Opt-out needed for web analytics tools, say German authorities

An association of federal and regional data protection authorities met yesterday and issued the guidelines on how the country’s telecommunications and media law applies to web analytics tools, after earlier warnings that the use of such tools without a user’s consent is illegal.

The authorities said that the creation of usage profiles is only allowed if they are based on pseudonyms rather than personally identifiable information. An IP address (the unique number that websites can use to identify a computer online) is considered by law to be personally identifiable information, they said.

The law requires that:

• web users are told they are being tracked and given the chance to opt out
• data collected is not linked with existing data on a user
• data is deleted once it is no longer being used
• a person’s consent is obtained before using their IP address to track their behaviour. Without such consent, IP addresses must be altered so as to prevent them being linked to an individual.

The statement does not mention how the rules will be enforced, but the law allows for fines of up to €50,000 for the use of personal information without consent.

In a report in Die Zeit yesterday, a spokesman for Google – whose free Analytics tool has the largest share of the market – was quoted as saying the company does not create profiles of users, and that the use of browser settings to reject cookies gives users a chance to avoid being tracked.