Do you use Google Analytics? This is probably in breach of European privacy rules (GDPR)

Privacy Law

20 January 2022

Do you use Google Analytics? This is probably in breach of European privacy rules (GDPR)

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

Which entrepreneur doesn’t use it? Google Analytics, Google’s service for collecting statistics on a website in order to gain more insight into visitor flows and which pages are visited. The use of Google Analytics may no longer be permitted in the Netherlands (and the rest of Europe) in the short term. In Austria, this is already the case. The Austrian privacy regulator has recently ruled that the use of Google Analytics is prohibited. Its use would be in breach of the European General Data Protection Regulation (GDPR), a law that must be applied in the same way in every European country.

What breach is involved?

That breach simply arises because, when you use Google Analytics, Google sends the personal data collected via your website to the United States (US). This includes user identification, IP addresses and browser parameters.

Some companies believe they can circumvent this by making agreements about it using the Standard Contractual Clauses (SCCs) drawn up by the European watchdog for the transfer of personal data. However, those agreements also cannot prevent the personal data from still being passed on by Google to the American intelligence service if they ask for it. Google is subject in the US to oversight by the American intelligence service, among other things through the Cloud Act.

Dutch AP probably gave incorrect advice

The Dutch Data Protection Authority (AP) previously published a guide on its website about how Google Analytics could still be used in a privacy-friendly way. This included, among other things, aggregating the data as much as possible (stripping data of personal aspects and pooling it for statistical purposes). The Austrian privacy regulator also considered this, but concluded that even with a privacy-friendly setup of Google Analytics, the data still constitutes personal data and not anonymised data. The data passed on to the US can, after all, still be traced back to a person. If the data had truly been anonymised (meaning the data is irreversibly stripped of personal characteristics), it would have been permissible.

AP warning now on the website

The ruling by the Austrian privacy regulator was in any case sufficient reason for the AP in the Netherlands to post a warning that the use of Google Analytics may soon no longer be permitted. They state that they are currently conducting an investigation following two complaints about the use of Google Analytics in the Netherlands. It is expected that the use of Google Analytics will also be prohibited by the AP and by other European privacy regulators.

The AP’s investigation is in its final stage, says a spokesperson for the AP. The spokesperson also states that organisations are themselves responsible for keeping track of whether their products comply with privacy law.

Interim action by Google itself

Google now states on its website that users can set for themselves which data is sent. Google states that users can disable the sharing of users’ IP addresses with American servers. For now, that seems to be the best solution.

Conclusion

As an entrepreneur, it is important to check, at least in the short term, how Google Analytics is set up. This is to prevent data leaks to the US. It is also important to already consider the content of your organisation’s privacy statement, for the moment when the use of Google Analytics is explicitly prohibited in the Netherlands by the AP.

Do you have questions about your company’s GDPR compliance, for example how the privacy statement should be substantively designed? The Legal Company can help you with this quickly and easily.

The corporate lawyers of The Legal Company specialise in privacy law. For support or advice, you can contact us by emailing info@thelegalcompany.nl, calling 020-3450152 or filling in our contact form. We will call or email you back within 24 hours.

Would you like to stay informed on this topic and on all other relevant developments for businesses regarding employment law, contract law, corporate law and privacy law, and receive legal tips & tricks from our corporate lawyers? Sign up here for The Legal Alert!

Nothing changes as constantly as laws and regulations. Please note that our blogs may no longer reflect current laws and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or wish to obtain legal assistance, please contact us.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.