Google Analytics and GDPR: Google pleads not guilty and blames its users

Google publishes a pleading to defend the compliance of its analysis tool.

Google Analytics in the crosshairs of justice in Europe. © IB Photography –

Is Google Analytics compatible with GDPR?

This question has many marketing professionals shivering, as the web analytics tool is so popular. Yesterday, the Austrian authorities considered that the transfer of data outside the European Union, related to the implementation of Google Analytics on a website consulted by European citizens, represented a violation of the GDPR. This decision comes following a complaint from the NGO NOYB and corresponds in particular to the invalidation of the Privacy Shield by the Court of Justice of the European Union. It could spread all over Europe.

Also to read
Using Google Analytics Would Violate GDPR, Says Austria

When we attack Google, Google strikes back

In this case, several protagonists: Internet users, users and the software publisher. The former may believe that their rights are not respected, while Google and web experts may join the dock – or accomplices, a position that the Mountain View firm is trying to avoid. In a press release, Google defends itself from any violation of the laws in force and blames… its users.

Google’s arguments are as follows.

  • Google Analytics is used to improve the sites and applications; it does not allow Internet users to be tracked across the web. Fine, but that’s not really the point.
  • The Google Analytics TOS prohibit users from uploading data that could allow Google to identify individuals. Tools exist to delete data. If such data is found on Google’s servers, it’s not Google’s fault: it’s the users’ fault.
  • Google indicates that “Organizations use Google Analytics because they choose to” and is therefore not responsible for the data collection carried out by these organizations. Google somewhat compares its tool to peer-to-peer software: the legal problem does not lie in the application as such, but in the use of certain users.
  • Organizations retain full ownership of the data collected and Google only intervenes on the orders of its users. Google implies that this title of ownership is associated with the responsibility for the processing.
  • Google seeks to prove its good faith by listing the tools made available to users to comply with the laws. These options do deserve some publicity: anonymization of IP addresses, deactivation of collections, data retention period, request to delete data… What proportion of Google Analytics users are aware of these tools?
  • Google’s case looks more and more like an indictment against its own users. The firm thus recalls that it is the responsibility of website publishers to explicitly inform Internet users and obtain their consent for data processing, when laws require it.
  • Google also tries to convince by indicating that Internet users can use a browser extension to block Google Analytics. It’s true, but how do we do it on mobile? And is it really up to Internet users to take an action (download an extension) to protect their data? Google resonates here contrary to the spirit of the GDPR, which consecrates the opt-in against the opt-out.
  • Google ends its argument by indicating that many actions are taken to allow a transfer ” according to “ data to the countries where its servers are located, including the United States. The publisher justifies this transfer by the need to “speed and reliability of service”.

Because in Europe, we don’t have a server? The question is obviously more complex, as is the interpretation of regulations and decisions, whether it is the GDPR, the Schrems II judgment, the PIPL in China or the laws in force in California. The conformity of the use of a tool depends on many legislators and the rights of nations concerning their citizens are not always compatible. Some of Google’s arguments are legitimate, but the position of the company, which accuses its own users, still raises some questions.

Receive all the latest digital news by email

Leave a Comment