Out-Law News 1 min. read

German authorities concerned about Google Analytics' data protection compliance, says report


German data protection authorities are investigating whether Google's web traffic measurement system Google Analytics routinely infringes privacy laws, according to a German newspaper report.

Zeit reports that several regional authorities, as well as the national Federal Data Protection Commissioner, are investigating whether the use of the system is a breach of web users' privacy rights unless their permission is obtained.

Google Analytics gathers, stores and collates information about website visitors. It tells web publishers how many unique visitors have been to a site, what pages they visited in what order and for how long. Such information is essential for web publishers in the creation of their sites and the management of advertising.

While other measurement services are available, Google Analytics has become extremely popular because it is free to use.

The data protection authorities in Germany, though, are considering action against those publishers who use the system because it uses unique identifiers of users.

Zeit reported that data protection authorities are concerned in case Google combines that information with other details held by it on the owner of that internet protocol, or IP, address from other services it operates such as its search engine or email system.

Though Google's terms and conditions say that it will not tie the Analytics data to other information it gathers, the data protection authorities are reportedly concerned about another clause in the terms and conditions that allows those terms to be modified by Google.

Though the use of the system without web users' consent is at the heart of its legality, Google said that it demands that all web publishers tell site users that Analytics is monitoring the use of the site.

"Analytics requires that all websites that use it must update their privacy policy to include a privacy policy on their site that fully discloses the use of Analytics," said a Google spokeswoman. "We are completely confident that Google Analytics complies with European data protection law."

"The service only reports on aggregate visitor data in anonymous form and does not collect personal information like addresses, names, or credit card numbers. For example, if users fill in personal details on a web site using Google Analytics, that data is not collected by or reported on by Google Analytics," said the spokeswoman.

Google said that Analytics set a "high bar" amongst its competitors for privacy protection and noted that UK data protection watchdog the Information Commissioner's Office used the system on its own site.

The German Data Protection Commissioner's Office did not respond to a request for comment before publication. 

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.