Use Google Analytics legally

Introduction

The data protection-compliant use of Google Analytics has been discussed for a long time. Based on the guidelines adopted by the Düsseldorf Circle in November 2009, an agreement has now been reached. Website operators must take some measures to use Google Analytics in compliance with the law.

1. Contract for data processing

As Google Analytics processes personal data, an order data processing contract with Google is required in accordance with § 11 BDSG. You can download this contract under the following link:

Contract for data processing

2. Anonymize IP addresses

Google provides an extension of the Google Analytics Code to anonymise IP addresses.AnonymizeIpThe last 8 bits of the IP address are deleted, so that no complete storage takes place.

Universal Analytics Tracking Code:

<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');

ga('create', 'UA-XXXXXXX-X', 'website.de');
ga('set', 'anonymizeIp', true);
ga('send', 'pageview');
</script>

Classic Analytics Tracking Code:

<script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-XXXXXXX-X']);
_gaq.push(['_gat._anonymizeIp']);
_gaq.push(['_trackPageview']);

(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + 
'.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>

3. Right of objection for users

Google offers a Browser add-on for deactivation of Google Analytics, which enables users to prevent the tracking. In the privacy policy must be pointed out.

4. Adapted Privacy Notice

The use of Google Analytics must be clearly explained in the privacy policy. A sample text could look like this:

Diese Website nutzt Google Analytics, einen Webanalysedienst der Google Inc. ...

5. Deletion of existing Google Analytics data

Since previous Google Analytics profiles may have been unlawfully collected, they should be deleted.

Conclusion

Through the above measures, website operators can use Google Analytics in compliance with the law. The adaptation of the tracking code, the provision of an opt-out link and the updating of the data protection declaration are decisive steps to comply with the data protection regulations.