Opposition to Google Analytics

Several German regulatory authorities issued coordinated warnings regarding the use of “Google Analytics” and other tracking tools on websites. In an apparent response to the flood of complaints received, the press releases point out that the use of Google Analytics and other web analytics tools exceeds the scope of Art. 6(1)(f) GDPR and therefore cannot be based on legitimate interests as a legal basis. Rather, the only option remaining is consent pursuant to Art. 6(1)(a) of the GDPR, which must comply with the requirements of Art. 7 of the GDPR as well as the guidelines of the European Data Protection Board on consent and the judgment of the CJEU in the “Planet 49” case. Furthermore, reference is made to the “Guidance for Telemedia Providers“, which was published by the DSK in March 2019. The supervisory authorities state that the complaints and suggestions for inspection that have been submitted are being followed up on.

Anyone who wishes to continue using Google Analytics will undoubtedly have to obtain consent from the data subjects to do so. To avoid being classified as a joint controller with Google within the meaning of Art. 26 of the GDPR, all data-sharing options should be disabled. These can be found in the Google Analytics admin area under the “Account Settings” menu item. The data processing agreement (“Data Processing Addendum”) must also be concluded there. In addition, IP address anonymization should be configured, and the retention period for user and event data should be set to the shortest possible duration. The passage regarding data access warrants critical evaluation. Here, Google states the following regarding the disclosure of data: “Exceptions to this apply only in certain cases and to the extent required by law.” As long as Google does not transparently disclose these specific cases, this could give rise to joint liability and render the data processing agreement as well as the data subjects’ consent forms invalid.

For many operators of web analytics tools, data-minimal alternatives such as Matomo (configured without cookies) also meet the requirements for a useful audience analysis, the use of which is based on the legitimate interest under Article 6(1)(f) of the GDPR as their legal basis. Such analyses also have an advantage over analytics methods requiring consent in that all visits can be analyzed, whereas with methods requiring consent, the vastvisitors will refuse to give their consent, resulting in only a fraction of visits being analyzed.

 

Sources