Yearly Archives: 2020

We have grown accustomed to the extraordinary speed and efficiency of the Google search engine and Chrome browser. Many people also welcome the prompts and suggestions for browsing and purchases generated by Google Analytics. For a large number of businesses (including our own), Google Analytics provides useful feedback and analysis on visits to your website. For businesses in all countries signed up to the GDPR, cookie notices should make clear whether or not a business wishes to use Google Analytics, and give individuals the ability to opt in or out.A growing number of people around the world, however, are wanting to take back control of their personal data. Rather than simply accepting cookies when invited to do so, they are setting preference options which refuse all but essential cookies, or refuse analytical, targeting  and advertising-related cookies. The GDPR and related directives have strengthened the position of data subjects who wish to limit the amount of their data that cookies collect and share. A recent German court decision has held that using cookies for marketing or market intelligence purposes invariably requires user consent, whether or not the cookies collect personal data. Further, that consent must be given through active confirmation by the user, not pre-ticked boxes. Users must also be given adequate information about what cookies there are and what they do.There is no federal data protection law in the US that mirrors the provisions of the GDPR. There is a Privacy Shield voluntary scheme for businesses processing data from EU subjects, to minimise the formalities needed for data transfers, but the efficacy of that system is currently being challenged. Individual states have introduced different data protection laws, and the California legislation is arguably the toughest, so far as data collectors are concerned. Given the patchwork nature of US data protection, Google and others have been accused of being slow to adopt ‘best practice’ data privacy measures, perhaps because it would require them to go far beyond the protection available in the majority of states.Against that background US data subjects who do not wish their data to be mined by Google Analytics seem to have been under the impression that choosing Google’s “Incognito” mode would prevent their personal data being mined by Analytics. Not so, says Google.  Furthermore, the company claims that this is made clear every time a new search tab is opened. Given the dictionary definition of “incognito” is “having one’s true identity concealed”, the choice of name is questionable, at the very least.A class action has been brought in California where these conflicting views will be tested. The headline compensation being sought is US$5 billion. Not only lawyers, but vigilant data subjects in all walks of life will be watching this case closely to see how this dispute develops and whether a similar class action will be brought in the UK or elsewhere in Europe under the GDPR and related directives. If the case goes against Google, the days of near-universal use of Analytics may be numbered, or at least the nature and extent of the use will need to be made clearer in the US at least. Google will be no doubt hoping that the court decision will offer them some crumbs of comfort.