Using Google Analytics legally in Europe – these are the points you should consider!
Corinne Sager
In spring 2022, the data protection authorities of Austria (DSB) and France (CNIL) made headlines regarding Google Analytics. The reason was their rulings that Google Analytics was not GDPR-compliant. Many companies are now uncertain: What are we still allowed to do? What do we need to do if we use Google Analytics? Our checklist helps you use Google Analytics in a data protection-compliant manner.
David Rosenthal, an expert in Data and Technology Law, has examined the ruling from Austria in detail. In doing so, he identified several points that he believes were not assessed correctly and are inaccurate from a technical perspective. Other sources also confirm that in the case in question (the one in Austria), not all technical measures were exhausted that are necessary for a GDPR-compliant use of Google Analytics. For example, there was no IP anonymization and no cookie consent management. David Rosenthal suggests that noyb.eu and the data protection authorities want to force website operators in the European Economic Area (EEA) to switch to EEA-based solutions and abandon the use of Google Analytics — regardless of how it is implemented. From David Rosenthal's perspective, the debate around the use of US service providers therefore appears to be politically motivated, at least initially.
What exactly did the two data protection authorities rule on?
The following graphic shows that the rulings were limited solely to the tool "Google Analytics." Assuming the two companies that were found in violation (companies A and B in the example) had additional tools in use, those would not be affected by the ruling, as the complaint was limited to the use of Google Analytics. The rulings by the DSB and CNIL also concern configurations X and Y, but not configuration Z. It is therefore not possible to make a blanket statement that Google Analytics is not GDPR-compliant. To date, there are no rulings from data protection authorities in other countries. It therefore remains open how other countries would assess the various configurations. And the question of how other tools would be evaluated also remains open, as they have not yet been the subject of any complaint.
All well and good, but there was still the issue of data storage in the United States. Since the invalidation of the EU-US Privacy Shield in July 2020, which had regulated the protection of personal data, there is no longer a legal framework in place governing how personal data must be handled. And because US laws on data protection do not go as far as those in the EU, the use of Google Analytics is a no-go for the Austrian data protection authority. One can only hope that a new regulation will soon be established, restoring a legal basis.
A brief aside: the complaints and rulings from Austria and France are directed against Google Analytics. However, it should not be forgotten that a great many other providers operate on exactly the same principle and also store their data in the US — meaning they would be equally affected by a complaint. This applies not only to other analytics tools, but also to marketing pixels from Facebook, Twitter, and others, as well as various cloud services (e.g., a CRM hosted in the cloud that stores data in the US). If you are now considering alternatives to Google Analytics, you would, to be consistent, need to do the same in these other areas as well.
What do I need to consider when using Google Analytics?
The difference between "legal" and "illegal" use of Google Analytics lies in the details of implementation, which are difficult to understand for non-technical users or non-lawyers. We have summarized the key points in a checklist so that you can use Google Analytics in a data protection-compliant manner.
Are you using Google Analytics in compliance with data protection regulations? Download the checklist.
To what extent do these precautions restrict your use of Google Analytics?
In general, when using an analytics tool, two application scenarios can be distinguished:
Understanding and optimizing web platforms based on user behavior. In this case, companies use an analytics tool to analyze user behavior on their web platforms and continuously improve the user experience.
Collecting and using data for marketing purposes. For this purpose, data from the analytics tool is shared with marketing platforms (e.g., Google Marketing Platform, Google Ads accounts, CRM systems). A common use case is generating audiences based on user behavior. These audiences are then used for targeting in marketing campaigns.
In the first case, the precautions described in the checklist are unlikely to result in significant restrictions. For optimizing a user journey, for example, no personal data is required — instead, user behavior is analyzed in aggregate or broken down by segments.
In the second case, analytics data is used for marketing purposes (keywords: retargeting, remarketing, lead nurturing, etc.). Here, I recommend a careful review of the data and its use. This should be assessed on a case-by-case basis, as the purposes of use can vary greatly. This applies, incidentally, regardless of whether you use Google Analytics or another analytics tool for data collection!
Recommendations for companies using Google Analytics
First of all, stay calm. The two rulings in Austria and France are above all a wake-up call to engage more intensively with the topic of data protection. To once again question what data you actually need, for what purposes it is used, and whether you need and have consent for it. In my opinion, immediately jumping into evaluating alternative tools is too hasty.
If we were to consistently discontinue all services that do not meet the criteria criticized by the Austrian data protection authority, we would have to forgo a great many services embedded in websites and would have to make compromises that bring competitive disadvantages. And why would a company remove only Google Analytics while remaining exposed to the same risk in other areas? A much better approach is to do everything possible to collect data sparingly and to be transparent about it. Start with our checklist regarding Google Analytics and make the necessary adjustments to your setup. We are happy to support you in this process.
Sources:
For those who would like to study David Rosenthal's article in detail — voilà: https://www.vischer.com/en/knowledge/blog/how-to-legally-use-google-analytics-in-europe-39512/
Disclaimer:
I am not a legal expert, and the information in this article is therefore not legally binding.
Contact for your Digital Solution
Are you keen to talk about your next project? We will be happy exchange ideas with you.
Contact for your Digital Solution with Unic
Are you keen too discuss your digital tasks with us? We would be happy to exchange ideas with you.
