In mid-January 2022, the Austrian data protection authority published a decision that affects many marketers. According to the authority, a website that used Google Analytics had breached the GDPR. The reason: visitor data was sent to the United States without being adequately protected there.
That may sound far away, but other regulators in Europe are watching closely, including in the Netherlands. In this article you will read what was decided, what it does and does not mean for you, and which steps make sense now. You will also see why measuring via your own server is a logical step for the future.
What was decided in Austria
The case began with a complaint from the privacy organisation noyb. It argued that an Austrian website was passing visitors’ personal data to Google in the US via Google Analytics. The Austrian regulator sided with the complainant.
The core of the decision is that the data was not sufficiently protected in the US. Google had taken additional measures, but in the regulator’s view they were not enough. In this case, IP anonymisation did not solve the problem either.
It is important to note that the ruling formally applies only to this case in Austria. It is not a Europe-wide ban on Google Analytics. It is, however, a clear signal of how regulators view this kind of data transfer.
Why sending data to the US is a problem
The GDPR is the European privacy law. It states that personal data may only leave the EU if it is protected there to the same standard as here. For the US, there was an arrangement in place for a long time, the Privacy Shield. In July 2020, the European Court of Justice declared that arrangement invalid. The reason was that US government agencies can, under certain conditions, demand access to companies’ data.
Since then, many businesses have relied on standard contractual clauses. These are fixed contractual terms between two parties on how they handle data. They are permitted, but only if they provide genuine protection in practice. That is precisely what proved insufficient in Austria.
What counts as personal data here? More than you might think. Consider:
- a visitor’s IP address;
- unique IDs in cookies, which allow you to recognise a visitor;
- device and browser data, especially in combination with other data.
As soon as you can use these to recognise a visitor or distinguish them from other visitors, it may constitute personal data.
What this means for your business in the Netherlands
In the Netherlands, Google Analytics is not currently prohibited. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is examining the Austrian ruling and its consequences. Guidelines or decisions may therefore follow later. What they will be, and when, nobody knows at present.
That does not mean you can sit back and relax. As a website owner, you are yourself responsible for what happens with your visitors’ data, even if you use an external tool.
A common scenario: a web shop had Google Analytics installed years ago. There is a cookie banner on the site, but nobody knows exactly what it does. Analytics is on its default settings, data sharing with Google is switched on and no data processing agreement has been signed. The owner thinks: that will probably be fine. When a visitor asks a question or an inspection takes place, he cannot explain which data goes where. That is the risk. Not that you will be fined tomorrow, but that your affairs are not in order when someone asks about them.
What to do now
You do not need to stop measuring in a panic. You can, however, take a number of steps that reduce your risk and prepare you better. Work through this list calmly:
- Check your settings. Open Google Analytics and see what is switched on. Turn on IP anonymisation if you have not already. Anonymising means that the last part of the IP address is removed.
- Switch off data sharing. Do not share data with Google for advertising purposes or other Google purposes of its own, unless you have consent for it.
- Sort out the paperwork. Conclude the data processing agreement with Google. This is a contract that sets out how a party handles your data.
- Ask for consent. Have your cookie banner request consent for analytics cookies that are not anonymous. Only place those cookies after the visitor says yes.
- Do not retain data longer than necessary. Set a short retention period for data. You usually do not need years of detail on individual visitors.
- Update your privacy statement. Say honestly which tools you use and which data you collect.
Please note: consent via your cookie banner is a good step, but it does not automatically resolve the question of transfers to the US in every case. If you process a lot of visitor data or work with sensitive data, discuss this with a privacy adviser or lawyer.
What else you should know about your cookie banner
Many cookie banners are not compliant. A banner with only an Accept button is not enough. Refusing must be as easy as accepting. And pre-ticked choices do not count as consent.
A good banner does three things:
- briefly explains what you use cookies for;
- lets the visitor choose per type of cookie;
- only places cookies after a clear choice has been made.
The downside is that you measure fewer visitors, because not everyone gives consent. Frankly, that is a consequence of the rules. How to deal with this wisely is covered below.
Think ahead with server-side tagging
With the usual approach, scripts in your visitor’s browser send data directly to parties such as Google. You have little control over this.
Server-side tagging works differently. The data first goes to a server that you manage. There, you decide what you pass on to which party. For example, you can remove the IP address or leave out data you do not need before anything leaves your environment.
This gives you three advantages:
- you have more control over what you send on;
- you can better explain and demonstrate your privacy choices;
- your measurement often becomes more reliable, because ad blockers and browser restrictions are less likely to disrupt it.
It is not a magic wand. Even with your own server, the GDPR still applies and you still need a valid legal basis, such as consent. But it is a solid foundation to build on.
Also look at your overall measurement setup. Google Analytics 4, the newer version, does not store IP addresses. There are also alternative analytics tools that run in Europe and are built with privacy as a starting point. Which one suits you depends on what you want to know and how large your site is.
Frequently asked questions
Can I still use Google Analytics?
In the Netherlands, there is currently no ban. The Austrian ruling formally applies only there. Even so, you run a risk if your settings and agreements are not in order. Adjust your settings, ask for consent and keep an eye on developments.
Is IP anonymisation enough to comply with the GDPR?
No, not in all cases. It helps, so you are better off switching it on. But in the Austrian case it proved not to be enough. Cookies with unique IDs and other data can also be personal data.
How much work is it to switch to server-side tagging?
That varies per website. For a simple site with a few tools, it is manageable. For a web shop with many advertising channels, it takes longer. It always begins with an inventory of what you measure and why. After that, you can switch over step by step.
Book a free 30-minute introductory call
Not sure whether your measurement and cookie banner are in order? Or would you like to know what server-side tagging could mean for your website? Then book a free 30-minute introductory call with Adventio Marketing in Amersfoort. Together we will look at your current setup, give honest advice on the next steps and tell you what you can do yourself. No strings attached and no obligations.
