Google Analytics is currently used on more than half of all websites in Germany. The free use and close integration with Google’s advertising services are not the least of the reasons for its widespread use.
However, the use of Google Analytics in Germany has long been viewed very critically in terms of data protection law. This is because Google lays claim to the collected data and links it across all tracked websites and its own advertising platform. And so, among other things, socio-demographic data on own users can be viewed in all accounts.
On 12 May 2020, a Resolution of the Conference of the Independent Data Protection Authorities of the Federal Government and the States laid down the minimum data protection requirements that must be complied with by website operators when using Google Analytics.
Thus, informed, voluntary, active and prior consent of the users is always mandatory – even if the IP anonymisation function is used:
„The consent must clearly describe that the data processing is essentially carried out by Google, that the data is not anonymous, what data is processed and that Google uses it for any of its own purposes such as profiling, as well as linking it to other data such as any Google accounts. A mere reference such as „this site uses cookies to enhance your browsing experience“ or „uses cookies for web analytics and advertising“ is not sufficient, but misleading, because the processing involved is not made transparent. […]
The subject matter of the consent must be made clear: Google Analytics users must make it clear for what purpose Google Analytics is used, that the usage data is processed by Google LLC, that this data is stored in the US, that both Google and government authorities have access to this data, that this data is linked to other data of the user such as search history, personal accounts, usage data of other devices and any other data Google has on this user.“
(translated by the author)
The position of the supervisory authorities was confirmed with the BGH ruling of 28.05.2020, the so-called Cookie ruling.The Schrems II ruling of the ECJ on 16.07.2020, which declared the Privacy Shield agreement between the EU and USA invalid with immediate effect, has once again intensified the legal problem. This is because even the use of so-called „standard contractual clauses“ would only be possible with additional guarantees, such as the encryption of personal data by the client, with the key only being available to the client. Explicit consent by users also requires prior information on the risks of data transfer.
The Berlin Commissioner for Data Protection and Freedom of Information Maja Smoltczyk therefore calls in her press release of 17.07.2020 „… on all data controllers subject to her supervision to comply with the ECJ’s decision. Controllers who transfer personal data to the USA – especially when using cloud services – are now urged to switch immediately to service providers in the European Union or in a country with an adequate level of data protection.“
(translated by the author)
Fortunately, with etracker Analytics there is a European alternative to Google Analytics with special advantages:
- Migration is quick and easy.
- By default, etracker Analytics can record all conversions and visit interactions in a legally compliant manner, even if statistics cookies are rejected.
- The interface is intuitive to use and structured similarly to Google Analytics.
- Google Ads campaigns can be automatically evaluated as before and the anonymous conversion data transferred to Google Ads.
- The reporting data can also be accessed via REST interface in the Enterprise Edition. Raw data can be imported into BI and visualisation tools for further processing.
Check out the numerous reporting functions and the functionality of cookie-less, consent-free tracking for yourself.
Register now for the weekly harbour tour, the etracker Analytics presentation webinar.