website visitor and Google user (data subject and complainant) – Complaint Upheld (Austria, 2021)
An Austrian court upheld a complaint against a website for using Google Analytics without consent, which is a big deal for online privacy. This ruling shows that companies must obtain user consent before tracking their data. Website operators should review their tracking practices to ensure they comply with privacy laws.
What happened
A complaint was upheld against a website for using Google Analytics to track visitors without their consent.
Who was affected
Website visitors who were tracked by Google Analytics without proper consent were affected by this ruling.
What the authority found
The Austrian DPA found that the website did not have valid consent for using Google Analytics, violating GDPR rules.
Why this matters
This decision highlights the importance of obtaining user consent for tracking. Website operators should ensure they have clear consent mechanisms in place.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
= About a month after the "Schrems II ruling" by the CJEU (CJEU - C-311/18 - Schrems II) the NGO noyb filed 101 complaints regarding data transfers from EEA based websites to Google LLC and Facebook Inc. in the U.S (see [https://noyb.eu/en/101-complaints-eu-us-transfers-filed here] and [https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers here]). In order to coordinate the work of all involved DPAs, the EDPB created a [https://edpb.europa.eu/news/news/2020/european-data-protection-board-thirty-seventh-plenary-session-guidelines-controller_en?mkt_tok=eyJpIjoiTVRrMVlqRmpOMlF3TnpCbCIsInQiOiJFekdLKzFydWlOSHpaU1RDUTNUaHVWR2JxTVN4MnRDUm9jYTRkOGRxWG1LSDBWY1lBQkhaM2dsTkdoSEdYNlQrN2lFbm84d1Y3STRWMFlXZk5lM0dzeGFMd2p2NGFjVmltS1wvNnlCSmhrK3Nra1dGcGNjd2lEQWN6UW9EQVdtNmsifQ%3D%3D special task force]. The Austrian DPA (Datenschutzbehörde - DSB) now issued the first decision on one of these 101 complaints. = On 14.08.2020, the data subject visited a website on health topics hosted by an Austrian company while logged into his personal Google account. The website used Google Analytics, a tool provided by Google LLC used to measure and track website use. According to the website provider and Google LLC, the website controller qualifies as controller (Article 4(7) GDPR) and Google LLC as processor (Article 4(8) GDPR) for data processing in connection with Google Analytics. Furthermore, according to the privacy documents provided on the website or included via hyperlink, the website provider and Google LLC entered into standard contractual clauses under Article 46(2)(c) GDPR ([https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32010D0087 Commission Decision2010/87 of 05.02.2010]; SCCs) as a mechanism for transfers of personal data with regard to Google Analytics. On 18.08.2020, the data subject (represented by noyb) filed a complaint with the DSB against both the website provider (in its role as data exporter) and Google LLC (in its role as data importer), argui
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Violations (2)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Enforcement Actions (0)
No other enforcement actions found for website visitor and Google user (data subject and complainant) in AT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. website visitor and Google user (data subject and complainant) - Austria (2021). Retrieved from cookiefines.eu
Last updated: