Google Analytics only with consent?

What does data protection say about statistical tools? Are they allowed? And under what conditions? Is it enough to use anonymization options?

I recently published this article.

Today, the German data protection authorities gave a concerted opinion on this and similar issues.

For example, the Berlin Data Protection Supervisor believes that website operators have the consent of visitors to their websites if third-party services are to be integrated into them, in which the provider also obtains personal data for uses its own purposes. This includes Google Analytics. Analysis tools that pass on data about the usage behaviour to third parties may only be used with consent in cases where these third parties also use the data for their own purposes. The same applies if the behaviour of visitors to the website can be traced and recorded in detail, for example when keyboard input, mouse or swipe movements are recorded.

On the other hand, it can be considered permissible for website operators to record reach and to collect the number of visitors per page, the devices and the language settings, even if a processor does so. However, a processor may not use the data for its own purposes. Locally installed tools such as Matomo also offer numerous settings options to be compliant with privacy, from anonymization features to complete elimination of tracking cookies. Of course, you can also obtain the clear consent of the users at any time for various other functions. However, this must be checked on a case-by-case basis and implemented correctly under data protection law.

The view from Berlin corresponds to the guidance of the supervisory authorities for providers of telemediain the legal evaluation of the integration of third parties on websites and apps.

Even if one should be careful not to panic now, it should indeed be checked which tools from the past may still be integrated on one’s own websites and possibly set uncontrolled cookies, which are not pointed out.