The German Data Protection Authorities (DSK) are being flooded with complaints – approximately 200.000 – regarding websites’ use of Google Analytics in Germany. The use is allegedly in violation with the General Data Protection Regulation (GDPR), privacy activist Christian Bennefeld of datenschutz-zwecklos.de reports.
The complaints concern whether it is possible for website owners to deploy Google Analytics’ services – and thereby their tracking cookies – without obtaining the consent of the end user.
The struggle for Google Analytics
Being the most popular web analytics tool worldwide, Google Analytics collects – for its users – vast amounts of data on the origin and behavior of website visitors to create comprehensive user profiles for marketing purposes.
Best-practice when using Google Analytics has until now been IP anonymization and the possibility of opt-outs. The legal basis for tracking user behavior has be legitimate interest of the website owner.
However, the DSK has long pushed for the legal basis to be consent, i.e. that website owners obtain valid – and prior – consent from their visitors for using Google Analytics’ tracking cookies.
With the recent verdict by the European Court of Justices against German lottery website Planet49, website owners may be forced to change behavior.
The case in Germany
The bomb exploded when the Hamburg supervisory authority in October 2019 received a complaint from a single complainant stating that they had visited more than 20.000 business website sites in Hamburg, all using Google Analytics in a non-compliant manner.
According to the Hamburg authorities, North Rhine-Westphalia reports an identical case with over 70,000 offending websites.
At the Autumn Conference of the BvD (The Association of Data Protection Officers), Head of the Bavarian Country Offices for Data Protection Supervision Kristin Benedikt reported that up to 200.000 cases against Google Analytics are pending.
With the Planet49 and the recent Cookie Judgment of the EU Court of Justice, in addition to the identical opinion of the German Data Protection Conference (DSK), there are now clear directives from the highest courts, which must be adhered to.
The struggle for website owners and marketers (using Google Analytics)
If the DSK succeeds in regulating website owners’ use of Google Analytics, it would mean a whole new way of collecting online data of online behavior.
Website visitors are to be properly informed of tracking cookies, their purpose and ownership. Visitors must actively opt-in to cookies and be made the offer to decline – at least according to the recent Planet49 case.
Thus, the threat to publishers and marketers relying on Google Analytics’ insights from tracking cookies is real. Asking users for consent to storing cookies on their devices may see a fall in revenues because marketing is so heavily based on users’ personal data.
However, with a proper consent implementation, websites can still use Google Analytics & co.’s services and be GDPR compliant.
How to use Google Analytics while being GDPR compliant
Cookie Information has developed a Consent Management Platforms with a cookie pop-up banner which not only informs users of cookies (as required by ePrivacy), it also collects consents for your cookies’ personal data collection and processing )as required by GDPR).
Our cookie consent solution currently has an overall acceptance to all cookies at 98.5%.
This means, you can collect and use more than 98% of your website traffic data with Google Analytics and be GDPR compliant at the same time.