Could the end of Google Analytics in the EU be on the horizon?

Why might Google Analytics be banned?

That warning comes from the Dutch Data Protection Authority (AP). Following an investigation by the Austrian data protection authority (DSB), the AP has launched an investigation into Google Analytics in the Netherlands. The Austrian authority warned that the Google service violates the European General Data Protection Regulation (GDPR).

The General Data Protection Regulation (GDPR) has been in effect since May 25, 2018. This means that the same rules apply throughout the European Union regarding privacy rights, the responsibilities of companies in this regard, and the powers of European privacy regulators. This law gives you, as a citizen, more rights in the area of privacy and ensures that organizations handle your (digital) personal data with greater care.

The Data Protection Authority (DSB) in Vienna ruled that Google Analytics transmits IP addresses and cookie data from users in Europe to servers in the United States. And that is not permitted under the GDPR.  

Can I still use Google Analytics ?

The Dutch Data Protection Authority (AP) is currently investigating two complaints regarding Analytics in the Netherlands. Once the investigation is complete, the AP will determine whether the service is permitted or not. For now, you can continue to use Google Analytics as usual. If the ruling concludes that the service is not currently GDPR-compliant, that does not automatically mean the end of Analytics. The service can adapt its system to ensure it complies with European privacy law. This is what happened when Google’s educational software came under fire.  

How do I make Google Analytics GDPR-compliant?

The investigation is still ongoing, but the Dutch Data Protection Authority has already issued a manual shared to help you configure Google Analytics to be privacy-friendly. The issue lies with the cookies that Analytics uses. When you use the system to collect data about your website or online store, you process users’ personal data using analytical cookies. To handle your users’ data in a privacy-friendly way, it’s a good idea to ask for consent. If you haven’t done so yet, log in to your Analytics account and follow these 6 steps. This way, you’ll have your users’ privacy properly managed and you’ll be compliant with the GDPR.  

1. Sign a data processing agreement with Google This agreement states that Google acts solely as a processor of website visitors’ personal data and is therefore not, for example, a data controller. Go to the account settings under “Management” to request this agreement. Accept the updated amendment and save it.

2. Do not allow Google to process the full IP address (anonymize IP) An IP address is used to identify a device on the internet or on a local network. Every IP address is unique. Such an address consists of a long string of numbers. You can use Google to remove the last four digits of that address, making visitors more anonymous. The AP would like those last digits removed to reduce privacy risks for users. How do you do that? Go to Property Settings, Tracking Info, and select the Tracking Code option. There you’ll see a code that you had to place in your website’s header to link Analytics. Add the yellow section to that code:Just to be safe, save a screenshot of the date and time when you add the rule. If asked, you’ll be able to quickly show when you implemented this measure.

 

3. Turn off data sharing with Google By default, Analytics shares data with Google for five different purposes, such as benchmarking and technical support. This means Google acts not only as a processor but also as a controller. And that’s not the intention, because then you’d have to ask visitors for consent on Google’s behalf. Go to your account settings and uncheck the five boxes.

4. Turn off data sharing with Google for advertising purposes Once you've completed step 3, you're not quite done yet. Google can still use your website visitors' data for advertising purposes. You'll need to disable this in a different section. Go to Property Settings, Tracking Info, and the Data Protection option. You'll now see the Remarketing and Advertising Reporting Features options. Turn these two off and save your changes.

5. Don’t accidentally enable the User ID feature Google allows you tolink browsing behavior across devices and sessions. You may only do this if you ask users for their consent. Therefore, make sure this setting is turned off. Go back to Property Settings, Tracking Info, and User ID.

6. Inform users about the use of Analytics and opt-out You may process data using analytical cookies without requesting consent. However, you must inform users of this, for example in a privacy policy. State in the policy that you use cookies and have followed the steps above to ensure privacy.Another recommendation from the AP is to offer your users an opt-out option: this prevents any information from being sent to Google Analytics. You can do this in two ways:add an element toyour website to offer the opt-out to users. Alternatively, users can install a browser extension for Chrome, but that isn’t a convenient solution for everyone.

Not sure how to do this, or don't have the time?

JKC Media will set up Google Analytics for you.