- Have you considered other analytics systems?
- If so, what does Google Analytics have that's important enough to send all user traffic to Google?
Google's understanding of what is and isn't okay has been challenged repeatedly by data protection authorities. If I understand your plan correctly, you do not intend to ask for any consent before transferring traffic and usage data to Google.
2020-03-11: The Swedish Data Protection Authority imposes administrative fine on Google:
The Swedish Data Protection Authority imposes a fine of 75 million Swedish kronor (approximately 7 million euro) on Google for failure to comply with the GDPR. Google as a search engine operator has not fulfilled its obligations in respect of the right to request delisting. […] Google does not have a legal basis for informing site-owners when search result listings are removed and furthermore gives individuals misleading information by the statement in the request form. That is why the DPA orders Google to cease and desist from this practice.
2022-01-12: Austrian DSB: EU-US data transfers to Google Analytics illegal:
[…] die Standarddatenschutzklauseln, die die Erstbeschwerdegegnerin mit dem
Zweitbeschwerdegegner abgeschlossen hat, kein angemessenes Schutzniveau gemäß
Art. 44 DSGVO bieten, […] die Maßnahmen, die zusätzlich zu den in Spruchpunkt 2. b) genannten
Standarddatenschutzklauseln getroffenen wurden, nicht effektiv sind, da diese
die Überwachungs- und Zugriffsmöglichkeiten durch US-Nachrichtendienste
nicht beseitigen,
Soweit die Beschwerdegegner ins Treffen führen, dass keine „Mittel“ verwendet würden, um die hier
gegenständlichen Kennnummern mit der Person des Beschwerdeführers in Verbindung zu bringen, ist
ihnen neuerlich entgegenzuhalten, dass die Implementierung von Google Analytics auf
www.[REDACTED].at eine Aussonderung iSd ErwGr 26 DSGVO zur Folge hat. Mit anderen Worten: Wer
ein Tool verwendet, welches eine solche Aussonderung gerade erst ermöglicht, kann sich nicht auf den
Standpunkt stellen, nach „allgemeinem Ermessen“ keine Mittel zu verwenden, um natürliche Personen
identifizierbar zu machen.
2022-02-10: Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply:
The 10 February 2022, the CNIL, which was cooperating with its European counterparts, has issued and order to comply to several organizations using Google Analytics because of illegal transfers of data to the United States. […] A simple change in the tool's settings is not enough
2022-04-22: Austrian DPA rejects “risk based approach” for data transfers to third countries:
In seiner Stellungnahme vom 9. April 2021 im Parallelverfahren zur GZ: DSB-
D155.027 hat der Zweitbeschwerdegegner bei Frage 9 zwar vorgebracht, dass er eine derartige
Information nur bekommt, wenn gewisse Voraussetzungen erfüllt sind, wie etwa die Aktivierung von
spezifischen Einstellungen im Google-Account. Nach Auffassung der Datenschutzbehörde vermag
dieses Vorbringen nicht zu überzeugen. […] Dabei kann das Vorbringen der Beschwerdegegner rund um die „Anonymisierungsfunktion der
IPAdresse“ dahingestellt bleiben, da die vollständige IP-Adresse jedenfalls für einen gewissen – wenn
auch sehr kurzen – Zeitraum am Server von Google LLC verarbeitet wird. Dieser kurze
Datenverarbeitungszeitraum ist ausreichend, damit der Tatbestand des Art. 4 Z 2 DSGVO erfüllt wird.
Es ist nämlich nicht erforderlich, dass die Beschwerdegegner jeweils alleine einen Personenbezug
herstellen können, dass also alle für die Identifizierung erforderlichen Informationen bei diesen sind
(vgl. die Urteile des EuGH vom 20. Dezember 2017, C-434/16, Rz 31, sowie vom 19. Oktober 2016, C
582/14, Rz 43). Vielmehr ist ausreichend, dass irgendjemand – mit rechtlich zulässigen Mitteln und
vertretbarem Aufwand – diesen Personenbezug herstellen kann (vgl. Bergauer in Jahnel, DSGVO
Kommentar Art. 4 Z 1 Rz 20 mVa Albrecht/Jotzo, Das neue Datenschutzrecht der EU 58).
2022-06-23: Italian SA bans use of Google Analytics
No adequate safeguards for data transfers to the USA:
The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. […] In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.
2022-07-14: Datatilsynet nedlægger behandlingsforbud i Chromebook-sag
”Der er risiko for, at Google eller andre tredjeparter anvender personoplysninger om lærere og elever til brug for markedsføring eller andre formål, som Helsingør Kommune som dataansvarlig ikke ønsker, at personoplysninger skal behandles til. Særligt kontaktoplysninger, IP-adresse og digitale spor (almindelige oplysninger) er relevante i denne sammenhæng. Det bemærkes, at der er tale om personoplysninger relateret til elever, der nyder en særlig beskyttelse i henhold til databeskyttelsesreglerne, hvorfor adgangen til og behandlingen af personoplysninger om eleverne udgør et yderligere element i relation til risikovurderingen.”
I det konkrete tilfælde, hvor det er alment kendt, at de teknologier, der benyttes til levering og systemunderstøttelse af den valgte service – Google Chromebooks og Workspace for Education – også benyttes til at levere øvrige dele af Googles produkter, og disse benyttes til oplysningsindsamling, målrettet markedsføring og salg af disse oplysninger. […] Datatilsynet finder, at Helsingør Kommunes risikovurdering ikke til fulde dokumenterer de risikoscenarier, som kan opstå som følge af databehandlerkonstruktionen og de foretagne systemvalg.
2022-09-21: Press release: Use of Google Analytics for web analytics
The Danish Data Protection Agency has looked into the tool Google Analytics, its settings, and the terms under which the tool is provided. On the basis of this review, the Danish Data Protection Agency concludes that the tool cannot, without more, be used lawfully. Lawful use requires the implementation of supplementary measures in addition to the settings provided by Google.
“Since the decisions by our European colleagues, we have looked into the tool and the specific settings available to you when you intend to use Google Analytics. This has been particularly relevant as Google, following the first Austrian decision, has begun to provide additional settings in relation to what data can be collected by the tool. However, our conclusion is that the tool cannot, without more, be used lawfully.”
If you go ahead with this plan, will you at least consider respecting the Do Not Track header?
I've had a little look at Google Analytics 4, and – based solely on what Google claims about its functionality – it's not something you can opt users into without their consent.
The Internet Archive did not let me save a current version of the User exploration page, so I've documented the differences between the current version and that version:
Before:
To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from By User-ID and device to By device only:
Current:
To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from Blended Identity which factors in User ID, Google Signals and Modeling to By Device only:
Aside from that, the page is identical, so I will quote:
When a user is logged in, event data associated with that user is identified by the user ID you provide. When the user is logged out, that user's event data is identified by an anonymous ID.
- Do you intend to give Google our user IDs, in association with our activity?
This information should be written in your privacy policy, but it's not. And the point is somewhat moot, since Google could easily deduce such information from just an "anonymous" ID.
I'm no Google Analytics expert, but it feels like you'd need to give them some ID anyway, so you could comply with GDPR Article 17 "Right to erasure" requests. It's a bit of a catch-22 for you, though: if you give Google this data, then you're giving them explicitly personally-identifying information that they can use to connect more dots about us. If you don't, though, what Google gets is already personally-identifying to Google – but we have no way of requesting it deleted, because you can't identify which information is ours!
Speaking of, [GA4] Data-deletion requests said (in June):
If you need to delete data from the Analytics servers for any reason, then you can use a data-deletion request to issue a request for its removal.
You can have a maximum of 12 active (in grace period / pending deletion) requests per property at any one time.
You can cancel any request within 7 days from the time it was created. Use the request-details page. During the first 7 days, you can also see a preview of the effects of the deletion in your reports and in Explorations.
A data-deletion request can take between 7 and 63 days to be processed, depending on the amount of data to be deleted, and data must be more than 12 days old before it can be deleted.
If you're using consent mode for your property, you may need to add seven calendar days to the end date of your data-deletion request to ensure that any value you are specifically targeting for deletion is deleted from behavioral models. This is because Analytics trains machine-learning models on data from consented users (i.e., the data you may be trying to delete) and approximates future user behavior based on that training data.
This raises red flags. Are "consented users" actually consenting to this use of their data? Your current consent system isn't consent, and the big button is labelled:
Accept all cookies
with the small print:
Your privacy
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
Your cookie policy says nothing about training machine learning models. Even if you stretch and assume people consent to what's in the cookie policy, they're not consenting to this. This terminology is misleading.
I've said all this before, more than once, so this time I'll just quote the UK's ICO.
How do we comply with the cookie rules? | ICO:
A number of services exist that provide an analytics function, and it could be easier for you to use these instead of building your own. However, it can be more difficult to obtain consent for third-party analytics cookies as there is no direct relationship between the third-party organisation and the user of your site. In these cases you need to ensure the information you provide to users about these cookies is absolutely clear and is highlighted in a prominent place – for example you can’t just include it through a general privacy policy link.
What are cookies and similar technologies? | ICO:
Functions usually performed by a cookie can be achieved by other means. This could include, for example, using certain characteristics to identify devices so that visits to a website can be analysed.
PECR applies to any technology that stores or accesses information on the user’s device. This could include, for example, HTML5 local storage, Local Shared Objects and fingerprinting techniques.
Example
Device fingerprinting is a technique that involves combining a set of information elements in order to uniquely identify a particular device.
Examples of the information elements that device fingerprinting can single out, link, or infer include (but are not limited to):
- data derived from the configuration of a device;
- data exposed by the use of particular network protocols;
- CSS information;
- JavaScript objects;
- HTTP header information,
- clock information;
- TCP stack variation;
- installed fonts;
- installed plugins within the browser; and
- use of any APIs (internal and/or external).
It is also possible to combine these elements with other information, such as IP addresses or unique identifiers, etc.
PECR also applies to technologies like scripts, tracking pixels and plugins, wherever these are used.
From now on, this guidance uses the single term ‘cookies’ to refer to cookies and similar technologies that PECR applies to, […]
Let's compare this to Mad Scientist's non-exhaustive list of what Google claims they collect from "non-consenting" users. Or maybe you could look at what the Austrian DSB has found that Google Analytics actually collects?
