internet privacy european-union gdpr website
Is it really possible to use Google Analytics without consent, and if so, why exactly?
<p>I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is possible. You just need to change some settings in Google Analytics: anonymize IPs, turn off "data sharing", whatever that is or whatever it means. But does this <em>really</em> make Google Analytics complaint with the GDPR without the user's consent? Is that guaranteed anywhere? I might be wrong, but I somehow get the feeling that this is just a "suggestion", to make things probably "better", but there might not be a valid legal explanation for this.</p>

<p>Basically the only way you can avoid consent in this case is by having a "legitimate interest", which in any case must be "reasonably expected" by the data subject (which means it can't be something totally unrelated, for example). The user can expect it is your legitimate interest to get some statistics on the traffic and the way the website is used. Other kinds of processing are probably not expected, and not to be considered "legitimate interests". So Google should probably not do <em>anything</em> with the Google Analytics data, except for providing the website owner with some innocent statistics. Now, is this guaranteed anywhere in Google privacy policies, in a way that makes it compliant with the GDPR? </p>

<p>So what I'm asking is: is it really possible to use Google Analytics on a website without user consent, and if so, <strong>what exactly makes it complaint</strong>? Changing some settings might be a good idea but not be enough, unless there's something that guarantees that's enough. </p>

<p><strong>Update:</strong> On 1 October 2019 the <a href="https://en.wikipedia.org/wiki/Court_of_Justice_of_the_European_Union" rel="nofollow noreferrer">CJEU</a> ruled in Case <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=218462&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1438506" rel="nofollow noreferrer">C‑673/17</a> (Verbraucherzentrale Bundesverband vs. Planet49 GmbH)
that cookies require explicit consent regardless of personal data is being processed. (Where the <a href="https://law.stackexchange.com/a/29084/18215">exceptions</a> don't apply). (paragraphs 68-70 of the ruling).
That does probably invalidate my answer below. However, because I have based my answer on information provided
by the Dutch DPA, I will not update my answer until that DPA has responded on this.</p>
<p>Basically, your thoughts are all correct. The Dutch DPA (Autoriteit Persoonsgegevens) has written a <a href="https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/138._handleiding_privacyvriendelijk_instellen_google_analytics_aug_2018.pdf" rel="nofollow noreferrer">manual</a> how to use Google Analytics compliant with the GDPR without having to ask for consent. But unfortunately it is not available in English.</p>
<ol>
<li>Based on <a href="https://gdpr-info.eu/art-28-gdpr/" rel="nofollow noreferrer">Art. 28 GDPR</a>, you need a Data Processing Amendment with google.
<ul>
<li>Open the settings menu from Google Analytics</li>
<li>Go to Admin</li>
<li>Choose Account Settings</li>
<li>Scroll down to the data processing amendment</li>
<li>Open it</li>
<li>Accept it</li>
<li>Click Save</li>
</ul>
</li>
<li><a href="https://support.google.com/analytics/answer/2763052?hl=en" rel="nofollow noreferrer">Anonymize</a> your visitors IP Address. A full IP address is considered personal data. It is possible to remove the last octet before it is processed by google.
<ul>
<li>Add <code>{ ‘anonymize_ip’: true }</code> to the tracking code on your website</li>
<li>Create a screenshot of the change, so you can prove later at which date you made this change.</li>
</ul>
</li>
<li>Disable Data Sharing with google. By default Google uses the data for 5 different purposes. Each of them would require consent from the visitor of your website. So you need to switch that off.
<ul>
<li>Open the settings menu from Google Analytics</li>
<li>Go to Admin</li>
<li>Choose Account Settings</li>
<li>Scroll down to the data sharing settings</li>
<li>Uncheck all checkboxes (Google producs &amp; services, Benchmarking, Technical support, Account specialists and access for sales experts)</li>
<li>Click Save</li>
</ul>
</li>
<li>Disable Data Collection for Advertising. This has to be disabled at a different location, for the same reason as the previous step.
<ul>
<li>Open the settings menu from Google Analytics</li>
<li>Choose Property settings</li>
<li>Choose Tracking info</li>
<li>Choose Data collection</li>
<li>Turn off these two options (remarketing and advertising reporting)</li>
<li>Click Save</li>
</ul>
</li>
<li>Disable the User-ID feature. This is probably turned off by default. But it is important to keep it turned off. So you need to verify this.
<ul>
<li>Open the settings menu from Google Analytics</li>
<li>Choose Property settings</li>
<li>Choose Trackinginfo</li>
<li>Choose User-ID</li>
<li>Disable it</li>
<li>Click Save</li>
</ul>
</li>
<li>Even though you don't need consent to use Google Analytics, you still need to inform your users, for example by adding a few lines to your privacy policy explaining:</li>
</ol>
<ul>
<li>You are using Google Analytics cookies.</li>
<li>You have a data processing agreement with google.</li>
<li>You have enabled IP anonymization/masking.</li>
<li>You have disabled data sharing.</li>
<li>You are not using any other google services in combination with Google Analytics.</li>
</ul>
<p>The Autoriteit Persoonsgegevens still recommends to offer an <a href="https://developers.google.com/analytics/devguides/collection/analyticsjs/user-opt-out" rel="nofollow noreferrer">opt-out for Google Analytics</a>, but it would not be required.</p>
<p>As the Autoriteit Persoonsgegevens is a DPA as defined in <a href="https://gdpr-info.eu/chapter-6/" rel="nofollow noreferrer">chapter 6 of the GDPR</a>, you have to assume their advice really is GDPR complaint. In the past they also had performed other <a href="https://autoriteitpersoonsgegevens.nl/sites/default/files/downloads/mijn_privacy/en_rap_2013-google-privacypolicy.pdf" rel="nofollow noreferrer">investigations</a> to the privacy policies of google.</p>

<p>The following is essentially a replication of <a href="https://law.stackexchange.com/a/82794/37526">my answer</a> this <a href="https://law.stackexchange.com/questions/28367/gdpr-whats-classed-as-an-opt-in-for-google-analytics-cookie-and-do-i-need-to">similar question</a>, which also led to the essentially same <a href="https://law.stackexchange.com/a/35587/37526">frequently up-voted answer</a>.</p>
<p>In contrast to that answer, which cites a Dutch decision, I pointed out that <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf" rel="nofollow noreferrer">Opinion 04/2012 on Cookie Consent Exemption</a> of the Article 29 Data Protection Working Party, adopted 7 June 2012, addresses the question of “First party analytics” (see page 10 of the pdf):</p>
<blockquote>
<p>While they are often considered as a “strictly necessary” tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the user can access all the functionalities provided by the website when such cookies are disabled. As a consequence, these cookies do not fall under the exemption defined in CRITERION A or B.</p>
</blockquote>
<p>The CRITERIA A and B referenced are the only conditions under which a cookie could be exempted from the requirement of informed consistent, according to the ePrivacy Directive (Article 5.3 of Directive 2002/58/EC, as amended by Directive 2009/136/EC).</p>
<p>Whether the Google Analytics cookie is seen as a first-party cookie (with the analysis outsourced) or as a third-party cookie, it would definitely not be treated more leniently than this first-party analysis.</p>
<p>There’s nothing in the Working Party decision that gives any wiggle room about exactly how the analytics cookie is implemented that would lead to an exemption for needing affirmative user consent.</p>
