The Federal Commissioner for Data Protection and Freedom of Information

Navigation and service

Bonn/Berlin, 14 November 2019

Press release 26/2019

Person-related web tracking only with consent

If providers of third-party services embedded in a website use the data collected there for their own purposes, the website operator is required to obtain explicit consent from users.

The Federal Commissioner for Data Protection and Freedom of Information, Ulrich Kelber, therefore calls on website operators to check their websites immediately for respective third-party content and tracking mechanisms: A provider embedding offers which, such as Google Analytics, legally require consent, must make sure that he obtains consent from his website users which is in conformity with data protection law. In this context, the fact that simple information via cookie banners or pre-activated checkboxes does not work for declarations of consent, should hopefully now be clear to everyone. Every website operator should therefore carry out thorough checks in order to find out what services are embedded in his website and, if necessary, deactivate those services until he has ensured that data protection compliant use can be guaranteed.

For this purpose, some support can be found in the “Guidance for telemedia providers”, which was already published in spring by the data protection supervisory authorities of the Federation and of the Länder. This guidance details the conditions under which the tracking of website visitors is allowed. The supervisory authorities’ older publications, for example on Google Analytics, are no longer applicable as the legal situation and processing operations have sometimes changed significantly.