Klaro and Google Analytics

[Julia Gilmore]

Hi DSpace community, 

We would like to clarify if/how the Klaro consent pop-up impacts site statistics.

Specifically, if Google Analytics is set up for a DSpace site but a visitor leaves the “Statistical > Google Analytics” option turned off in the Klaro pop-up, would that prevent their visits from being recorded in Google Analytics? 

Thank you, 

Julia

[DSpace Technical Support]

Hi Julia,

Yes, if a user opts out of Google Analytics tracking then their visits will not be recorded in Google Analytics.  This was added to align with privacy regulations like GDPR, as those regulations require an ability to opt-out of any non-required "tracking" cookies.  As the Google Analytics tracking cookie is not required to make DSpace function, users are able to opt-out of it.

The logic for this is all in the "google-analytics.service.ts" class in the frontend.

Tim

[Julia Gilmore]

Hi Tim, 

Thank you for this speedy and informative (as per usual) response! 

To further confirm our understanding, from testing, it looks like users need to opt in to being tracked by Google Analytics (by default, Statistical service tracking is not toggled on). Is it possible, if an institution desired, to change the default so users need to opt out? 

Thanks again :) 

Julia

[DSpace Technical Support]

Hi Julia,

In that case, I'd recommend a bug ticket.  I *expected* it to be "opt out" by default as well.

If it's not behaving that way, then I'd consider that to be a bug.  I don't recall a past decision to make it "opt in" only, and I also don't recall a way to configure the default behavior differently (but hopefully someone will correct me if I'm forgetting something here).  So, it's probably best to create a bug ticket because it likely will require a change to existing code (either to make it configurable or switch it to "opt out" by default).

Tim

[mw...@iu.edu]

On Wed, Feb 04, 2026 at 08:03:28PM +0000, DSpace Technical Support wrote:
> Hi Julia,
>
> Yes, if a user opts out of Google Analytics tracking then their visits will not be recorded in Google Analytics. This was added to align with privacy regulations like GDPR, as those regulations require an ability to opt-out of any non-required "tracking" cookies. As the Google Analytics tracking cookie is not required to make DSpace function, users are able to opt-out of it.
>

> The logic for this is all in the "google-analytics.service.ts" class<https://github.com/DSpace/dspace-angular/blob/dspace-8_x/src/app/statistics/google-analytics.service.ts> in the frontend.
>
> Tim

This might be an opportune moment to underscore what that means:
there are sizable jurisdictions in which the ability to easily render
download statistics incomplete is a legal requirement.

Together with the tremendous growth in bot traffic, this ought to call
the whole practice of download counting seriously into question. We
need another way to demonstrate the value of repository content. We
need to measure that which tells us what we want to know, not that
which is easy to (mis)measure.

--
Mark H. Wood
Lead Technology Analyst

University Library
Indiana University Indianapolis
755 W. Michigan Street
Indianapolis, IN 46202
317-274-0749
library.indianapolis.iu.edu

ORCiD: 0000-0002-9558-3768

[Julia Gilmore]

Hi Tim and Mark, 

Thank you both for your responses. I took a look at some of the sites we host that have Google Analytics enabled and the Statistical section and Google Analytics service are both toggled off. We spoke with one institution that has Google Analytics enabled and while they do see some stats appearing in their GA dashboard, the numbers are lower than expected and support the thinking that these stats are not being recorded for most users (who, in the current set-up, would need to opt in to having their site traffic recorded). One theory is that the numbers that do appear in the dashboard may be coming from direct downloads of the bitstream URL (e.g., if accessed from an external site) where the cookie settings would be skipped, or, as this ticket suggests, that for users who have previous session settings cached. 

Taking a look at both the DSpace demo site (D9) and another institution on D9 that has Google Analytics set up, the Statistical settings appear to be enabled by default. There is another another Statistical service (Correlation ID) that also appears and is enabled out of box. This change however may be attributed to the switch to Orejime (replacing the Klaro tool) as of D9: https://github.com/DSpace/dspace-angular/issues/2718. 

We would like to confirm the following: 

a) Is there a configuration setting to change the Google Analytics behaviour to 'opt out' (and given GDPR regulations, is this even a recommended change?) 

b) In D9, cookie collection for Google Analytics switches to being 'opt out' (is this then out of alignment with privacy recommendations, where DSpace should not be doing any tracking until the user grants permissions?) 

c) In D9, is the behaviour the same for the Matomo integration? I.e., if a user selects 'That's ok' for the cookie pop-up, their site visits are recorded? Related ticket: https://github.com/DSpace/DSpace/pull/10435

Thanks again for any advice you can provide. We would like to accurately communicate what/when/where site vists are being recorded, and if that behaviour is changing from D8 to D9. 

Have a nice day! 

Julia

[DSpace Technical Support]

Hi Julia,

I dug around into this a bit more and realized that GDPR requires opt-in functionality when it comes to any cookies which are not "strictly necessary".  See the GDPR guide to Cookies at https://gdpr.eu/cookies/ , especially this text (under "Cookie compliance"):

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

• Receive users’ consent before you use any cookies except strictly necessary cookies.

Just above that, GDPR defines what is considered "strictly necessary" cookies and it does NOT include statistics cookies.

So, this is why for *both* Google Analytics and Matomo, we have an "opt-in" policy in place.  In my prior messages, I had forgotten this decision was based on the GDPR requirements.

At this time, there are no configurations in DSpace to switch either Google Analytics or Matomo cookies to being "opt-out".  That would be possible to implement, but it seems like it would break GDPR compliance (at least based on what I'm understanding). All this said, I'm not a GDPR expert. This is just my basic understanding of the regulations.

All that said, I believe with both Google Analytics and Matomo all file downloads will still be tracked for everyone (regardless of whether they accept the cookies).  These cookie settings only impact the statistics which are tracked via browser cookies (e.g. things like seeing their page visits, browser stats, etc).

(As a side note, it looks like Matomo now has a "cookieless tracking" option where it can retain GDPR compliance without cookies, but data will be less accurate. However, I don't believe DSpace supports this option yet. Though you could submit a feature request ticket if that's of interest.)

Hopefully that gives you a bit more information.

Tim