Is Google Analytics really in violation of the GDPR legislation?

Blog
Posted on
GDPR and Google analytics in 2022

Google Analytics is a free analytical tool for collecting data about your website visitors. With this data, you can improve your website and gain better insights into your marketing objectives. Google Analytics is the market leader so there is a high chance that this tool is also installed on your website. This popular analytical tool has been under fire since a ruling by the Austrian DSB. Why? I'll explain that to you below!

Austrian DSB's ruling on Google Analytics

In January 2022, the Austrian DSB (Datenschutzbehörde) decided that Google Analytics violates the GDPR legislation. They concluded that Google does not process the data from Google Analytics in accordance with the European privacy legislation. This mainly concerns IP addresses and cookie data that are sent to the United States. Also Germany, France, and the Netherlands want a ruling on the legal use of Google Analytics by early 2022.

Google's response and the situation around Google Analytics in Belgium

Google already posted a reaction about this at the beginning of February. They indicate that they will provide more information in the coming weeks to expand the options regarding data management. In this way, they want to meet the privacy needs of every company as best as possible. According to the experts of the legal niche office 'deJuristen’, there are currently 4 investigations underway into the violation of the GDPR legislation in Belgium. The exact content of these investigations is unknown. It is still unclear what Belgium will decide here.

The problem with Google Analytics

According to the Austrian regulator, Google Analytics is illegal because the default IP anonymization is not sufficient enough, IT daily says. The DSB concludes that it concerns unique identification numbers and browser parameters. These unique IDs are used to determine whether a website visitor has previously visited a specific website.

Because these are not anonymized enough, you could combine this data into a unique profile and thus trace it back to a natural identifiable person. In addition, the DSB believes that Google does not protect their data enough against the American intelligence services.

The solution for your Google Analytics

There are several solutions that Google may be considering: 
 

 

SVG

Data centers

Placing data centers in Europe (Germany and France), which are not connected to the US. This would ensure that the data no longer needs to be transferred to the US and thus be protected against (potential) American espionage. 

SVG

Additional options for data management

Google already added additional options for data management in the past, so that each company can enable certain settings to comply with the laws of each country. There are plans to broaden these options even further. They regularly launch updates for Google Analytics, you can find this info here. 

SVG

New legal agreement

Europe and the US can make a new legal agreement on data processing and -transfer. This would mean that under certain circumstances data processing and -transfer would still be possible between Europe and the US.

What does this specifically mean for your business?

Pending a possible legal ruling in Belgium, we can take some steps to make Google Analytics as privacy-friendly as possible. 
You do this by: 

  • informing the visitor based on a privacy statement on your website. 
  • use a cookie banner that allows users to refuse cookies (and thus also Google Analytics tracking). 
  • review your settings for older accounts in Google Analytics. 
  • check whether you allow data sharing so that your data is not shared with Google. 
  • check Google's help page to see if you've already applied all the new settings.

Need advice on how to use your Google Analytics?

Not sure whether the Google Analytics on your website is completely in line with the latest GDPR legislation? Our experts are happy to help you to keep your data safe.