Google Analytics remains in the focus of the regulatory authorities. In Germany the State Data Protection Officer of Rheinland-Pfalz has issued prohibition orders against responsible website operators, according to which the transfer of user data to Google may only take place with the explicit consent of the users concerned and cannot be based on the legitimate interests of the website operators. Some of the companies which are responsible parties in accordance with the GDPR have already taken legal action against these instructions, but according to the information available to date, without success.
In addition to the basic recommendation to obtain user consent for tracking on your website (see ePrivacy Special Information of October 2019), we recommend that you check your use of Google Analytics.
What you can do now:
- In case you use Google Analytics only to a limited extent and do not necessarily need it, we recommend that you stop using this service on your website. A website operator has already has already decided to cease further use of Google Analytics in an ongoing lawsuit following a corresponding notice by the court.
- If you are willing to take the risk and wish to continue using Google Analytics to analyse your website, make sure to use IP anonymisation. You should also deactivate the data release for Google. Your company should also have agreed to the Google contract data processing agreement.
- It is worth considering switching to a more data-efficient analytics alternative in order to ensure that the analysis of website visitors continues to be guaranteed. In particular, a self-hosted solution can ensure that no personal data is transferred to third parties.
Should you wish to take such measures and have questions regarding data protection laws, please do not hesitate to contact us.
contact