The Hamburg Data Protection Authority arrived at an agreement with Google on the data protection-conforming use of Google Analytics. This agreement had been expected, according to related statements. A protracted dispute about the use of Google Analytics appears to be resolved. In the following, read about what website operators will soon have take into account.
Data protection authorities passed a resolution at the end of November 2009 that makes the analysis of user behavior, based on the personal linkage of these data by using their full IP address, only permissible with the user’s deliberate and explicit consent. Thus, the use of Google Analytics in practice had to be discouraged in most cases until Google could subsequently present the first adaptation options that conform to data protection.
Finalized proposed resolution
The Hamburg Data Protection Authority has now come to a finalized resolution with Google and recommends implementing the following measures for an unimpeachable operation of Google Analytics:
- Conclude Data Processing Agreement: Website operators must enter into the Google-issued Data Processing Agreement in writing. It should be noted here that the website operator is formally the Principal, and Google is merely acting in accordance with instructions regarding the processing of personal data. The processing of personal data on order entails certain control obligations, and Google will support website operators by presenting the corresponding back-up documentation.
- Adjust tracking code: The website operator must instruct Google to abbreviate the IP addresses through the corresponding settings in the Google Analytics program code. To do so, each Internet site with analytics integration of the tracking code must be modified using the function “_anonymizeIp()”. Further details can be found here.
The Hamburg Data Protection Authority furthermore indicates that any aged data retrieved through Google Analytics to date must be deleted. Based on the information from the Hamburg-based regulatory agency, Google offers the only means to do so: shut down the existing Google Analytics profile and then initialize a new one. Please note that you will potentially obtain a different tracking code or another web property ID (UA-XXXXX-YY) and have to adapt your websites accordingly.
We have expanded the text from Google Analytics by a few lines (red font). We make no warranty as to completeness or accuracy.