Italy is the latest country to warn over the use of Google Analytics, when collecting personal data on website/app visitors and users.
Google Analytics can be configured to collect both personalised and anonymous data. When collecting personal data, this is subject to the UK GDPR in the UK (and the GDPR in the EU). The key issue is the transfer of this data to the US for processing, where the core of the Google Analytics platform is based. The US does not have sufficient safeguarding laws in place to protect the transfer, storage, and processing of this data under the GDPR.
This latest finding by the Italian data protection authority (Garante) follows similar complaints and warnings from France in February and Austria in January. The Garante found that use of Google Analytics resulted in the collection of many types of user data, including device IP address, browser information, OS, screen resolution, language selection, etc – which were transferred to the US without adequate supplementary measures being applied to raise the level of protection to the necessary legal standard.
Italy’s DPA has given the publisher of the particular website in this case 90 days to fix the compliance violation. The decision has a wider significance, in that other national websites that use Google Analytics should take note and check their own compliance, writing in a press release the Garante said:
“The Authority draws the attention of all Italian managers of websites, public and private, to the illegality of transfers made to the United States through GA [Google Analytics], also in consideration of the numerous reports and questions that are being received by the Office, and invites all data controllers to verify the compliance of the methods of use of cookies and other tracking tools used on its websites, with particular attention to Google Analytics and other similar services, with the legislation on the protection of personal data.” (translated from Italian).
Google has a detailed explanation of the privacy controls available in Google Analytics here.