Germany Considers Google Analytics Ban

Tweet

German Analytics banGoogle Analytics, the world’s most popular website statistical analysis system, could be illegal in Germany. Government officials responsible for national data protection are attempting to ban Analytics on the grounds that it breaches privacy laws.

Collating detailed web statistics used to be a time-consuming task. Site owners either resorted to rudimentary page counters or web server log analyzers such as AWstats or WebTrends. Although these provide valuable data, the information is generally better suited for systems administrators rather than Internet marketers.

Google acquired Analytics from Urchin Software in April 2005. Although it was originally a commercial package, Google re-branded the system and permitted unlimited free use from 2006. Rather than analyzing log files, Analytics uses a JavaScript snippet which is placed on every page of a website. The code collects visitor data and sends it to Google’s servers for processing.

The real power of Analytics is evident in the reports. Data is normally processed within hours of collation and the system offers a huge range of analysis tools. The dashboards and attractive charts are a dream for marketers and statisticians. Today, it’s tough to find a major site that does not use Google Analytics, including an estimated 13% of German publishers.

The success of Google Analytics causes concern for German privacy protection officials. Conceivably, Google would be able to track an individual’s movements throughout the web and collate information from websites that hold personal data, such as banks and insurance companies. In theory, Google could create profiles that include information about a person’s interests, career, lifestyle, wealth, health, political and sexual preferences. If that individual has a Google account, the company could match a profile against a known user.

The German authorities are also concerned data is moved away from the country and stored on US servers. Privacy protection laws are different in the US and, potentially, Google could move information to countries where such laws are non-existent.

There’s no evidence Google is profiling users in this way, but the company is secretive about how data is collated, processed and used. A Google spokesman argued that users could opt-out of data collection by disabling JavaScript or refusing cookies.

Unfortunately, German lawyers are already drooling at the prospect of anti-privacy cases. One claimed that German websites using Google Analytics could be fined up to US$75,000.

Do you use Analytics on your websites? Are you concerned about potential privacy breaches? Or is the system so useful that privacy no longer matters?

Free book: Jump Start HTML5 Basics

Grab a free copy of one our latest ebooks! Packed with hints and tips on HTML5's most powerful new features.

  • Sebastian Hoitz

    So it really is about Google and not Analytics. :(

  • http://www.50000steps.co.uk sfrost2004

    I’m not particularly keen on being tracked or analysed (even if the data is anonymised), so I always browse with JS disabled – which blocks Analytics.

    It seems that Germany is taking a national approach to dealing with a global product.

    The more interesting story, which is only touched upon here, is how much information Google collates about its users, which, as the article notes, Google is rather reluctant to talk about.

    The idea that “privacy no longer matters” is absolute rubbish, however – it has never been acceptable (or even legal) to take that position offline and so it should be online, though analytics packages could be argued to be exempt so long as the data they collect is anonymous and can’t be connected to an actual person.

  • http://www.optimalworks.net/ Craig Buckler

    @sfrost2004
    Privacy matters of course, but would site owners reject Analytics for that reason? Many marketers would sell a kidney to discover your inside leg measurement!

  • http://www.50000steps.co.uk sfrost2004

    Probably not, unless there was a public uproar.

    My point was that analytics software generally doesn’t track “personally identifiable” information, so Germany may be taking the privacy argument a step too far.

    That said, online privacy is something which is far too easily abused/breached.

    So, Germany has a point when it comes to protecting privacy online, but I don’t think they should be focusing on Analytics, because analytics should only be collecting anonymous (or anonymised) information.

  • http://www.eBizIndia.com eBizIndia

    As long as Google is transparent about not linking the surfing pattern to an individual and just working with anonymous data (which unfortunately they are not), it should be fine.

    Otherwise, why bother about Google Analytics. All web servers keep a detailed log of your access of their web pages and you would be better off not accessing any web sites that are hosted outside of Germany.

    To avoid being tagged to the data, one might avoid being signed on to Google while surfing and may be avoid Google Toolbar also. That makes the tracking much more difficult.

    Arun

  • just_passing_by

    @Craig
    Ah well, as long as it isn’t theirs, I suppose. They’ve only got two.
    Anyway, would you have your measurements taken in exchange for a kidney?

    I think that by and large google stinks. I don’t trust them. I use noscript especially to prevent google analytics from sniffing on me.

  • Phweeee

    “There’s no evidence Google is profiling users in this way” – so you’re saying they haven’t actually done anything wrong?
    I’m as concerned about my own personal privacy as everyone else, but to ban something purely because it gives people the potential to commit a crime seems ludicruous. You may as well ban all candlesticks, lead piping, spanners and bits of rope while you’re at it.

  • NetNerd85

    “Google Analytics, the world’s most popular website statistical analysis system”, says who?

  • http://www.web-development-blog.com olaf2

    When is your website a German website?
    If the siteowner is German resident?
    If the site and domain is hosted in Germany?

    Sounds like the next wave where German lawyers sue website owners because they just have an ordinary website…

  • http://www.appropriatesolutions.co.uk AppSol

    @olaf2 Good point. Sounds like a bonus time for Austrian hosting companies – Google ‘sees’ your server as German, but you don’t get sued for tracking.

  • Arkh

    Country-wide ban is a bad thing.
    But opening the eyes of people about analytics and its friends is a good thing.

    If a company track their own user browsing on their own website, no problem. Having some companies saving these infos on a multitude of other companies website is a problem.
    Long live noscript !

  • Lorenzo

    I must admit that this does freak me out a bit. My first thought when I saw Google Analytics for the first time was, “Wow! Is this ever cool!” My second tbought was, “Woah… this gives Google some serious power…”

    I do agree with olaf2 though. The biggest problem we’re going to see here is some average everday German Website owners having their lives ruined by some money hungry lawyers.

  • SpacePhoenix

    I just added

    |http://www.google-analytics.com/*

    to my filters (stuff to block) list in AdBlockPlus, problem solved, simples

  • http://www.mortier.ca/ Ryan Mortier

    Kind of picking up on what olaf2 said, what is stopping German residents from purchasing hosting outside Germany?

  • Thomas Kahl

    I’m no friend of too much government regulation. But as a german, i feel good that there is someone who has an eye on this. With GA Google found the key to follow users from site to site, which should normally be not possible. Nobody knows, what they do with this information.

    In Germany, we have quite strict laws about what is allowed and what not concerning storing data. This might be different in other countries and there are countries where there are no regulations about this. If Google stores the data in these countries, nearly everything you can imagine (and even more) can be done with that.

    And, yes – we use GA on our own and for our customers…

  • Pacoup

    Wow, yet another country being just plain stupid. Let’s go be like China and firewall everything!

    Really, Google’s whole market depends on people trusting them. Would they really do something that would break this trust? No, because it’s a business. They go for the money, like every single business out there, and breaking privacy is not a way for Google to make money.

    I don’t know but, in Germany’s arguments, we shouldn’t be allowed to have servers know what IP is requesting what, almost.

    It’s crazy, I’ll keep using Google Analytics on my web site and the German government can go screw itself.

  • http://www.web-development-blog.com olaf2

    @AppSol, @SpacePhoenix, I don’t think that only some hosting outside the Germany will not help. If you’re a UK website owner and you server is hosted in Germany by 1&1 for example, I think they can’t sue you.

    But what if you have a German language website because yuu like to sell stuff in Germany?

    I have an interesting example, I maintain a website for a dutch company with also a branch in Germany. The German part looks like a “real” German website, while the site is hosted and owned by a dutch company. I think the risk is because the domain and company address is a German one.

    Having a website or shop was already a risk and it looks like Germany becomes a kind of “China” in Europe.

  • http://www.optimalworks.net/ Craig Buckler

    @Pacoup
    Perhaps Germany is being overly cautious, but that’s not necessarily “stupid”.

    In some ways, your argument contradicts itself. Google may depend on trust but – as you say – they are a business. They have data that could be used to track and profile individuals from site to site … it’s worth millions. The fact that they don’t sell it, doesn’t prevent them from doing so in the future.

    Also, what if the data fell into another’s hands? Are you certain that Google’s security measures are effective?

  • http://www.wifigator.com/ lorenw

    I get the impression that Google is a target in this. What exactly do they want to make illegal, logging IP or the time of day someone visited or what keywords were used as well as user agent?

    I wrote a tracking script that logs everything, keywords, host. user agent, the country and state right down to screen resolution.

    It’s simple because php.net gives you these resources.

    Is Gemany concerned about the data gathered or the fact that it is on one server?

    Google is not the only stat service but they are the biggest.

    The Big question in legal terms is where collecting data becomes illegal. Let’s say I have four websites and log everything I can so I can see how many people visit my sites and click through from one to the other. This is marketing in my opinion just like television ratings. Such and such show has 2 million viewers, am I to get upset because the ratings guys know that I am watching the show (or not watching)?

    I’m not backing or defending Google but at what point and how do you draw the line between legal and ilegal?

    Awstats collects all of the same info but they are not targeted. Why?

    Just my 2c

  • http://www.optimalworks.net/ Craig Buckler

    @lorenw
    The danger is that Google could use Analytics data to build a profile of an individual. It goes far further than logging the IP and date.

    Many people have a Google account for GMail or another service. Google could associate a user with the sites they visit and deduce their net worth, family, health, interests, political and sexual preferences.

    It’s powerful information. At a basic level, it would allow Google to show you appropriate car insurance adverts before your renewal notice arrives. At worst, Google could sell your information; you could be refused health insurance because you’d been looking at critical-illness websites.

    I’m not saying Google would ever use such underhand business practices, but have they said they won’t?! And who knows how secure their data centers are?

  • Mike

    On the other hand they send all kind of data to the US for no reason…

  • http://www.tyssendesign.com.au Tyssen

    Unfortunately, German lawyers are already drooling at the prospect of anti-privacy cases.

    This is what it boils down to for me. Sounds like the main protagonists in this issue aren’t concerned about privacy or about Google being too powerful, but instead with lining their own pockets. :|

  • http://brianswebdesign.com skunkbad

    It wouldn’t necessarily just be Google that can track users, but it is because they are as big as they are that makes the difference. Personally, I use Statcounter, because it meets my needs, and I like the way it displays data for me to analyze. Even Statcounter could be tracking people, but who cares? So they know what browser I use, or maybe they know my IP address. So what?

  • alex

    You can’t ban Analytics without banning Google as whole as Analytics is used everywhere by Google. In Germany there are many paranoid people who just hate big corporations. If you don’t like to be tracked by Google you can ban data from certain domains. So it’s an issues of every individual and not of the state. Germany criticizes China for its firewall… but is not better at all.

  • http://www.wifigator.com/ lorenw

    @Craig Buckler

    I was just making the point of what other services would be banned. I can’t see a law that only targets Google. There would need to be criteria. Yahoo has webmail and a search engine, What would happen if they added analytics?

    Would the law read that you can’t have email services and a search engine and analytics all at one company?

    The law would be for Germany so will this ban G analytics for German sites only? What if someone visited my site and it had analytics?

    The point I am making is that to write the law and not have gaping grey areas would be impossible. Lawyers will have a field day with the grey areas though.

  • http://www.mikehealy.com.au cranial-bore

    lorenw – the difference is that Google in many cases could relate that IP/cookie/user agent information to a real person. Because many people have Google accounts Google could potentially relate an IP or cookie from a visit to an Analytics enabled site to that persons Google account (and in turn their name, email etc.)
    Analyics being a central service that many sites use also means that Google could potentially see broad patterns of unrelated sites that a given user visits.
    These are things you cannot do with PHP functions.

  • Just stopping by

    Are there Wal-Marts in Germany? If there are Wal-mart has an intelligence system that would probably rival Google. How about Windows OS, or any major global or multinational corporation has a data bank that they use. Mastercard and Visa or any bank now that is an interesting idea of giant databases on spending behavior, and all the info banks or other financial companies normally need.

    My point is the world is getting smaller and this is the hard part with the internet the rules get muddy. Also I do not know what is considered public information in Germany but there is a lot of information in the US that people think is private but it is public if you just have the time to walk to the court house or city clerk and ask.

    Also governments, are just businesses and really if they are going to ban one company from amassing large amounts of data, they may want to check their own databases and security procedures. Social security numbers and passports, that information is interconnected, at least in the US, with many other departments and institutions.

  • huit

    Google Analytics really isn’t much different than any other tracking system in the stats it provides. I would think that the issue would be more the fact that Google has the potential to connect data from sites that use Analytics with Google user profiles (Youtube/Gmail/etc). Especially when users remain logged into their Google accounts 24/7.

    Cookies and javascript can only provide so much information and are easy enough to counter.

    Conversely, even if Google or any other company/site is only collecting visiting IPs, there’s still potential to track users… albeit with much more footwork and legal implications involved. Google just has massive databases at hand… with even greater potential.

  • computerclub uhuscc

    thank you for this; but data collecting like this is even to have from each simple virus programm -,) http://www.uhus.cc

  • Anthony Calzadilla

    This is a very sensitive subject, and getting more and more serious daily. I wonder if this would start a trend with other countries banning goole’s analytics.

    Best Regards,
    anthony calzadilla

  • Paul Thomas

    What a joke. I know for a fact that government departments sell personal information to marketing companies. My wife got her learner drivers permit and three days later had a personal invitation to a sale at a major car dealer!

    How did that car dealer get our address? Funny thing is, I had been driving for 20 years at the time… why didn’t I get an invite?

    The information that is available to websites using GA is anonymous but does help the website owners get a higher page ranking and focus on what their prospects need.

    Everywhere we go we are tracked and monitored. If you use a credit card the card provider know exactly where you are, what you purchased and where you live! Don’t worry about Google :o)

  • jessica

    Collecting data is not an issue here. Google would not be the only one on that field. Its just that what they plan to do with data. If google guaranties individual’s privacy and exports only statistics that I guess it should be OK , right?
    and yes , I use it on my site Tower Defense

  • David Winch

    Haven’t these politicians and legislators got better things to devote time and money to? Like finding a cure for cancer?

    But maybe the legal fees aren’t as high in that case?

  • steve

    privacy protection is 1 thing but i hope they need evidence before they can decide to ban a service based on mere assumptions.
    if they’re so concerned about privacy why don’t they first sue facebook who openly disclose all your personal data to 3rd party companies without any consent as soon as 1 of your friends uses a facebook app!!! there’s NO PRIVACY on Facebook…

  • Rahul600018

    Google has been the best analytics for a noob like me till now. I started off blogging and moved on the build a website and realized analytics is highly essential.
    Then I found out about http://exactostats.com/ It has to be the best thing that happened after google analytics! I exactly know what my audience is doing on my website now, so optimization is completely easy.

  • jim

    If you think google analytics tracking is scary.. how about video playbacks of users on your website? This site is crazy. http://exactostats.com/

  • Anonymous

    “It seems Germany is taking a national approach
    to deal with a global product”

    So you mean multi-national companies suddenly are
    above all nation’s Laws.

    Sure we can surf without cookies and without javascript
    and so on. But that’s not practical. Try loggin in to Youtube without a Google-cookie! Google has too much power and too little control over that power. Individuals are forever screwed in 1984 Big Brother Stasi life if we dont stop Google now! While we can…
    The ONLY thing that we can do is use the Law.
    Google cannot be reasoned with.

    We cannot co-exist with Google-spyware.

    We cannot out-compete with Google (Even Microsoft’s deep pockets cant make a dent dispite they had 95% of the world locked in thier OS and WebBrowser)

    Google must be moved back by Law to at least the 2008 boarders.