Schindler Parent > Blog > Privacy-compliant tracking: etracker
Hardly a week goes by without new data protection guidelines. Staying up to date is, thus, a real challenge - and a rather time-consuming one at that. Especially for companies with enough projects on-hand, even without new data protection laws and regulations. So the ban on Google Analytics comes at an inopportune time.
Many marketing departments rely on data from the U.S. tracking tool but are now no longer allowed to use it. It's time for an alternative. But what works effectively? And what is still allowed? At Schindler Parent, we provide answers to these questions. Work with us to keep your tracking effective and, more importantly, legal.
For most of our analyses, we use etracker as a certified partner. In many ways, it is the best alternative to Google Analytics for us for several reasons: The GDPR-compliant tool does not use cookies or US data transfer. Furthermore, the data sovereignty remains 100% with you, the website operator. The high level of up-to-date data is only the cherry on top. If you would like to know how to get relevant and legal data, please feel free to contact us. Our online marketing manager, Daniel Leidorf, is a Certified etracker Expert and knows the answers to your questions. He will be happy to support you in converting your tracking so that you can continue to gain crucial insights from your privacy-compliant web analytics.
Please read on if you want to learn more about etracker and gain insight into the analytics ban and alternative tools. But be careful: The following content might be dull at one point or another.
Data protection and web analytics: need not be a contradiction in terms. Because even when complying with the regulations of the new Telecommunications Telemedia Data Protection Act (TTDSG), which came into effect at the end of 2021, website operators can carry out informative data analyses. However, there are a few things to keep in mind. The national implementation of the directives adopted at the EU level (2002/85/EC e-Privacy) stipulates that website administrators need the consent of their users when accessing the user's terminal device.
You can find more information on the new Telecommunications Telemedia Data Protection here: https://gesetz-ttdsg.de/teil-1/.
In addition, the Data Protection Conference published the "Orientation Guide for Telemedia Providers" in the wake of the new law. Among other things, it deals with data transfer to the United States. In this case, and according to the Data Protection Conference, there is no legal basis whatsoever, and even with the user's consent, there is a violation of the GDPR (General Data Protection Regulation). In this regard, the Data Protection Conference writes:
"[...] Furthermore, in cases where third-party service providers are involved in tracking as processors, attention must be paid to whether these service providers also process data of the users concerned for their own purposes (e.g., to improve their services or to create interest profiles). In this case - and even if the third-party service provider only reserves this right theoretically - the scope of a commissioned processing according to Art. 28 DS-GVO is violated.
And further:
"It should be noted that [when transferring personal data to the U.S. and other third-party countries] the mere agreement to standard data protection clauses such as the standard contractual clauses adopted by the EU Commission is insufficient."
You can access the official guidance of the Data Protection Conference here: https://www.datenschutzkonferenz-online.de/media/oh/20211220_oh_telemedien.pdf
If you are fed up with laws and regulations, here is a summary of the four points that make Google Analytics a data protection problem:
If you want to dive in further, the coming paragraphs will give you an idea of what the legislation means in concrete terms. Namely, the widely used Google Analytics tracking tools are illegal. With Google Analytics, the analysis of personal data takes place in the US, a security risk from a privacy protection perspective.
In Austria, the data protection authority has already clarified that Google Analytics is illegal there, as the data processing is not GDPR-compliant. Shortly thereafter, the Dutch and French data protection authorities joined in and prohibited website operators from embedding Google Analytics tracking tools into their websites. Consequently, it only makes sense to monitor this trend while keeping the developing guidance of the Data Protection Conference in mind. It seems likely that more state authorities will join in on the strict ban. Therefore, the U.S. data transfer of Google Analytics represents an insurmountable hurdle to privacy-compliant tracking at this point.
The cookie-based method of Google Analytics furthermore requires the consent of the user. By automatically enriching the user profiles with socio-demographic data, the platform creates extensive data sets, which is why tracking is consent-dependent. In addition to the dependency on user consent, there still exist data protection concerns, because even with consent, the data protection conference writes, "[...] the services concerned may not be used, i.e. they may not be integrated into the website [...]".
Furthermore, the processing of data by Google Analytics does not only occur based on orders, meaning that no absolute data sovereignty is ensured. This insecure processing relationship increases the risk of data leaks and the associated negative consequences. Google Analytics neither grants access to raw data nor does it generate daily updated data. However, the immediate tracking of events is indispensable for successful web analysis.
As a direct competitor of Google Analytics, Matomo could be an alternative for website operators. In reality, however, Matomo also works with tracking cookies by default, which makes it possible to identify users. Again, extensive usage profiles are created, and the explicit consent of the website users must, therefore, be guaranteed. The problem: the consent rate of users is low, decreasing the amount of available data dramatically. Due to ad blockers, cookie banners are even often blocked immediately, thus, ruling out user consent from the start. Web analytics of this kind are therefore becoming less and less effective.
Since etracker Analytics does not use cookies, the debate about user consent simply does not apply. The high rejection rate that jeopardizes web analytics using Matomo, for example, doesn't matter with etracker. "But then, how is informative data even collected for my web analytics?" you may be asking. It's simple: due to etracker's data protection-friendly default settings, all interactions on the website are recorded in the same form with the cookie-less method as with the cookie-based way. etracker relies on anonymizing the data before the first data is even stored. Another reason why etracker does not use cookie banners is the legitimate interest of the website operator, which is taken into account by the GDPR. This legitimate interest forms the legal basis of cookie-less session tracking and is, therefore, recognized by German regulatory authorities as not requiring consent. The etracker Analytics analysis tool even offers a template for balancing interests in this context. Website operators who use eTracker are, thus, on the safe side.
If website operators do not wish to forego cookies and hence user permission, despite the advantages mentioned above, etracker also offers the option of tracking with cookie-based consent. One can connect this option to all common consent management platforms.
Since, unlike Google Analytics, etracker Analytics is platform-neutral, one can connect both Google Ads and Microsoft Ads in the same way. Thus, the relevant user conversion data can be fed back to the respective advertising platforms. The connection to the corresponding ads is done via etracker's clear dashboard and does not involve any extraordinary niche capabilities.
The aspect of US data transfer, which makes tracking with Google Analytics problematic from a privacy protection point of view, is also eliminated with etracker. Since the server is located in Germany and there is no data transfer to non-European third countries, etracker's features are compliant with the high data protection standards of the GDPR. In addition to the fact that etracker excludes US data transfer, the data is collected exclusively on behalf of the website operator and is not used elsewhere by etracker. Data sovereignty, thus, lies 100% with the website operators. In contrast to Google Analytics, the raw data export is guaranteed, and the actuality of the data is a clear benefit. etracker provides a continuous processing time of the data of approx. 30 minutes.
Due to its compliance with the GDPR, the etracker analytics platform was honored with the "ePrivacy Seal" certificate. This certificate is awarded by the independent ePrivacyseal GmbH when online and mobile offerings withstand a thorough data protection audit.
In short, etracker is the best alternative to Google Analytics in many aspects. To summarize, these are the most important advantages of etracker compared to Google Analytics:
As you can see, etracker's services create a win-win situation, as it is possible to protect user privacy while simultaneously creating significant web analyses.
If you have any questions about etracker, please feel free to contact us:
Michael Meier
Managing Director
michael.meier@schindlerparent.de
