{"id":8687,"date":"2023-06-06T13:14:27","date_gmt":"2023-06-06T13:14:27","guid":{"rendered":"https:\/\/dpoassociates.eu\/new-gdpr-proof-alternatives-to-google-analytics-and-cookies-part-1\/"},"modified":"2024-07-05T08:15:31","modified_gmt":"2024-07-05T08:15:31","slug":"new-gdpr-proof-alternatives-to-google-analytics-and-cookies-part-1","status":"publish","type":"post","link":"https:\/\/dpoassociates.eu\/en\/new-gdpr-proof-alternatives-to-google-analytics-and-cookies-part-1\/","title":{"rendered":"New GDPR-proof alternatives to Google Analytics and cookies: Part 1"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Are there any alternatives to Google Analytics? <\/em><\/p>

The use of Google Analytics (hereafter GA) has been restricted by national data protection authorities in an increasing number of European countries for several years. <\/em><\/p>\n

Austria, France and most recently Italy have caused quite a stir. It is not yet certain whether Google Analytics will also be banned in Belgium, although it is very likely that it will.  <\/em><\/p>\n

On July 1, 2023, Google itself will pull the plug on Universal Analytics and Analytics 4 will definitely take over the torch.  Analytics 4 is an attempt by Google to be GDPR-compliant after all. The question, however, is whether Analytics 4 will be effective in doing so.<\/span> <\/span><\/em><\/p>\n

But why is GA being banned? <\/span><\/em><\/h5>\n

Part 1 of this blog will discuss the issues surrounding GA and the GDPR. In part 2 of the blog, we will show you how to prepare for a possible ban of GA in Belgium. We figured out for you which affordable and GDPR-compliant analytics services are good alternatives to GA.<\/span> <\/span><\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What's the issue with Google Analytics? <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We have seen articles appearing for<\/strong> months claiming that GA goes against the provisions of the GDPR,<\/strong> but why is this the case? <\/span> <\/span><\/p>\n

It is important to note that when using GA,<\/strong> personal data is transferred to the United States.<\/strong> The data sent includes: IP addresses, browser data and user identification data. <\/strong> <\/span> <\/span><\/strong><\/p>\n

Until a few years ago<\/strong>, there was a U.S.-European treaty available, the so called ” Privacy Shield,”<\/strong> which regulated data transfers to the U.S.<\/span> <\/span><\/p>\n

This treaty was declared invalid<\/strong> in the famous SchremsII ruling of July 16,<\/strong> 2020. To notice the loss of the Privacy Shield<\/strong>, Google<\/strong> has begun working with Standard Contractual Clauses (SCCs)<\/strong>. These are clauses<\/strong> that can be used on a voluntary basis to demonstrate compliance with data protection requirements.<\/strong><\/span> <\/strong><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Privacy Commission<\/span> (“<\/span>Datenschutzbeh\u00f6rde<\/span>” or “DSB”)<\/span><\/strong><\/h5>\n

The Austrian Privacy Commission (“Datenschutzbeh\u00f6rde” or “DSB”) is the first national data protection authority<\/strong> to rule against<\/strong> Google Analytics<\/strong> ‘ practices . This ruling<\/strong> followed the 101 complaints by the organization Noyb (NOT Your Business)<\/strong> of Austrian Max Schrems, against the website<\/span>www.netdoktor.at<\/span><\/a> <\/span><\/p>\n

<\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
DBS: Google’s SCCs insufficient for GDPR compliance<\/strong><\/h5>\n

This is because of the following reasons: <\/span> <\/span><\/p>\n

    \n
  1. Since Google is a “provider of electronic communication services,” it is subject to US law 50 US Code \u00a7 1881 (b) (4). Under these regulations, the U.S. intelligence community can require Google to give them access to Google’s data.<\/span> <\/span><\/li>\n
  2. The measures taken in addition to the SCCs are not sufficient to protect personal data as no possibility is foreseen to exclude monitoring and access to personal data by U.S. intelligence agencies <\/span> <\/span><\/li>\n<\/ol>\n

    <\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    In addition, the DBS<\/strong> alsodetermined that GA , due to a technical error<\/strong>, had the<\/span>IP address<\/span><\/strong>of visitors was<\/strong> not anonymized.<\/span><\/span><\/p>\n

    Even without the<\/span>them<\/span> technical error<\/strong>, the DBS<\/strong> felt that GA was not adequately protecting personal data.<\/strong> The DBS<\/span> highlights<\/span> that <\/span>in<\/span> the<\/span> privacy measures <\/span><\/strong>that Google<\/strong><\/span> affects,<\/strong> such as the <\/span>anonymize<\/span> of the IP<\/span>address<\/span><\/strong>,<\/strong> still talk about <\/span>the processing of <\/strong> <\/span>personal data<\/span><\/strong>.<\/strong><\/span> <\/span><\/p><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Indeed, there is still the possibility<\/strong> that the remaining data <\/strong> could be combined<\/span>with<\/strong> a<\/span> unique profile<\/strong>. This combination<\/strong> makes it easy to trace the data back to<\/strong> a <\/span>naturally identifiable individual. <\/strong> <\/span> <\/span><\/p>\n

    This is certainly the case<\/strong> when one considers the sea <\/strong> of<\/span>data<\/span><\/strong>Google possesses when the user, while surfing <\/strong> the<\/span>Internet<\/span><\/strong>is logged in with a Google account<\/strong>.<\/span><\/span> <\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    In summary, we can identify the following problems with GA:<\/strong><\/h5>\n