Cologne District Court Rules Against the Use of Google Analytics
The Cologne District Court has ruled in a non-final judgment on March 23, 2023 (file no. 33 O 376/22) that the use of GoogleAnalytics on the telekom_de website is unlawful, as it violates Art. 44 ff. of the General Data Protection Regulation (GDPR)
According to the court, the transmission of IP addresses as well as browser and device information to Google LLC, the operator of analytics and marketing services based in the USA, is not covered by the Chapter V safeguards provided in the GDPR. IP addresses are considered personal data when they can be attributed to individuals by parties, as in this case with Telekom and Google.
The judgment clarifies that Standard Contractual Clauses (SCCs) alone are not sufficient to ensure an adequate level of data protection. Additional (supplementary) technical protection measures that can accompany SCCs and exclude unlawful access in third countries were not presented. Google does not offer such measures, as the processing objective of Google Analytics is for Google to receive the data in plain text.
Consent under Art. 49.1.a GDPR can only be relied upon if one is informed about the recipients and circumstances. “Explicit” is a particular standard and requires a special level of information. The burden of proof lies with the defendant according to Art. 5.1 and Art. 7 GDPR.