Google Analytics: When sensitive data is left to a free tool

The decision of the Austrian Data Protection Authority radically highlights the vulnerability and legal uncertainty of website and webshop data. […]

The decision of the Austrian Data Protection Authority of 13 January 2022 has hit like a bomb and has far-reaching consequences: The use of Google Analytics violates the General Data Protection Regulation (GDPR) in the form described. The concern in Austria’s companies is correspondingly great and the legal search for economically viable ways to solve problems in web-oriented data management for DSGVO-compliant website analysis and data collection has increased immensely overnight.

On January 13, 2022, the Austrian Data Protection Authority made a far-reaching legal decision: The use of Google Analytics, the globally dominant tracking tool of the US-american Google Group for traffic analysis of websites, contradicts the General Data Protection Regulation (GDPR) in the form discussed.

“The decisive point for entrepreneurs is that by simply adjusting their own privacy policy on the company website, the criticisms of the Austrian Data Protection Authority can be resolved and compliance with the GDPR can be established,” says marketing data expert Gerhard Kürner, pointing out the explosive nature of this decision. “In order for Google Analytics to be legally used again by Austria’s companies, according to the complainant, either Google would have to change its system in accordance with the GDPR or the American data protection regulations would have to be harmonized with those of Europe. Both do not stand out. Therefore, companies are now required to react quickly in order to be able to operate their websites legally correctly and thus unassailable by third parties,“says Kürner.

First decisions of the Austrian Data Protection Authority

The first decision (currently 101 sample complaints have been submitted) of the Austrian Data Protection Authority shows mercilessly how high the dependence on the Google Analytics tool is. Although digital shopping and digital services have experienced a further boom due to the corona pandemic – keyword e–commerce, homeschooling, video conferencing – the website and shop data were mostly considered insignificant by the companies. So far, dealing with this has hardly been an issue in the decision-making circles of companies.

“The hiding of the handling of the website data by many decision-makers is not comprehensible. Because these digital data are increasingly deciding on the success and failure of companies. They are emblematic of one of the most precious raw materials of the present and future, comparable to the importance and dominance of petroleum in recent decades,“ says Gerhard Kürner. So it is ultimately absolutely incomprehensible how you can leave this valuable and sensitive data to a free tool, which then evaluates and uses it for its own purposes.

“No company would simply pass on their own accounting, production control or CRM data to a free tool from an external third party – but most of them didn’t think anything of the website data. This is avenged by the decision of the data protection authority. Due to the renewed data protection problems of this procedure, a rapid and radical rethinking is now required,“emphasizes Kürner.

The mere deactivation of Google Analytics would be a legal, but not an economically expedient ad hoc solution. Because website data is often the beginning of a customer relationship. They enable targeted and efficient market cultivation. No company can afford to leave this competitive advantage unused. In addition, website data for companies is the central control factor for communication with and services for existing customers. It is precisely this great influence on the success of the company’s activities that is the main reason why Google Analytics has become the dominant provider worldwide.

Strong alternatives to Google Analytics

For example, the marketing data science & Analytics company 506 uses the European privacy market leader Piwik PRO for data tracking for its customers. The associated major advantage, which has been decisive since the decision of the data protection authority, is that the website data belongs exclusively to the customer and not to external service providers. The respective company thus acts in accordance with the GDPR, uses the website data for its own business success and, above all, can continue to use this valuable data to consistently improve communication with interested parties and customers.

“There is no way around data-based management. But it must be GDPR-compliant. Only in this way can companies achieve a legally correct and thus unassailable third-party comprehensive picture of their customer and marketing processes, consistently improve their own corporate service and corporate communication and increase business success,“ Kürner is convinced.

Ready to see us in action:

More To Explore
Enable registration in settings - general
Have any project in mind?

Contact us: