BayLDA takes action against websites with Google Analytics

Those who operate a website usually want to know how often it is visited, whether there are regular users, from which countries they come and what the usage behavior is on the site.

Key Facts

Website operators must analyze visitor frequency, user behavior and user origin.
Tracking requires the consent of website visitors for the processing of their user data.
Consent must be based on complete information and must be given by active action on the part of the user.
The use of Google Analytics requires current legislation and may only take place with consent.
Website operators without consent risk data protection violations and severe fines.
The BayLDA plans to take active action against violations by Google Analytics.
Competitors are already using warning letters to take action against these data protection violations.

There are also some entries on this topic on my blog.

However, if the user behavior is not only used for its own purposes, but is transferred to other places in order to be used to create a comprehensive “internet profile” of the website visitor, one speaks of tracking; and according to the Bavarian State Office for Data Protection, website operators require the consent of website visitors.

Consent is only available and is only effective if the users are fully informed about the planned processing of their user data (e.g. who receives which data for what purpose) and then have clearly consented. In other words, effective consent requires an active action by the user. This is in line with the current development on cookies(see my articles on this here).

Many website operators refer to old, long outdated and withdrawn publications when integrating Google Analytics or comparable analysis tools. However, the product Google Analytics has been developed in recent years in such a way that Google grants itself the right to use the data of website visitors for its own purposes.

Therefore, those who use functions that require consent may no longer use these functions with website visitors until they have declared effective consent.

Website operators who track users without consent commit a data breach, which can be punished with a hefty fine. From the current advance of the BayLDA it can be seen that this will soon also take action against Google Analytics violations itself. Competitors are already doing this by means of warnings.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.