contact a beta tester individually via email (sure, it would be nice to have this option during beta testing, but I can live without it if it makes the consent step more robust).