The German Data Protection Authorities (DSK) is being flooded with complaints – approximately 200.000 – regarding websites’ use of Google Analytics in Germany. The use is allegedly in violation of the General Data Protection Regulation (GDPR),
privacy activist Christian Bennefeld of datenschutz-zwecklos.de reports.
The complaints concern whether website owners can deploy Google Analytics’ services – and thereby their tracking cookies – without obtaining the end-user’s consent.
The struggle for Google Analytics
Being the most popular web analytics tool worldwide, Google Analytics collects – for its users – vast amounts of data on the origin and behavior of website visitors to create comprehensive user profiles for marketing purposes.
Best-practice when using Google Analytics has been IP anonymization and the possibility of opt-outs. The legal basis for tracking user behavior has to be the legitimate interest of the website owner.
However, the DSK has long pushed for the legal basis to be consent, i.e., that website owners obtain valid – and prior – consent from their visitors for using Google Analytics’ tracking cookies.
With the recent verdict by the European Court of Justices against the German lottery website Planet49, website owners may be forced to change behavior.
The case in Germany
The bomb exploded when the Hamburg supervisory authority in October 2019 received a complaint from a single complainant stating that they had visited more than 20.000 business website sites in Hamburg, all using Google Analytics in a non-compliant manner.
According to the Hamburg authorities, North Rhine-Westphalia reports an identical case with over 70,000 offending websites.
At the Autumn Conference of the BvD (The Association of Data Protection Officers), Head of the Bavarian Country Offices for Data Protection Supervision Kristin Benedikt reported that up to 200.000 cases against Google Analytics are pending.
With the Planet49 and the recent Cookie Judgment of the EU Court of Justice, in addition to the identical opinion of the German Data Protection Conference (DSK), there are now clear directives from the highest courts, which must be adhered to.
The struggle for website owners and marketers (using Google Analytics)
If the DSK succeeds in regulating website owners’ use of Google Analytics, it would mean a whole new way of collecting online data of online behavior.
Website visitors must be properly informed of tracking cookies, their purpose, and ownership. Visitors must actively opt-in to cookies and be made the offer to decline – at least according to the recent Planet49 case.
Thus, the threat to publishers and marketers relying on Google Analytics’ insights from tracking cookies is real. Asking users for consent to store cookies on their devices may fall in revenue because marketing is so heavily based on users’ data.
However, with a proper consent implementation, websites can still use Google Analytics & co.’s services and be GDPR compliant.
How to use Google Analytics while being GDPR compliant
Cookie Information has developed a Consent Management Platform with a cookie pop-up banner that not only informs users of cookies (as required by ePrivacy) it also collects consentS for your cookies’ personal data collection and processing )as required by GDPR).
Our cookie consent solution currently has an overall acceptance of all cookies at 98.5%.
This means you can collect and use more than 98% of your website traffic data with Google Analytics and be GDPR compliant at the same time.
