According to German law (TMG 15 passage 3) however, user data may only be collected for advertising and marketing research, if a) made anonymous and b) the user is informed about his/her data being used and is given the chance to opt out.
The independent center for data protection Schleswig-Holstein has now send a letter to Google and Google Analytics using websites, asking for clarification (Track URL (german)).
The following question were sent to Google:
- Who in Schleswig-Holstein is a registered Google Analytics user?
- Please provide the terms of the contract for using Google Analytics.
- Are you willing to delete the datasets in question, if found, that they were submitted via websites in breach with the TMG law?
- Can Google Analytics cookies be synchronized with other Google services (for identifying purposes)? If not, why not?
- How does Google make sure, that data acquired through Google Analytics stays anonymous?
- For which purposes does Google use data acquired by Google Analytics?
- After which time, will collected data be deleted?
- Are you willing to implement (and if so, till when) a technical opt out solution according to TMG 15 passage 3?
The following questions were sent to webmasters, using Google Analytics:
- Please state the terms of contract for using Google Analytics.
- Please state your knowledge about triggering a data transfer in a foreign country and how that data is processed there.
- Are you willing to stop using Google Analytics, if found that the use of this tool is illegitimate according to privacy laws?
- Are you using any other tools to analyzer web traffic? If so, which?
- Please present the certificate of you privacy protection officer according to 4f BDSG.