3

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is possible. You just need to change some settings in Google Analytics: anonymize IPs, turn off "data sharing", whatever that is or whatever it means. But does this really make Google Analytics complaint with the GDPR without the user's consent? Is that guaranteed anywhere? I might be wrong, but I somehow get the feeling that this is just a "suggestion", to make things probably "better", but there might not be a valid legal explanation for this.

Basically the only way you can avoid consent in this case is by having a "legitimate interest", which in any case must be "reasonably expected" by the data subject (which means it can't be something totally unrelated, for example). The user can expect it is your legitimate interest to get some statistics on the traffic and the way the website is used. Other kinds of processing are probably not expected, and not to be considered "legitimate interests". So Google should probably not do anything with the Google Analytics data, except for providing the website owner with some innocent statistics. Now, is this guaranteed anywhere in Google privacy policies, in a way that makes it compliant with the GDPR?

So what I'm asking is: is it really possible to use Google Analytics on a website without user consent, and if so, what exactly makes it complaint? Changing some settings might be a good idea but not be enough, unless there's something that guarantees that's enough.

  • Adjusting those settings makes it collect no personal data, that is data that can be reasonably straightforwardly used to identify to whom it belongs. Do not trust this is the case? Then this is a technical question to Google, not a question of law. – Greendrake Dec 20 '18 at 20:42
4

Basically, your thoughts are all correct. The Dutch DPA (Autoriteit Persoonsgegevens) has written a manual how to use Google Analytics compliant with the GDPR without having to ask for consent. But unfortunately it is not available in English. A translation is also available here.

  1. Based on Art. 28 GDPR, you need a Data Processing Amendment with google.
    • Open the settings menu from Google Analytics
    • Go to Admin
    • Choose Account Settings
    • Scroll down to the data processing amendment
    • Open it
    • Accept it
    • Click Save
  2. Anonymize your visitors IP Address. A full IP address is considered personal data. It is possible to remove the last octet before it is processed by google.
    • Add { ‘anonymize_ip’: true } to the tracking code on your website
    • Create a screenshot of the change, so you can prove later at which date you made this change.
  3. Disable Data Sharing with google. By default Google uses the data for 5 different purposes. Each of them would require consent from the visitor of your website. So you need to switch that off.
    • Open the settings menu from Google Analytics
    • Go to Admin
    • Choose Account Settings
    • Scroll down to the data sharing settings
    • Uncheck all checkboxes (Google producs & services, Benchmarking, Technical support, Account specialists and access for sales experts)
    • Click Save
  4. Disable Data Collection for Advertising. This has to be disabled at a different location, for the same reason as the previous step.
    • Open the settings menu from Google Analytics
    • Choose Property settings
    • Choose Tracking info
    • Choose Data collection
    • Turn off these two options (remarketing and advertising reporting)
    • Click Save
  5. Disable the User-ID feature. This is probably turned off by default. But it is important to keep it turned off. So you need to verify this.
    • Open the settings menu from Google Analytics
    • Choose Property settings
    • Choose Trackinginfo
    • Choose User-ID
    • Disable it
    • Click Save
  6. Even though you don't need consent to use Google Analytics, you still need to inform your users, for example by adding a few lines to your privacy policy explaining:

    • You are using Google Analytics cookies.
    • You have a data processing agreement with google.
    • You have enabled IP anonymization/masking.
    • You have disabled data sharing.
    • You are not using any other google services in combination with Google Analytics.

The Autoriteit Persoonsgegevens still recommends to offer an opt-out for Google Analytics, but it would not be required.

As the Autoriteit Persoonsgegevens is a DPA as defined in chapter 6 of the GDPR, you have to assume their advice really is GDPR complaint. In the past they also had performed other investigations to the privacy policies of google.

  • So guess the answer I was looking for is that it all boils down to the "data processing amendment", with which Google guarantees that they will only use the data in accordance with the client's instructions (so if you turn off all the settings for unnecessary processing you are left with a hopefully compliant analytics). – reed Jan 1 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.