{"id":2032,"date":"2024-04-21T20:10:40","date_gmt":"2024-04-21T18:10:40","guid":{"rendered":"https:\/\/trackboxx.com\/?p=2032"},"modified":"2025-03-17T16:30:36","modified_gmt":"2025-03-17T15:30:36","slug":"google-analytics-always-sends-data-to-the-usa","status":"publish","type":"post","link":"https:\/\/trackboxx.com\/en\/google-analytics-schickt-immer-daten-in-die-usa\/","title":{"rendered":"Google Analytics always sends data to the US."},"content":{"rendered":"<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-1769608 stk-block-background\" data-v=\"2\" data-block-id=\"1769608\"><style>.stk-1769608{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-1769608:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-1769608-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-15cfef8\" data-block-id=\"15cfef8\"><style>.stk-15cfef8{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-ad0c7ec\" data-block-id=\"ad0c7ec\"><style>.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-ad0c7ec\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-6dfbac1\" id=\"jetzt-ist-es-offiziell\" data-block-id=\"6dfbac1\"><h4 class=\"stk-block-heading__text\">Now it\u2019s official.<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-7f19526\" data-block-id=\"7f19526\"><p class=\"stk-block-text__text\">Google now unequivocally admits that Analytics data is always processed in the USA. Additionally, data processing occurs worldwide.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"translation-block\"><strong>Google Analytics is still the most popular website tool<\/strong> for spying on user behavior.<\/p>\n\n\n\n<p>A few days ago, Google made a surprising admission. Since then, it has been indisputable that all data collected with Google Analytics on a website is always sent to the USA and processed there.<\/p>\n\n\n\n<p><strong>Why did Google admit to this?<\/strong><\/p>\n\n\n\n<p class=\"translation-block\">The trigger was a <strong>complaint<\/strong> by the \u00a0<a href=\"https:\/\/noyb.eu\/\" target=\"_blank\" rel=\"noreferrer noopener\">data protection organization noyb<\/a> against Google to the Austrian supervisory authority. The authority then asked Google over 20 questions.<\/p>\n\n\n\n<p class=\"translation-block\">Google responded to the questions <a href=\"https:\/\/noyb.eu\/sites\/default\/files\/2021-05\/2021-04-09_Response_to_Austrian_DPA_-_NOYB_Complaints_b.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">often evasively, frequently ignorantly, and incompletely<\/a>. That Google proclaimed the <strong>exclusive data storage in the USA for Google Analytics data<\/strong> is relatively easy to explain. I need to elaborate on this a bit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the legal situation?<\/h2>\n\n\n\n<p class=\"translation-block\">Since the ECJ ruling on the <strong>Privacy Shield<\/strong>, also known as the \u201cSchrems II\u201d ruling, the USA is considered an unsafe third country. A transfer of personal data to the USA requires consent.<\/p>\n\n\n\n<p>On websites, a transfer of personal data always takes place because the user\u2019s network address, the IP address, is considered personal data according to a supreme court ruling.<\/p>\n\n\n\n<p class=\"translation-block\">The <strong>USA is considered an unsafe third country<\/strong> because legal measures there allow American authorities, such as intelligence agencies, to access data from American companies. If an American company stores customer data from Germans, America can access it.<\/p>\n\n\n\n<p class=\"translation-block\">The legal measures that legitimize intelligence agencies for secret data access are particularly the <strong>FISA Act<\/strong> and the <strong>Executive Order EO12333<\/strong>. In its response to the supervisory authority, Google clarified that these regulations only permit access to data stored outside the USA.<\/p>\n\n\n\n<p>Google's logic is therefore: We store all data in the USA, so no access can occur based on FISA and EO12333. Thus, the data is safe with us.<\/p>\n\n\n\n<p>However, this is not entirely true, but it is probably the best possible argument that Google can present. The creativity of this statement from Google likely correlates somehow with the salaries of Google\u2019s lawyers. Nevertheless, Google has thereby admitted what many already knew but could not prove.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Are the data safe in the USA?<\/h2>\n\n\n\n<p>The better question is whether data sent to and stored in the USA by Google Analytics is safe.<\/p>\n\n\n\n<p class=\"translation-block\">Obviously, analytical data is generated in Europe when a European opens a website that uses Google Analytics. Google collects this data through a so-called <strong>collector<\/strong>.<\/p>\n\n\n\n<p class=\"translation-block\">A collector is a server that is ideally located in the <strong>geographical proximity of the user<\/strong> and receives the data from the endpoint. The data is then <strong>sent to the USA<\/strong>.<\/p>\n\n\n\n<p class=\"translation-block\">This is obviously, one might ironically note, inherently <strong>illegal<\/strong> without consent. Besides, affected individuals must be informed about this, which likely does not happen. Additionally, under the GDPR, every affected individual must have a right to object. The NSA probably does not recognize this term either.<\/p>\n\n\n\n<p class=\"translation-block\">This is obviously, one might ironically note, inherently <strong>illegal<\/strong> without consent. Besides, affected individuals must be informed about this, which likely does not happen. Additionally, under the GDPR, every affected person must have a <a href=\"https:\/\/dr-dsgvo.de\/artikel-7-dsgvo\/\" target=\"_blank\" rel=\"noreferrer noopener\">right to object<\/a>. The NSA probably does not know this term either.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Consent requirement for Google Analytics<\/h2>\n\n\n\n<p>Due to the global data collection and data transfers to the USA, consent for Google Analytics should be obtained before the tool is loaded.<\/p>\n\n\n\n<p class=\"translation-block\">In its current standard configuration, Google (Universal) Analytics uses <strong>cookies<\/strong>. According to \u00a7 15 Abs. 3 TMG, this <strong>requires consent<\/strong>. Reasoning:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The cookies are set and read by Google Analytics.<\/li>\n\n\n\n<li>The values of the cookies are sent to Google servers.<\/li>\n\n\n\n<li>The cookies are not technically necessary. Proof: Google Analytics can also be operated without cookies.<\/li>\n\n\n\n<li class=\"translation-block\">The ePrivacy Directive requires consent for this in Art. 5 Abs. 3. It is irrelevant what data is stored in the cookies. They do not even have to be personal data.<\/li>\n\n\n\n<li>The TMG must be interpreted according to the ePrivacy Directive, as per the BGH ruling of May 28, 2020 \u2013 I ZR 7\/16 (\u201cPlanet49\u201d).<\/li>\n<\/ul>\n\n\n\n<p class=\"translation-block\">With Google, it is also <strong>possibly impossible to conclude an effective DPA (Data Processing Agreement)<\/strong> because the subcontractors are distributed worldwide, Google \"possibly\" deletes data only after two months upon request, and so on.<\/p>\n\n\n\n<p class=\"translation-block\">All this is sufficient to assume a <strong>general requirement for consent for Google Analytics<\/strong>, even if no cookies are used.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Information about Google Analytics<\/h2>\n\n\n\n<p class=\"translation-block\">Anyone who has looked at Google's privacy notices and the <strong>contractual framework for Google Analytics<\/strong> is probably just as confused as before. Google's statements are so convoluted, spread across various documents, vague, and ambiguous that transparent information on this seems impossible.<\/p>\n\n\n\n<p class=\"translation-block\">According to Article 12 GDPR, there must be <strong>transparent and understandable information<\/strong> about data processing with Google Analytics.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"translation-block\">Obtaining <strong>valid consent<\/strong> for Google Analytics seems <strong>difficult<\/strong>. These so-called cookie pop-ups on websites are not only annoying but are also usually <a href=\"https:\/\/dr-dsgvo.de\/cookiegeddon-das-versagen-aller-consent-tools\/\" target=\"_blank\" rel=\"noreferrer noopener\">legally invalid in practice<\/a>.<\/p>\n\n\n\n<p>Without consent, Google Analytics could only be used if cookies are not used. However, the data quality would be questionable because Google Analytics is not optimized for this mode of operation.<\/p>\n\n\n\n<p class=\"translation-block\">A privacy-friendly analysis of website visitors is possible with tools like <a href=\"https:\/\/trackboxx.com\/en\/\" target=\"_self\">Trackboxx<\/a>. Without cookies and without significant fingerprinting, no consent is required. The focus here is on ease of use, which is certainly not the case with Google Analytics. Anyone who has looked at the Google Analytics dashboard will still not have understood everything even after hours.<\/p>\n\n\n\n<p class=\"translation-block\">Additionally, I believe we should <strong>prefer German providers<\/strong> and stop providing free data to Google as soon as possible.<\/p>\n\n\n\n<p>Anyone who has ever had a support case or a general question for a corporation will know the feeling of not having received a proper answer. In my experience, local providers are significantly more customer-friendly and have a better understanding of the service provider mentality.<\/p>\n\n\n\n<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-cd4b1bc stk-block-background\" data-v=\"2\" data-block-id=\"cd4b1bc\"><style>.stk-cd4b1bc{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-cd4b1bc:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-cd4b1bc-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-52524ed\" data-block-id=\"52524ed\"><style>.stk-52524ed{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-f92a541\" data-block-id=\"f92a541\"><style>.stk-f92a541 .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-f92a541 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-f92a541\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-f-92-a-541-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-f-92-a-541-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 32c14.2 0 27.3 7.5 34.5 19.8l216 368c7.3 12.4 7.3 27.7 .2 40.1S486.3 480 472 480H40c-14.3 0-27.6-7.7-34.7-20.1s-7-27.8 .2-40.1l216-368C228.7 39.5 241.8 32 256 32zm0 128c-13.3 0-24 10.7-24 24V296c0 13.3 10.7 24 24 24s24-10.7 24-24V184c0-13.3-10.7-24-24-24zm32 224a32 32 0 1 0 -64 0 32 32 0 1 0 64 0z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-906b17a\" id=\"wusstest-du-dass\" data-block-id=\"906b17a\"><h4 class=\"stk-block-heading__text\">Did you know that...<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-ee56abc\" data-block-id=\"ee56abc\"><p class=\"stk-block-text__text\">... tracking (i.e., web analytics) is also possible without cookies? Trackboxx generates a hash instead of cookies. Personal data is not stored. This allows you to potentially even skip the consent banner under certain conditions. Sounds good? Then try Trackboxx completely free and without obligation.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-call-to-action stk-block-call-to-action stk-block stk-e215782 is-style-default\" data-v=\"2\" data-block-id=\"e215782\"><div class=\"stk-block-call-to-action__content stk-content-align stk-e215782-column stk-container stk-e215782-container stk-hover-parent\"><div class=\"has-text-align-center stk-block-content stk-inner-blocks stk-e215782-inner-blocks\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-55888e5\" id=\"jetzt-trackboxx-30-tage-kostenlos-testen\" data-block-id=\"55888e5\"><h3 class=\"stk-block-heading__text\">Try Trackboxx free for 30 days now<\/h3><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-ea0d235\" data-block-id=\"ea0d235\"><p class=\"stk-block-text__text translation-block\">No payment information required! No automatic renewal!\nYour Trackboxx ready to go in 1 minute.<\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-button-group stk-block-button-group stk-block stk-0c93f40\" data-block-id=\"0c93f40\"><div class=\"stk-row stk-inner-blocks stk-block-content stk-button-group\">\n<div class=\"wp-block-stackable-button stk-block-button stk-block stk-b564d26\" data-block-id=\"b564d26\"><style>.stk-b564d26 .stk-button{padding-right:40px !important;padding-left:40px !important;background:linear-gradient(135deg,rgb(226,1,119) 0%,rgb(0,92,174) 99%) !important;border-top-left-radius:40px !important;border-top-right-radius:40px !important;border-bottom-right-radius:40px !important;border-bottom-left-radius:40px !important}<\/style><a class=\"stk-link stk-button stk--hover-effect-darken\" href=\"\/en\/helpcenter\/30-day-free-trial\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"stk-button__inner-text\">Start for free now<\/span><\/a><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Jetzt ist es offiziell Google gibt neuerdings selbst unmissverst\u00e4ndlich zu, dass die Analytics-Daten immer in den USA verarbeitet werden. Zus\u00e4tzlich findet eine Datenverarbeitung weltweit statt. Google Analytics ist noch das popul\u00e4rste Webseiten-Tool, um das Verhalten von Nutzern auszuspionieren. Vor wenigen Tagen kam dann das \u00fcberraschende Eingest\u00e4ndnis von Google. Seitdem ist unbestreitbar, dass alle mit Google [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2034,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,37,53],"tags":[],"class_list":["post-2032","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogboxx","category-google-analytics","category-web-analytics"],"acf":[],"_links":{"self":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/comments?post=2032"}],"version-history":[{"count":0,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2032\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media\/2034"}],"wp:attachment":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media?parent=2032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/categories?post=2032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/tags?post=2032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}