German authorities consider fines for Google Analytics users

Johannes Caspar, the data protection commissioner for Hamburg (where Google has its German headquarters), told the Frankfurter Allgemeine Zeitung that Google had failed to make sufficient changes to its website analytics tool to bring it in line with the law.

The authorities warned in November 2009 that website analytics tools must give users the chance to opt out of being tracked, and since then Google has been in negotiations with Caspar’s office about changes to how its software works.

“We must be clear: what Google is proposing is not enough,” he told the paper on Monday.

The free tool can be used by website owners to track and analyse traffic to sites, which it does by placing cookies on users’ computers and collecting data including IP addresses (the unique numbers that identify computers on the web).

The company offered to shorten IP addresses to render them anonymous, as well as introducing plug-ins for browsers to allow users to opt out – but Caspar said these were not available for some browsers, including Safari and Opera, leaving around 10% of the country’s internet users without a solution. He also said his office had discovered that data about users who had opted out via their browsers was still being sent to Google – including full IP addresses.

Google’s head of data protection in Germany, Per Meyerdierks, said Google Analytics was already in line with European law, and is even used by the websites of European data protection bodies.

The Hamburg data protection authority itself was recently criticised for using a website statistics tool that does not anonymise user data – but says its supplier is in the process of changing its practices.

Caspar said Google was simply playing for time and taking advantage of the fact that the legal responsibility for the use of its tool lies with website owners. “Google is obviously hiding behind them,” he said.

Caspar said he will discuss the matter with other regional and federal data protection bodies – with a possibility of penalties for sites that use the tool. The law allows for fines of up to €50,000 for the use of personal information without consent.