Google Analytics inadmissible at more than half of companies

Employees of the State Data Protection Officer in Baden-Württemberg (Jörg Klingbeil) have, according to his press release of 14.02.2014, examined the websites of 12,205 companies for the lawful use of the reach analysis tool Google Analytics under data protection law. The result: 2,533 of the examined website operators use Google Analytics, whereby 65% of them do not comply with data protection law requirements.

To monitor user behaviour, a website operator can use the free software "Google Analytics" provided by the American IT company Google. However, in view of the strict data protection rules applicable in Germany, caution is required. This results in particular from the disclosure of the collected internet usage data including the user's IP address to Google Inc. in the USA. The website visitor may possibly use Google services such as Gmail and through the combination of all data, far-reaching usage profiles can be created. The creation of such usage profiles is subject to strict rules in Germany. In particular, usage profiles may only be created under a pseudonym. According to the opinion of the Data Protection Officer, (unabbreviated) IP addresses are personal data, not pseudonyms. The collection of personal data such as IP addresses requires the conscious and express consent of the user. The IP address can be rendered non-personal by shortening it. The law furthermore prescribes notification obligations of the website operator towards users, who in particular also have a right of objection against the creation of usage profiles (under a pseudonym). The data protection notices must contain appropriate wording.

It should further be noted that the German website operator is responsible for compliance with data protection law requirements, not Google. Google processes the data on behalf of the website operator, who receives the visitor data processed. Therefore, a so-called data processing agreement (Auftragsdatenverarbeitungsvertrag) must be concluded, which is held as a standard.

Conclusion:

When using reach analysis tools to evaluate user behaviour, caution is required from a data protection law perspective. This requires technical settings, the conclusion of a data processing agreement and corresponding notices in the data protection provisions.