Can usage of Google Analytics (without consent) be considered a legitimate interest?

Question

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "legitimate interest" in the context of a simple website that's just publishing articles in the open.

So first of all it is true that Google Analytics can use anonymized IPs, however GA also drops a tracking cookie used to distinguish users, with an expiration time of 2 years. And AFAIK tracking cookies are considered "personal data" under the GDPR, even if they are pseudo-anonymous.

Recital 47 says this:

The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest

So it seems possible, however due to the use of "may" all this says is that "analytics" can be regarded as a legitimate interest, however the publisher still needs to establish the legitimate interest.

And that same recital 47 says this:

... the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place

I don't see how visitors of a website can expect being tracked upon opening a website and the website can definitely work without tracking, so I don't see how this can be a legitimate interest.

So what am I missing, anybody with legal expertise that can help out?

Answer 1

You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR.

You worry about the cookies. I also found this article which also does and suggests to either:

• change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0.

• completely disable cookies. (GA does not require cookies). To do this, set the storage field to none:

  ga('create', 'UA-XXXXX-Y', {
    'storage': 'none'
  });
  

If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as:

‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection.

So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users.

The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized.

Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low.

It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely.

Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.