8

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is possible. You just need to change some settings in Google Analytics: anonymize IPs, turn off "data sharing", whatever that is or whatever it means. But does this really make Google Analytics complaint with the GDPR without the user's consent? Is that guaranteed anywhere? I might be wrong, but I somehow get the feeling that this is just a "suggestion", to make things probably "better", but there might not be a valid legal explanation for this.

Basically the only way you can avoid consent in this case is by having a "legitimate interest", which in any case must be "reasonably expected" by the data subject (which means it can't be something totally unrelated, for example). The user can expect it is your legitimate interest to get some statistics on the traffic and the way the website is used. Other kinds of processing are probably not expected, and not to be considered "legitimate interests". So Google should probably not do anything with the Google Analytics data, except for providing the website owner with some innocent statistics. Now, is this guaranteed anywhere in Google privacy policies, in a way that makes it compliant with the GDPR?

So what I'm asking is: is it really possible to use Google Analytics on a website without user consent, and if so, what exactly makes it complaint? Changing some settings might be a good idea but not be enough, unless there's something that guarantees that's enough.

Improve this question
2
  • Adjusting those settings makes it collect no personal data, that is data that can be reasonably straightforwardly used to identify to whom it belongs. Do not trust this is the case? Then this is a technical question to Google, not a question of law.
    – Greendrake
    Commented Dec 20, 2018 at 20:42
  • 1
    That's not the definition of personal data; personal data is data which can be associated with a person (now or in the future). The individual data fields themselves do not have to be identifiable, for example a colour is not personal data, but my favourite colour is.
    – Synchro
    Commented May 21, 2019 at 11:55

2 Answers 2

Reset to default
8

Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this.

Basically, your thoughts are all correct. The Dutch DPA (Autoriteit Persoonsgegevens) has written a manual how to use Google Analytics compliant with the GDPR without having to ask for consent. But unfortunately it is not available in English.

  1. Based on Art. 28 GDPR, you need a Data Processing Amendment with google.
    • Open the settings menu from Google Analytics
    • Go to Admin
    • Choose Account Settings
    • Scroll down to the data processing amendment
    • Open it
    • Accept it
    • Click Save
  2. Anonymize your visitors IP Address. A full IP address is considered personal data. It is possible to remove the last octet before it is processed by google.
    • Add { ‘anonymize_ip’: true } to the tracking code on your website
    • Create a screenshot of the change, so you can prove later at which date you made this change.
  3. Disable Data Sharing with google. By default Google uses the data for 5 different purposes. Each of them would require consent from the visitor of your website. So you need to switch that off.
    • Open the settings menu from Google Analytics
    • Go to Admin
    • Choose Account Settings
    • Scroll down to the data sharing settings
    • Uncheck all checkboxes (Google producs & services, Benchmarking, Technical support, Account specialists and access for sales experts)
    • Click Save
  4. Disable Data Collection for Advertising. This has to be disabled at a different location, for the same reason as the previous step.
    • Open the settings menu from Google Analytics
    • Choose Property settings
    • Choose Tracking info
    • Choose Data collection
    • Turn off these two options (remarketing and advertising reporting)
    • Click Save
  5. Disable the User-ID feature. This is probably turned off by default. But it is important to keep it turned off. So you need to verify this.
    • Open the settings menu from Google Analytics
    • Choose Property settings
    • Choose Trackinginfo
    • Choose User-ID
    • Disable it
    • Click Save
  6. Even though you don't need consent to use Google Analytics, you still need to inform your users, for example by adding a few lines to your privacy policy explaining:
  • You are using Google Analytics cookies.
  • You have a data processing agreement with google.
  • You have enabled IP anonymization/masking.
  • You have disabled data sharing.
  • You are not using any other google services in combination with Google Analytics.

The Autoriteit Persoonsgegevens still recommends to offer an opt-out for Google Analytics, but it would not be required.

As the Autoriteit Persoonsgegevens is a DPA as defined in chapter 6 of the GDPR, you have to assume their advice really is GDPR complaint. In the past they also had performed other investigations to the privacy policies of google.

Improve this answer
2
  • So guess the answer I was looking for is that it all boils down to the "data processing amendment", with which Google guarantees that they will only use the data in accordance with the client's instructions (so if you turn off all the settings for unnecessary processing you are left with a hopefully compliant analytics).
    – reed
    Commented Jan 1, 2019 at 14:33
  • 1
    Good answer, but even if you do all this, it really boils down to whether you trust Google to do something explicitly counter to their entire raison d'être. If you're willing to turn all those GA features off, then you should be happy using a mildly less-capable self-hosted system like Matomo which avoids the problem altogether. I'd also note that the UK ICO uses GA on their site, and does none of these steps, allowing identifiable, persistent tracking without consent from the first page load, but then they're not exactly overburdened with competence.
    – Synchro
    Commented May 21, 2019 at 12:02
1

The following is essentially a replication of my answer this similar question, which also led to the essentially same frequently up-voted answer.

In contrast to that answer, which cites a Dutch decision, I pointed out that Opinion 04/2012 on Cookie Consent Exemption of the Article 29 Data Protection Working Party, adopted 7 June 2012, addresses the question of “First party analytics” (see page 10 of the pdf):

While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.

The CRITERIA A and B referenced are the only conditions under which a cookie could be exempted from the requirement of informed consistent, according to the ePrivacy Directive (Article 5.3 of Directive 2002/58/EC, as amended by Directive 2009/136/EC).

Whether the Google Analytics cookie is seen as a first-party cookie (with the analysis outsourced) or as a third-party cookie, it would definitely not be treated more leniently than this first-party analysis.

There’s nothing in the Working Party decision that gives any wiggle room about exactly how the analytics cookie is implemented that would lead to an exemption for needing affirmative user consent.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .