NEWS15 September 2011

Google agrees privacy changes to analytics tool in Germany

Government Privacy

GERMANY— Website owners in Germany who use Google Analytics will have to delete their accounts and open new ones in order to comply with data protection rules, regulators said today.

Although Google denies that using its free analytics tool breaches the law, the company has come to an agreement with the regional data protection authority in Hamburg, where it has its German head office, to make certain changes.

But the regulator’s new guidance for websites that use the tool says they will have to delete past records because they have not been collected in accordance with the rules. The only way to do this, it says, is to close their accounts and open new ones – losing all historical data in the process.

This is unlikely to go down well with the thousands of sites that rely on Google Analytics to track and understand their visitors over time – although the guidance is currently only for sites based in the state of Hamburg. The data protection authorities in the other German states will have to give their own advice on how to use the tool in accordance with the law.

The changes made by Google include making an add-on available for all popular browsers to allow users to opt out of being tracked, providing an option for site owners to have the IP addresses of their users shortened to make them anonymous, and introducing an agreement with site owners to handle all user data in accordance with the law. Google says the technical changes will apply throughout Europe.

But Hamburg’s data protection commissioner Johannes Caspar emphasised that it is ultimately website operators – not Google itself - who are responsible for making sure their practices are in line with the law. And under Germany’s strict data protection rules misuse of personal information can lead to fines of up to €50,000.

Site owners are required to accept the agreement, configure Google Analytics to shorten IP addresses, publish a privacy policy stating how they use the tool and reopen their account to delete historical data.

The process does not require deleting accounts for other Google services such as Gmail or Google Docs, but it will require website operators to make small changes to their sites’ html code, in order for the new account to identify and analyse them.

Caspar said that bringing Google Analytics in line with the law had been “a long but constructive process”. But relations have not always been smooth – talks broke down earlier this year with Caspar complaining that the changes proposed by Google were insufficient.

In a blog post this morning Google’s head of data protection in Germany, Per Meyerdierks, said the company had worked closely with the authorities and was pleased to be able to offer users more clarity. “The protection of the user’s private space was one of the principles behind the development of Google Analytics from the beginning. It is important to us to provide users of Google Analytics with transparency and control,” he said.

Caspar said that dialogue between the authorities and Google will continue as web technologies continue to develop, particularly in the area of mobile.