Will Google Analytics be banned in the EU?

Google Analytics is one of the most popular tracking tools in Germany and enables countless website operators to gain insight into the behavior of their customers. Now several European data protection authorities are saying that Google Analytics is not compatible with the GDPR.

By Hartmut Deiwick, CEO of the Löwenstark Digital Group

Google Analytics enables countless website operators to gain insight into the behavior of their customers. Like no other service provider, Google understands how to collect and evaluate data. Data protectionists have complained in the past that this competitive advantage is at the expense of the protection of personal data. Now several European data protection authorities agree with these concerns: Google Analytics is not compatible with the General Data Protection Regulation and its use is therefore illegal.

History of the impending ban

The current development was triggered by a decision in the “Schrems II” case. On July 16, 2020, the European Court of Justice declared the so-called “Privacy Shield” to be inadmissible. This data protection agreement between the USA and the EU previously regulated the transfer of personal data to the USA. The ruling prompted the Austrian data protection association noyb to take action against 101 companies from the EU and the European Economic Area.

A first decision was made on January 12, 2022. The Austrian data protection authority stated that the web analysis tool Google Analytics violated the provisions of the General Data Protection Regulation (GDPR) in several respects. Above all, the requirements for third-country transmission and the general principles for data transmission according to Art. 44 DSGVO are therefore not complied with. Other European authorities followed the assessment.

Hartmut Deiwick, CEO of the Löwenstark Digital Group

(Source: Löwenstark Digital Group)

Why is Google Analytics criticized at all?

Google is regarded worldwide as an expert in the collection and processing of user data. Every time a customer visits a website, Google receives important information. The IP address and cookie data are collected on each visit. There is also important information about the web browser, the operating system or the exact time of the visit. The amount of data can be analyzed according to defined criteria and thus provides operators with information on the use of their own website.

The problem with this is that the data collected enables the visitor to be identified. In order to prevent this, personal data would have to be better protected according to the GDPR. But Google Analytics does not meet these requirements.

What’s more, Google uses the collected data for its own purposes and combines them into entire user profiles. This procedure is explained in Google’s terms of use, but very few users are likely to be aware of it. Google transmits the collected data to cloud data centers in the USA. However, such a transfer is only compliant with data protection if the third country – in this case the USA – has a level of data protection that is equivalent to EU law. This is not the case in the US. On the contrary, the US secret services have unlimited access and intervention rights, even to data transmitted by EU citizens. Those affected are not informed about such access and can therefore not oppose it.

Impact on the use of Google Analytics

Since then, there has been great uncertainty in Germany about the further use of Google Analytics. At the end of March, the report that the EU Commission and the USA were promising a surveillance reform caused further ambiguity. The so-called “Trans-Atlantic Data Privacy Framework” is intended to contain obligations and rules that limit the US security authorities’ access rights to personal data. Accordingly, compliance with EU-wide data protection regulations is guaranteed by appropriate procedures. US companies that continue to transfer data from the EU to the US for processing should self-certify to comply with the new agreement.

It is currently unclear whether this is the next failed attempt at data protection-compliant cooperation or whether the agreement meets the requirements for a lawful transfer of personal data to third countries. Data protectionists are already pointing out that the proposed restrictions on the powers of intervention of the US security authorities are not the enactment of new laws, but merely administrative instructions in the form of so-called “executive orders” in which the EU The quality of legal protection granted to citizens appears rather questionable.

The efforts made by some website operators to enable data transmission when using Google Analytics with the express consent of the user in accordance with Article 49 (1) lit. Because it is expressly an exception to Art. 44 GDPR, which cannot be a legal basis for the permanent and mass transfer of data to a third country.

Switch to another tracking tool?

So most website operators only have to switch to a tracking tool that meets the requirements of the GDPR. Because the responsibility for legally compliant use of your own website always lies with the operator. With a data protection-compliant web analysis tool, data is encrypted or shortened and thus does not enable individual users to be identified. A server location in Germany or the EU is the most effective way of preventing problems when transferring data to a third country.

Although no binding decision has yet been made in Germany, website operators should plan the change at an early stage. This leaves enough time for the selection of the right tool and a gradual conversion. Google has largely ignored the decisions it has received so far from the European courts and data protection authorities. So it will be interesting to see how the tech giant will react if there is a Europe-wide ban on Google Analytics.

Source: com! professional by www.com-magazin.de.

*The article has been translated based on the content of com! professional by www.com-magazin.de. If there is any problem regarding the content, copyright, please leave a report below the article. We will try to process as quickly as possible to protect the rights of the author. Thank you very much!

*We just want readers to access information more quickly and easily with other multilingual content, instead of information only available in a certain language.

*We always respect the copyright of the content of the author and always include the original link of the source article.If the author disagrees, just leave the report below the article, the article will be edited or deleted at the request of the author. Thanks very much! Best regards!