Are You Using Google Analytics? Do You Need to Follow German Disclosure Expectations?

Late last year, to relatively little fanfare, the Hamburg data protection office issued guidelines about disclosures it expected companies to make if those companies were using Google Analytics. It has recently come to our attention that in some instances, German authorities are contacting US-based companies that it believes may not be following EU behavioral advertising requirements, and in particular, as those requirements apply to their use of Google’s tools. As a reminder, if your company is subject to German law, you should keep in mind that (at least according to the Hamburg office), your company should take the following steps to use Google Analytics in a legally compliant manner. First, there should be an appropriate data processing agreement in place with Google. Second, your company’s privacy policy should disclose that Google Analytics is used on your site, and that the user has the ability to opt-out of use of those analytics. Third, the correct Google code settings need to be used by your IT team to make sure that users’ IP addresses are made anonymous. Finally, any Google Analytics data collected before these steps were in place needs to be deleted.

Tip: Companies that use Google Analytics tools in Europe, and Germany in particular, may find the Hamburg office’s guidance useful for how to use the analytics tools without running afoul of German law.