So what about tracking? Who tracks what?
Google is naturally the biggest player in this market with its analytics tool Google Analytics. For a long time, data protectionists criticized Google for storing users' IP addresses and transmitting them to servers in the US.
In addition, according to data protectionists, Google's privacy policy did not provide sufficient information about which user data was actually stored and transmitted. However, after years of negotiations, an agreement was reached.
If you are a website operator and want to embed Google Analytics in a legally compliant manner, you must observe the following:
- The website operator must conclude a digital contract for order data processing with Google.
- The IP addresses of users must be anonymized. In practice, this means that this function hides the last octet of the IP address, so that individual users can no longer be identified.
- The privacy policy of the website must be updated. This must describe whether and how Google Analytics is used. Furthermore, the notice must state that the contract data processing agreement with Google exists and that the anonymized IP address function is used.
- There must be an opt-out option. This means that the user must be actively informed that Google Analytics is being used and that the user can decide to object to this storage of data.
However, data storage must be limited to essential information about user behavior. Tracking the duration of use and navigation through the website, for example, is permitted. What is not permitted, for example, is mouse movement or eye tracking.
The analytics competitor etracker has already developed a solution for collecting cookie-less tracking data. They clearly state that tracking and cookie consent are two separate issues. Tracking can be justified if it is in the legitimate interest of the website operator. In this case, only consent to the use of cookies is required. However, an opt-out option for tracking must also be provided. There are therefore two options:
- Cookie-less by default. Even if the user rejects the use of cookies, a lot of data can still be collected, such as the device used, geolocation information down to city level, time spent on the website, etc.
- Tracking without consent. Here, “only the website data from web servers is used, as well as certain information that the web browser transmits to the web server to retrieve web pages” (etracker, further information here). The advantage of this is that, with the help of a time stamp, page views can be combined into customer journeys, even if the page views extend over a longer period of time.
Want to find out what this means for you and your company? We're happy to help! Feel free to email us at pole-position@drive.eu.
