Anonymize Google Analytics means modifying the IP address of website visitors before sending tracking data to Google, so that search engines cannot directly map tracking data to an exact IP address.
Reasons for anonymization
Google Analytics raises serious concerns among data protection advocates. In general, it is assumed that too much data is collected with Google Analytics that can be clearly assigned to each user due to their IP address.
Since the ruling of the ECJ of November 24, 2011 (Az. C-70/10), which defines that IP addresses can be considered personal data because they allow to draw conclusions about the user, the anonymity of the IP addresses of the users has become the basic requirement for the use according to the legislation of the monitoring service.
Obligations of the web portal operator
To use Google Analytics in accordance with legal requirements, site operators must follow a series of steps:
- Contract: Experts assume that you have entered into a contract with Google for data processing on request according to § 11 BDSG. This must be signed in writing.
- IP address anonymization: If you want to anonymize Google Analytics, you must delete the last 8 bits (the last octet) of the IP addresses. For this, the Google Analytics code is expanded with the "AnonymizeIP" function.
- Opposition rights: Each user has the right to disagree with the use of their personal data. To this end, the site operator must provide a link to a deactivation plug-in that allows to avoid the acquisition of data by Google Analytics, and put the link in the privacy policy in a double-opt-out cookie, which excludes the tracker. .
- Privacy statement: Previously, Google provided a post that informed you about the use of Google Analytics and that it should be integrated into the Privacy Policy. Even though it is no longer offered by Google, it is still considered the standard.
- Old data: Existing old data was collected without anonymity, so it was illegal. If you want to be sure, you should, in principle, remove old profiles and resume evaluations from the anonymization date.
Alteration of the IP of the visitors
In order for the visitor's IP to be stored in Analytics only in masked form, the _anonymizeIp () function must be applied. The full (standard) embedding of the Google Analytics tracking code will look something like this:
For universal analytics:
<script>
(function(i,s,o,g,r,a,m)function()[]).push(arguments),i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
)(window,document,'script','//www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-XXXXXXX-X', 'website.de');
ga('set', 'anonymizeIp', true);
ga('send', 'pageview');
</script>
The data confirms that the tracking code for classic analytics looks like this:
<script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-XXXXXXX-YY']);
_gaq.push(['_gat._anonymizeIp']);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>
The old tracking method still allows the use of Google Analytics, but it is limited. Therefore, Google recommends the implementation of new codes.
Each extension with the extra anonymize_IP ensures that the IP data already are not absolutely stored by Google. Although they are first submitted for evaluation to Google Analytics unmasked, they are directly anonymized before the save procedure and then stored.
The anonymization of the IP address is also possible with the Google Tag Manager. Either a complete tracking code will be integrated, including the extra IP anonymity, or a variable will be set that finds a use for each tracking code used.
Consequences of the unencrypted transmission of the IP address
If the web operators do not prevent the transmission of the full IP address to Google, in theory they violate the applicable law and therefore may risk receiving a warning.
