Achtung! Google Analytics is illegal, say German government officials

Next Story

YC-Funded WakeMate Helps You Kiss Groggy Mornings Goodbye

[Germany] Several federal and regional government officials in Germany are trying to put a ban on Google Analytics, the search giant’s free software product that allows website owners and publishers to get detailed statistics about the number, whereabouts and search behavior of their visitors (and much more).

According to an article in today’s Zeit Online (poor Google translation here), multiple federal and state government officials charged with guarding over national data protection are convinced that Google Analytics is against the law in Germany and are mulling imposing fines on companies who use the service to gather detailed stats based on their website visitors’ usage patterns without the explicit consent of those visitors.

Still according to the Zeit Online article, an approximate 13% of German website publishers (meaning those with sites that have .de as their TLD) currently use Google Analytics, including several websites of leading media organizations, political parties and pharmaceutical companies. The government officials are particularly wary about the information Google is able to collect on websites of health insurance companies and the like, saying Google could conceivably create profiles of people that would include information about their interests, lifestyles, consumption patterns, political and sexual preferences.

This isn’t the first time German privacy protection officials have voiced their concerns about the Google Analytics service, as it had earlier criticized the search giant over keeping everyone ‘in the dark’ about which information they’re collecting exactly and how much identifiable data is sent to and stored on servers located on U.S. soil. German laws prohibit such data to leave the country, they claim.

Google Germany’s Per Meyerdierks, however, says the company is well within its rights to process user data in the United States because it respects the Safe Harbour treaty between the EU and the USA. He argues that an opt-out would be entirely unnecessary, and that users always have the option to refuse cookies anyway.

One German lawyer that gets cited in the article says the penalties could amount up to €50,000 (about $75,000) per website that uses Google Analytics to keep track of its visitors’ usage patterns.

  • Sam

    I don’t believe it.

    • morgen

      In Shermany we take ze privacy of ze peeple wery seriously. Only ze government has ze right to spy on ze peeple. Zat’s why ze government released a trojan to protect oll ze computers in Shermany.

      • marc b

        I get it, because all you know about Germany is some infantile propaganda that was passed on to you by ignorant people and hollywood scripted games, you are using a derogatory, mocking tone to show your ignorance. Classy!

        So, that this post brings up a valide point regarding digital privacy and identity is irrelevant to you and your fellow curmudgeons, right?

        Would you also be so mocking if Wal-Mart decided that they would implant a recording and tracking device in the products they sell without your expressed permission? Then they could listen in on your conversations at home, see how and where you use the product you purchased, know when you enter their, or your competitors’ store when you wear the clothes with the attached tracking device, etc. Wouldn’t that be great?

      • Mark C

        Of course Germany is also known for it’s terrific sense of humour.

      • debouchage canalisation 75

        Tell your browser to delete the cookies (FF: “Private Data”, in Settings: check “Cookies” ) when you close it.

      • wedding stationery

        What’s browser cookies gotta do with the German sense of humour?

      • Arting
      • Fgtr

        Thanks for sharing. i really appreciate it that you shared with us such a informative post..

        Facebook Followers

      • mobil apps

        What’s browser cookies gotta do with the German sense of humour?

    • Devon

      This is great news for startups of all other countries. Bye German competition! Have fun not knowing what your traffic is doing? (German govt should take note…)

      • GoogleAnalytics alternatives

        Sorry, that’s BS.

        Although it might be the case in a few years, the World does not yet depend 100% on Google.

        There are countless alternatives to GoogleAnalytics:

      • Who's tracking you

        Want to know who’s tracking you using GoogleAnalytics?

        Firefox has an add-on:

        -> Tell your browser to delete the cookies (FF: “Private Data”, in Settings: check “Cookies” ) when you close it.

      • PS: Attention - "SuperCookies"

        You should also delete “SuperCookies” (based on Flash).

        This add-on can do that:

      • James

        That’s rather noob isn’t it?

        I built my own… Analytics doesn’t tell you what you need to know. In any event Piwik is an alternative for many.

      • Aria

        This is just older.
        There are many other alternatives to get off from Google Analytics.
        That’s boarig.. :(

        Aria Kerry.
        Professional Design Expert.
        website design
        web design

      • hundetraining
  • Achtung! Google Ana­lyt­ics is ille­gal, say Ger­man gov­ern­ment officials | Legal Technology Today

    […] via Achtung! Google Ana­lyt­ics is ille­gal, say Ger­man gov­ern­ment offi­cials. […]

  • mdmadph

    They do know that the only data that Analytics collects is data that the user is freely giving, right?

    • Jamie Thomson

      Maybe. But does the user know that?

      When I say “user” I mean mom and pop, not your average techie.

      • mdmadph

        Ignorance is no defense in the legal world, I think. ;)

      • Omer

        Yeah, but in Germany, the Government uses to protect peoples from their ignorance, I’m not just sure they know what Google analytics is exactly and how it works, I’m having the feeling like, the german Government has a very big concern seeing Google collect datas at all stages of the web, without knowing exactly what is done from those datas.

        (beta comment)

      • John something

        and yet the ignorant sometimes need protection, which is why we have all those warning signs abuot improper use on microwaves and plastic bags over here.

        Is all the “Angst” justified? Dunno, but I find this paranoia easier to accept than the Canadian government planning to allow the music industry to break into your computer on suspicion of copyright infringement. Sounds like ze Germans would not be too keen on that sort of thing.

      • Christian Owens

        True, ignorance is no excuse. And while we’re on the topic, I’m the prime minster on Nigeria and would love to organize a business deal with you for the sum of $43,000,000. (for the low, low, single transaction fee of $65).


      • marc b

        Ignorance may not be a defense, but ignorance that would cause morally culpability would require active disregard. How much can a person reasonably be aware of, especially when the laws, rules, regulations, guidlines, terms, etc. one expects others to be aware of are written in incomprehensible lawyer-ese, hidden away where no one will see it or notice the tiny little link that takes you there even if you wanted to attempt to read the terms, and other traps that are sprung on consumers who are reasonably trying to be knowledgeable and informed?

        The problem with people who spout the “ignorance is no defense before the law” lazy kind of syllogism are going to be, either on the doling end of the law, or not affected by it. It’s plain and simply a lazy and selfish postition to hold, à la, ‘as long as they don’t come for me I don’t care’.

    • Bernie

      well, that’s not entirely true. German law distinguishes between “personenbezogenen Daten” (personal data, e.g. your name) and “personenbeziehbaren Daten” (“personal obtainable” data, i.e. data which could be used to obtain personal data).

      It is debatable under German law right now if your IP address falls into the latter category. If yes, Google Analytics will technically be illegal in Germany.

      • scott

        So, is ‘tail -f /var/log/apache/access_log’ illegal in Germany too?


      • Bernie

        Let me correct myself. I mixed something up. Storing IP addresses in combination with other data (let’s say your email address) is not really allowed unless the user gives you an opt-in.

        The problem is that Google Analytics transmits and stores your IP address on their US-based servers and that it’s not clear what is happening to this data. And this is what contradicts the German privacy protection laws, I guess.

      • Paolo

        Obviously tailing a file is not illegal, but the access_log itself may be illegal if you put too much information in it. See this article about a sentence of a court in Germany on the subject

      • webalytics

        Well, I think there are two things that have not been taken into account by the German authority:

        1. Google does NOT provide any report containing data about IP addresses

        2. Google deletes all collected IP addresses after a certain amount of time (ie 30-60 days)

        Since we are one of the few Google Analytics Authorized Consultants in Germany we cannot aggree to that kind of paranoia. There are much more severe malicious activities caused by malware and spyware than to blame Google for collecting data and providing website owners with useful insight information.
        But IF this is really an issue, everybody’s free to buy Urchin Software which is completely self contained and will store data only inhouse.


      • Mary

        If that’s true..then would that not render most US or other country based services (like Facebook and other applications that track your ip address) illegal as well?

  • Garry Przyklenk

    It must be all that personally identifiable information Google stores in Google Analytics… oh wait, it DOESN’T do that…

    I’d be more concerned about the information Google collects from search behavior, but it still doesn’t differ that widely from information any other ad network collects.

    Get a grip people. Freedom ain’t free, and the internet isn’t anonymous.

    • Richard John

      Can you be sure about that? Yes, it doesn’t SHOW personally identifiable information, but they may still store it.
      It’s quite plausible that they’d store IP addresses and Google Accounts.

      • Christian

        So what? That’s how “the internet” works. If you’re going online, you should be aware that your “ip address” is tracked by a all websites you’re visiting (and some additional companies like Google Analytics, Advertising Companies etc).

        If someone is afraid about this, he shouldn’t go online, or, if anyone is that paranoid, switch off cookies and redial/reconnect to the internet after each website visit (hoping he gets a new dynamic ip). ;-)

        Nobody, and especially the government, should ask german website owners to remove third party stuff (widgets, analytics, etc), just because the ip is transferred outside of Germany.

        Oh, sorry, I forgot that it’s not prohibted. It’s “only” necessary to ask the user for permission before anything like that is done (like via popup). And, it’s not sufficient to write this in your terms of use. The visitor has to explicitly opt-in for this.

      • Paolo

        Agreed, that should be taught in schools.
        I adblock analytics, another thing to teach kids to do.

      • Nick

        If this is the case, and since all internet protocols send source IP along (if they expect a reply), then the only legal and compliant thing to do is to shut down the internet at the German border, otherwise IP end up at the foreign server.

  • Mike Skel

    Very interesting! It is very interesting development. I will be very curious how Google reacts and what other repercussions take place!

    • Casino Games

      you must do think now Google research factor of them new invention…….

  • Jeff

    Maybe the German government should look into what Google can collect and what they can not collect via web analytics before they come to the conclusion that Google could be building profiles of users based on the analytic data.

    • custom shower enclosures

      I think they are way too paranoid and anxious about google analytics

  • keith roberts (@MadKeet)

    MMM seems like a good way to track Paedophiles to me…….. whats the problem, Guilty concious ?

  • David

    Fair points around privacy this is something that should always be discussed no matter what the solution is.

    Do they plan on issuing fines if you use Google Analytics?

    Its a simple option to just exclude all German visitors traffic by using Google Analytics filters if they are serious about that fine…

    • lacoste polo shirts

      users always have the option to refuse cookies anyway

      • big pony polo shirts

        i like Google Analytics,great app

    • lacoste sale

      If this is the case, and since all internet protocols send source IP
      along (if they expect a reply), then the only legal and compliant thing
      to do is to shut down the internet at the German border, otherwise IP
      end up at the foreign server.

      • Counselling London

        This is very intriguing”This isn’t the first time German privacy protection officials have voiced their concerns about the Google Analytics service, as it had earlier criticized the search giant over keeping everyone ‘in the dark’ about which information they’re collecting exactly and how much identifiable data is sent to and stored on servers located on U.S. soil. German laws prohibit such data to leave the country, they claim. I hope the government intervenes. Counselling London

  • Robert Oschler

    This is ridiculous. Google Analytics is based on the web site access log file. Every web server out there is running server software that collects that information. The German government is about to ban the entire web.

    • Robert Oschler

      I should be more exact and say that Google Analytics, at least the majority of the information it collects, is the same information that all web servers collect.

  • Michael Notté

    How Google could build personal profiles based on GA data?

    Most of the data that is collected does not contain personal identifiable information – these are clickstream data. Of course some website owners can implement GA to track user-related data but then it is the responsibility of the company – not from Google.

    It is true that Google collects a LOT of information and that it allows Google to have a good understanding of general behavior, trends,…

    (see one of my post:

    But they don’t make user-level profiling (or am I naive?).

    As someone commented, then they should ban Google search as well.

    And Google Toolbar. And Google Mail. And….
    Hey maybe they should just ban the Internet ;-)

    Agree it also shows a lack of knowledge & understanding (on Web analytics in general).


    • Tim

      In adition to this it is impossible to track individual visitors. In fact, you may not add any personally identifiable information to your GA tracking.

      Compare this to a few paid packages out there and you’ll notice that they do allow this and in fact go very far.

      One package allows you to select all e-mail addresses from users that abandoned their cart at step X so that you can e-mail them.

      I seriously doubt that any of the people involved have even used GA…

  • Joe Morrissey

    Isn’t this the entire point of safe harbour, binding contracts etc was about – but it seems kneejerk – agree with previous posts – they need to quantify what could be assembled as user defining data.

  • Kevin Pike


    Understanding how the interwebs works is not important. When it come to technology the proper response is to think with your gut – not your brain!

    If you don’t believe me just ask great men like Rupert Murdoch or Ted Stevens.

    Screw reality. I think Germany is just taking a page from these great technological guts.

    • Kushal


    • GoogleAnalytics alternatives

      Wrong. You DO HAVE to think.

      And if you do so, you’ll see that Germany is rightfully concerned.

      Btw.: You only need to log into a Google service once and all the (GA-equipped) sites you’ll visit from that moment on can be linked to your Google account.

      => A nice & complete personal profile of yours.

    • C Hirlemann

      Hi All,

      There seem to be a lot of comments here from people who think that Google knowing a lot about you is a bad thing.

      We are all currently bombarded with well over 2000 adverts and marketing messages everyday with a tiny fraction of these being relevant or even remotely interesting. I must at this point admit I am a marketer so am bias, but what Google is trying to do is understand the needs of individuals and so that busineses can cater for those needs. In the long term it will be a benefit for consumers.

      A very good point made in the comments is that those that do not want any of this can simply turn off cookies and not sign up for the free applications and services that Google offer. Nobody is forced to have any of these.

      And, just a last comment re the suggestion that people should just go with their gut instinct… Gut instinct will only work for the very few and they will usually have built up years of experience that most will only be able to aspire to (that is how they got to the top! along with knowing the right people and being in the right place at the right time).

      Good decisions are always INFORMED decisions, if a decision is not informed then it is a guess. I do not think that Rupert Murdoch guesses much, he will make decisions based on his years of experience in media. Marketing can be the difference between a good year and a poor year, and as many people will know a poor year can mean redundancies and companies going bust!

      Currently the data collected cannot be linked to a physical individual (only the IP address could be considered as doing this). If data starts collecting personal information (such as name, address) rather than demographic data then I will expect opt in schemes.

      Untill then I will continue to gather as much information (legally) as I can about the people that interact with my site and there needs with the aim to serve these needs in the best possible way.

    • St. James

      Haha, definitely +1 to Kevin Pike. My sentiments exactly regarding Murdoch and Stevens.

      Honestly, this is so ridiculous it shouldn’t bear commenting. Yes, the web has serious privacy concerns, but there are far more pressing things out there besides Analytics. WTH the recording industry.

      So turn your cookies off. Not too tough.

  • UncleMatt

    How is this different than surveillance cameras in a retail store, or airport or, (I’m sure) a government building in Germany? I guess they’re claiming that the problem is the data is then exported. But the point being, a user is willingly (virtually) entering a domain. The server belongs to the host… they can monitor the happenings on that server in their best interests. Within reason, of course.

    • UncleMatt

      Also… Google is not the only analytics player in the game. Serious retailers will use a commercial vendor like Omniture (now Adobe) or Coremetrics. Why all the GOOG hate?

      • Reinier

        “Google Inc. is expressly acknowledges, in its regulations to be accepted when using the right one, beyond the individual user by means of a unique identifier data obtained with other previously stored data “associate something like Gmail” and to share this information with third parties. ”

        This is something that Omniture doesn’t do. Your data is kept privately.

  • Holger

    Let’s not forget that this is “Die Zeit” reporting… not exactly known to be the most IT savvy publication out there. Who knows what they actually asked…
    The assumption that “data is being exported” is wrong, anyway. It would be correct if the data was collected on the site first and then sent to the US, but the way it works, the browser connects to the US and that’s how data is collected. If that was illegal, Germans wouldn’t even be able to connect to any website outside Germany.

  • John Fernandez

    EU Governments, in general, have been astonishingly paranoid at web technologies and PII. While they are right in being concerned, the heavy-handed ways they are going about it are only going to stifle things in the EU-Zone.

  • Silly Billy

    I guess GA noticed that Germany started to build tanks…again… :)

  • Ron

    While the measure might seem drastic, I actually think this scrutiny makes sense. Google DOES collect all this information, and there is NO WAY to guarantee this information won’t be misused by personalizing by linking it to personalized services (e.g. Google Mail, AdWords or Checkout). And Google WILL misuse this information, if it’s in Google’s commercial interest. Just wait a few years…

    On my web sites, I would actually never ever use Google analytics.


  • Jason Carrasco

    Just out of curiosity, what about other analytic programs i.e. Omniture or Coremetrics. I don’t know German law but i would imagine that if one analytic program such as Google analytics is illegal then the more advanced ones like what i mentioned above would be considered illegal too. Just a thought, it seems more like a witch hunt than anything else…..

    • David

      What we can say is that Google is a special case, because they are building huge monopolies or otherwise dominate the Web like no other company in the World.

  • phew

    hmm so finally its getting noticed by all…

  • Ich bin ein Googler!

    […] he was a Berlin citizen or a donut but that’s for another blog. Today though we learn from TechCrunch Europe that Eric Schmidt from Google may need to head to Deutschland to proclaim that he is one of the […]

  • Paul G

    Oh bother. My wife and I are in the UK but have a couple of domains on a host that is located in Germany. We also use GA.

    Are we about to be clobbered by this nonsense or is it just German residents?

  • Whatever

    Silly Germans. Can’t they do anything right when it cones to the public? They either want a police state or a nanny state. Pffft.

    • air jordan sneaker

      get google,together with them

  • Web Analytics Facts » Google Analytics illegal in Germany?!

    […] Are you joking? No, read this article on Techcrunch. […]

  • Tom

    Get google, fb and the fbi in a room together and they could patch out in 15 minutes a pretty comprehensive life story for anyone 30 years of age and younger in the U.S.

  • ryanve

    I agree this is wacked. Google Analytics doesn’t really give you any private (personal) information about visitors. It doesn’t give out IP addresses either (that might be against some laws).

blog comments powered by Disqus