The data protection authorities from Bavaria have published a collection of questions and answers on data protection on websites. Questions are included if and under what conditions you can include Google fonts or whether you can include videos from Google in such a way that they start automatically.
The commitment of the Bavarian State Office for Data Protection is commendable, but should not replace legal advice in case of doubt. This is also due to the fact that they not only do not accept any liability for their information, but could even be wrong in case of doubt. Thus, the answer to the question of whether customer evaluation requests by e-mail are admissible is at least ambiguous. The Higher Regional Court of Dresden already expressed a critical opinion on the issue in 2016 (see this article); the Federal Court of Justice (BGH) took the same view.
Even whether the user’s consent is really required in order to use Google Analytics even with shortened IP is not yet definitively clarified, despite the numerous judgments on the subject at present; However, the body of the German data protection supervisory authorities, the so-called Data Protection Conference (DSK), sees this as this. The only decision to be decided by the court (e.g. by the District Court of Dresden) is that in any case only the shortened use of the IP address is permissible.
The FAQ should nevertheless give a good overview.
