Hi Mostafa,
I guess that means you’re using the nonce as a session id?
It’s a bit of a hairball because a lot of the decision belongs with the site owner — your customer — and not with the end user — the site owner’s customer. My take is to give the site owner as much of the decision as you can or at least give them the information they need.
The big problem here is you have no way to know if the site owner has asked the end user if cookies are allowed. Which means the options are:
1. No cookie (nor localStorage nor sessionStorage)
— do the fix I suggested above and generate a new nonce every time class-wp-statistics-api-hit.php gets a request
— every visit will appear in the stats as a new visitor. On high-traffic sites that won’t matter so much. (Maybe the stats could be sorted by IP/agent?)
— completely GDPR compliant
2. Use a cookie (or localStorage or sessionStorage)
— still needs the fix in the first post but with a check if the nonce exists
— Make the site owner confirm they get end user permission to store stats cookies
— completely GDPR compliant (because it’s the site owner who is liable not you)
3. Use a server-side PHP session
— I’m not a PHP dev so am not certain this would work
— still needs the fix from the first post but with a lot more in class-wp-statistics-api-hit.php
— completely GDPR compliant
— would need the site owner to confirm PHP sessions are acceptable
What would I do?
I’d go with the 1. No Cookie option and put a friendly warning next to the Enable Cache setting in WP Statistics. Something to let the site owner know. It’s the simplest option, requires the least coding on your part and means useful stats are collected. If your users want something better, it gives you time to think.
Hope this helps
BTW, I really like the API route for recording the stats. If you’re maintaining two different sets of code to record hits, I’d focus on this one and steadily sunset the other one.
