The Norwegian Data Protection Bureau has declared that Google Analytics is not in accordance with the law. They justify themselves by referring to a 2008 European Directive that demonstrates once again the ignorance of Eurocrats — even though Norway is not a member state of the European Union. Google will have to deeply alter its popular product in the coming weeks if it wants to keep its doors open to Norwegian developers.
According to the European Parliament, IP addresses are personal data.
The objective of the proposal was to limit the collection of IP addresses by search engines in order to reduce targeted advertising. As Google and others use an ad tracking cookie, it was both a useless and naive Directive.
From time to time, European governments cite that Directive against a particular service or hypocritically ignore it to implement anti-piracy laws such as the HADOPI law in France.
According to Aftenposten and Digi.no, Google Analytics does not comply with that Directive because it is collecting IP addresses and web surfing habits — and it could use that data for its ad business.
In other words, Google cannot provide an analytics service in Norway because it is not a pure analytics company. But why isn’t Yahoo Web Analytics targeted by the Norwegian government as well?
Google will have to change two things in order to comply with the Norwegian law. First, it will have to clarify its terms of service and stop sharing Google Analytics data with other Google services. Second, it will have to anonymize collected data and IP addresses.
That last consequence is a major drawback for Google. One of the appeals of Analytics services is that you can view in which country your users are living and the pages each user has viewed. Competitors will gain an unfair advantage in Norway.
Update: Google has provided a comment in response to the story.
“Google Analytics fully complies with Norwegian and European data protection laws. Every day many Norwegian companies use Google Analytics to improve their online presence and make their websites better for the users.
“Google Analytics is designed to keep information safe. Webmasters using Google Analytics are in complete control over which data is sent to the service and how Google uses, and can use, the information received from their sites.
“We have offered to meet the Norwegian Data Protection Agency several times to answer to any questions on Google Analytics and we remain willing to do so.”