Google Analytics only with consent?

What does data protection say about statistical tools? Are they allowed? And under what conditions? Is it enough to use anonymization options?

Key Facts

Data protection authorities require the consent of website visitors when using third-party services that use personal data.
Google Analytics must be used with consent if it uses data for its own purposes.
Tools that record visitor behavior in detail also require consent.
Range recording without personal data is permitted, even by processors.
Locally installed tools such as Matomo offer data protection-compliant options, including anonymization functions.
Users must give their consent for additional functions, and this must be implemented correctly in terms of data protection law.
Website operators should check which tools set cookies and possibly collect undocumented data.

I recently published this article on the subject.

Today, the German data protection authorities gave a concerted opinion on this and similar issues.

For example, the Berlin Data Protection Supervisor believes that website operators have the consent of visitors to their websites if third-party services are to be integrated into them, in which the provider also obtains personal data for uses its own purposes. This includes Google Analytics. Analysis tools that pass on data about the usage behaviour to third parties may only be used with consent in cases where these third parties also use the data for their own purposes. The same applies if the behaviour of visitors to the website can be traced and recorded in detail, for example when keyboard input, mouse or swipe movements are recorded.

On the other hand, it can be considered permissible for website operators to record reach and to collect the number of visitors per page, the devices and the language settings, even if a processor does so. However, a processor may not use the data for its own purposes. Locally installed tools such as Matomo also offer numerous settings options to be compliant with privacy, from anonymization features to complete elimination of tracking cookies. Of course, you can also obtain the clear consent of the users at any time for various other functions. However, this must be checked on a case-by-case basis and implemented correctly under data protection law.

The opinion from Berlin corresponds to the legal assessment of the integration of third-party providers on websites and apps in the guidance issued by the supervisory authorities for telemedia providers.

Even if one should be careful not to panic now, it should indeed be checked which tools from the past may still be integrated on one’s own websites and possibly set uncontrolled cookies, which are not pointed out.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.