{"id":2032,"date":"2024-04-21T20:10:40","date_gmt":"2024-04-21T18:10:40","guid":{"rendered":"https:\/\/trackboxx.com\/?p=2032"},"modified":"2025-03-17T16:30:36","modified_gmt":"2025-03-17T15:30:36","slug":"google-analytics-always-sends-data-to-the-usa","status":"publish","type":"post","link":"https:\/\/trackboxx.com\/en\/google-analytics-schickt-immer-daten-in-die-usa\/","title":{"rendered":"Google Analytics always sends data to the US"},"content":{"rendered":"<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-1769608 stk-block-background\" data-v=\"2\" data-block-id=\"1769608\"><style>.stk-1769608{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-1769608:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-1769608-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-15cfef8\" data-block-id=\"15cfef8\"><style>.stk-15cfef8{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-ad0c7ec\" data-block-id=\"ad0c7ec\"><style>.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-ad0c7ec .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-ad0c7ec\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-ad-0-c-7-ec-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 512A256 256 0 1 0 256 0a256 256 0 1 0 0 512zM216 336h24V272H216c-13.3 0-24-10.7-24-24s10.7-24 24-24h48c13.3 0 24 10.7 24 24v88h8c13.3 0 24 10.7 24 24s-10.7 24-24 24H216c-13.3 0-24-10.7-24-24s10.7-24 24-24zm40-208a32 32 0 1 1 0 64 32 32 0 1 1 0-64z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-6dfbac1\" id=\"jetzt-ist-es-offiziell\" data-block-id=\"6dfbac1\"><h4 class=\"stk-block-heading__text\">Now it\u2019s official<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-7f19526\" data-block-id=\"7f19526\"><p class=\"stk-block-text__text\">Google itself has explicitly acknowledged that Analytics data is always processed in the US. Processing also takes place elsewhere around the world.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph translation-block\"><strong>Google Analytics remains the most popular website tool<\/strong> for snooping on users\u2019 behaviour.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google\u2019s surprising admission made one thing clear: all data collected on a website using Google Analytics is sent to the US and processed there. Every time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why did Google admit this?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">It began with a <strong>complaint<\/strong> that <a href=\"https:\/\/noyb.eu\/\" target=\"_blank\" rel=\"noreferrer noopener\">privacy organisation noyb<\/a> filed against Google with the Austrian data protection authority. The authority then put more than 20 questions to Google.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Google\u2019s answers were <a href=\"https:\/\/noyb.eu\/sites\/default\/files\/2021-05\/2021-04-09_Response_to_Austrian_DPA_-_NOYB_Complaints_b.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">often evasive, dismissive and incomplete<\/a>. Why Google insisted that <strong>Google Analytics data was stored exclusively in the US<\/strong> is fairly easy to explain, but it needs some background.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What was the legal context?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Following the Court of Justice of the EU\u2019s ruling on the <strong>Privacy Shield<\/strong>, known as \u201cSchrems II\u201d, the US was considered an unsafe third country. The position set out here is that transferring personal data to the US requires consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Website traffic involves transfers of personal data because a user\u2019s network address\u2014their IP address\u2014has been recognised as personal data by the courts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">The <strong>US was considered an unsafe third country<\/strong> because its laws allow authorities, including intelligence agencies, to access data held by US companies. If a US company stores customer data relating to people in Germany, US authorities can access it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">The legal powers enabling intelligence agencies to access data covertly include the <strong>Foreign Intelligence Surveillance Act (FISA)<\/strong> and <strong>Executive Order 12333<\/strong>. In its response to the authority, Google argued that both only permit access to data stored outside the US.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google\u2019s reasoning was essentially this: we store all data in the US, so FISA and Executive Order 12333 cannot be used to access it. Therefore, the data is safe with us.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That argument does not hold up, but it may be the best Google could offer. Perhaps the creativity of its legal arguments has something to do with its lawyers\u2019 salaries. Either way, Google admitted what many had suspected but had not been able to prove.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Is the data safe in the US?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The more useful question is whether data that Google Analytics sends to the US and stores there is actually safe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">When someone in Europe visits a website using Google Analytics, the analytics data is generated in Europe. Google gathers it through a server known as a <strong>collector<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">A collector receives data from the user\u2019s device and is located <strong>as close to the user as possible<\/strong>. The data is then <strong>sent to the US<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">This means <a href=\"https:\/\/dr-dsgvo.de\/was-bedeutet-erheben-von-daten-im-kontext-der-dsgvo\/\" target=\"_blank\" rel=\"noreferrer noopener\">data is collected<\/a> around the world. Under FISA and Executive Order 12333, the US intelligence agency NSA can carry out what is known as <strong>upstream collection<\/strong>. This involves tapping a transatlantic cable carrying data into the US.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">One might dryly observe that doing this without consent is, in itself, <strong>unlawful<\/strong>. The people affected should also be informed, which apparently does not happen. Under the GDPR, they must also have a <a href=\"https:\/\/dr-dsgvo.de\/artikel-7-dsgvo\/\" target=\"_blank\" rel=\"noreferrer noopener\">right to object<\/a>, among other rights. That may be another concept the NSA is unfamiliar with.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Google Analytics requires consent<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On this reasoning, worldwide data collection and transfers to the US alone would require consent before Google Analytics is loaded.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">The standard configuration of Google (Universal) Analytics discussed here uses <strong>cookies<\/strong>. Under <a href=\"https:\/\/dr-dsgvo.de\/tmg-paragraph-15-nutzungsdaten\/\" target=\"_blank\" rel=\"noreferrer noopener\">section 15(3) of Germany\u2019s Telemedia Act (TMG)<\/a>, this <strong>requires consent<\/strong>. The reasoning is as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Google Analytics sets and reads the cookies.<\/li>\n\n\n\n<li>The cookie values are sent to Google\u2019s servers.<\/li>\n\n\n\n<li>The cookies are not technically necessary: Google Analytics can also run without them.<\/li>\n\n\n\n<li class=\"translation-block\">Article 5(3) of the <a href=\"https:\/\/dr-dsgvo.de\/gdprmageddon\/\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive<\/a> requires consent. It does not matter what the cookies contain; the information does not even have to be personal data.<\/li>\n\n\n\n<li>Under the German Federal Court of Justice\u2019s ruling of 28 May 2020, case I ZR 7\/16 (\u201cPlanet49\u201d), the TMG must be interpreted in line with the ePrivacy Directive.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">It may also be <strong>impossible to enter into a valid data processing agreement with Google<\/strong>. Reasons include its worldwide network of subprocessors and the possibility that requested data deletion may take two months.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Taken together, these points support a <strong>general consent requirement for Google Analytics<\/strong>, even when no cookies are used.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Explaining how Google Analytics uses data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">If you have read Google\u2019s privacy notices and the <strong>Google Analytics contractual terms<\/strong>, you may be none the wiser. The information is so convoluted, vague and scattered across different documents that providing a transparent explanation seems almost impossible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Yet <a href=\"https:\/\/dr-dsgvo.de\/artikel-12-dsgvo\/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 12 GDPR<\/a> requires <strong>clear, understandable information<\/strong> about data processing with Google Analytics.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Obtaining <strong>valid consent<\/strong> for Google Analytics appears <strong>difficult<\/strong>. Cookie pop-ups are not just irritating; most also <a href=\"https:\/\/dr-dsgvo.de\/cookiegeddon-das-versagen-aller-consent-tools\/\" target=\"_blank\" rel=\"noreferrer noopener\">fail to meet legal requirements in practice<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using Google Analytics without consent would, in turn, require dispensing with cookies. The quality of the resulting data is questionable, however, because Google Analytics is not optimised for that setup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">Tools such as <a href=\"https:\/\/trackboxx.com\/en\/\" target=\"_self\">Trackboxx<\/a> offer a privacy-friendly way to analyse website traffic. Without cookies or substantial fingerprinting, there is no need to ask for consent. The focus is on ease of use\u2014hardly Google Analytics\u2019 strong suit. Even after spending hours in its dashboard, you may still struggle to understand it all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph translation-block\">I also believe we should <strong>give preference to German providers<\/strong> and stop handing Google our data for free as soon as possible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have ever contacted a large corporation for support or with a simple question, you probably know what it feels like not to get a proper answer. In my experience, local providers are much more helpful and have a stronger commitment to customer service.<\/p>\n\n\n\n<div class=\"wp-block-stackable-icon-box stk-block-icon-box stk-block stk-cd4b1bc stk-block-background\" data-v=\"2\" data-block-id=\"cd4b1bc\"><style>.stk-cd4b1bc{background-color:#fcf8e3 !important;box-shadow:0 5px 5px 0 #123f5209 !important;border-style:solid !important;border-color:#f9f0c3 !important;border-left-width:8px !important}.stk-cd4b1bc:before{background-color:#fcf8e3 !important}<\/style><div class=\"stk-block-content stk-inner-blocks stk-block-icon-box__content stk-container stk-cd4b1bc-container stk--no-background stk--no-padding\">\n<div class=\"wp-block-stackable-icon-label stk-block-icon-label stk-block stk-52524ed\" data-block-id=\"52524ed\"><style>.stk-52524ed{margin-bottom:0px !important}<\/style><div class=\"stk-row stk-inner-blocks stk-block-content\">\n<div class=\"wp-block-stackable-icon stk-block-icon has-text-align-left stk-block stk-f92a541\" data-block-id=\"f92a541\"><style>.stk-f92a541 .stk--svg-wrapper .stk--inner-svg svg:last-child,.stk-f92a541 .stk--svg-wrapper .stk--inner-svg svg:last-child :is(g,path,rect,polygon,ellipse){fill:#000000 !important}<\/style><span class=\"stk--svg-wrapper\"><div class=\"stk--inner-svg\"><svg style=\"height:0;width:0\"><defs><lineargradient id=\"linear-gradient-f92a541\" x1=\"0\" x2=\"100%\" y1=\"0\" y2=\"0\"><stop offset=\"0%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-f-92-a-541-color-1)\"><\/stop><stop offset=\"100%\" style=\"stop-opacity:1;stop-color:var(--linear-gradient-f-92-a-541-color-2)\"><\/stop><\/lineargradient><\/defs><\/svg><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 512 512\" aria-hidden=\"true\" width=\"32\" height=\"32\"><path d=\"M256 32c14.2 0 27.3 7.5 34.5 19.8l216 368c7.3 12.4 7.3 27.7 .2 40.1S486.3 480 472 480H40c-14.3 0-27.6-7.7-34.7-20.1s-7-27.8 .2-40.1l216-368C228.7 39.5 241.8 32 256 32zm0 128c-13.3 0-24 10.7-24 24V296c0 13.3 10.7 24 24 24s24-10.7 24-24V184c0-13.3-10.7-24-24-24zm32 224a32 32 0 1 0 -64 0 32 32 0 1 0 64 0z\"><\/path><\/svg><\/div><\/span><\/div>\n\n\n\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-906b17a\" id=\"wusstest-du-dass\" data-block-id=\"906b17a\"><h4 class=\"stk-block-heading__text\">Did you know\u2026<\/h4><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-ee56abc\" data-block-id=\"ee56abc\"><p class=\"stk-block-text__text\">\u2026that you can track website activity without cookies? Trackboxx generates a hash instead and does not store personal data. Under certain conditions, you can even do away with the consent banner. Sound good? Try Trackboxx for free, with no obligation.<\/p><\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-stackable-call-to-action stk-block-call-to-action stk-block stk-e215782 is-style-default\" data-v=\"2\" data-block-id=\"e215782\"><div class=\"stk-block-call-to-action__content stk-content-align stk-e215782-column stk-container stk-e215782-container stk-hover-parent\"><div class=\"has-text-align-center stk-block-content stk-inner-blocks stk-e215782-inner-blocks\">\n<div class=\"wp-block-stackable-heading stk-block-heading stk-block-heading--v2 stk-block stk-55888e5\" id=\"jetzt-trackboxx-30-tage-kostenlos-testen\" data-block-id=\"55888e5\"><h3 class=\"stk-block-heading__text\">Try Trackboxx free for 30 days now<\/h3><\/div>\n\n\n\n<div class=\"wp-block-stackable-text stk-block-text stk-block stk-ea0d235\" data-block-id=\"ea0d235\"><p class=\"stk-block-text__text translation-block\">No payment information required! No automatic renewal!\nYour Trackboxx ready to go in 1 minute.<\/p><\/div>\n\n\n\n<div class=\"wp-block-stackable-button-group stk-block-button-group stk-block stk-0c93f40\" data-block-id=\"0c93f40\"><div class=\"stk-row stk-inner-blocks stk-block-content stk-button-group\">\n<div class=\"wp-block-stackable-button stk-block-button stk-block stk-b564d26\" data-block-id=\"b564d26\"><style>.stk-b564d26 .stk-button{padding-right:40px !important;padding-left:40px !important;background:linear-gradient(135deg,rgb(226,1,119) 0%,rgb(0,92,174) 99%) !important;border-top-left-radius:40px !important;border-top-right-radius:40px !important;border-bottom-right-radius:40px !important;border-bottom-left-radius:40px !important}<\/style><a class=\"stk-link stk-button stk--hover-effect-darken\" href=\"\/en\/helpcenter\/30-day-free-trial\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"stk-button__inner-text\">Start for free now<\/span><\/a><\/div>\n<\/div><\/div>\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Jetzt ist es offiziell Google gibt neuerdings selbst unmissverst\u00e4ndlich zu, dass die Analytics-Daten immer in den USA verarbeitet werden. Zus\u00e4tzlich findet eine Datenverarbeitung weltweit statt. Google Analytics ist noch das popul\u00e4rste Webseiten-Tool, um das Verhalten von Nutzern auszuspionieren. Vor wenigen Tagen kam dann das \u00fcberraschende Eingest\u00e4ndnis von Google. Seitdem ist unbestreitbar, dass alle mit Google [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2034,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,37,53],"tags":[],"class_list":["post-2032","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogboxx","category-google-analytics","category-web-analytics"],"acf":[],"_links":{"self":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/comments?post=2032"}],"version-history":[{"count":0,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/posts\/2032\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media\/2034"}],"wp:attachment":[{"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/media?parent=2032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/categories?post=2032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trackboxx.com\/en\/wp-json\/wp\/v2\/tags?post=2032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}