No Google Analytics without a Google Analytics Opt-Out Cookie

If you use Google Analytics for web analysis, you should ensure that its use complies with data protection regulations. To do this, you must have and adhere to the following requirements (not legally binding):

• Contract with Google for data processing

• Deletion of old data

• Privacy policy for the use of Google Analytics

• Anonymization of IP addresses when collecting user data

• Integration of an opt-out solution

You can find a detailed list of the points mentioned above on the Data Protection Officer Info website. Here you will also find a template of the contract that must be concluded with Google for data processing.

The additional integration of an opt-out solution is often forgotten. By installing a Google Analytics add-on or an opt-out cookie, users have the opportunity to prevent their data from being collected. This offer is mandatory in EU countries and ignoring it can lead to costly consequences.

After the introduction of the new General Data Protection Regulation (GDPR) on May 25, 2018, it is becoming more apparent that these adjustments must be taken seriously. The disable Google Analytics link must be integrated on every page using Google Analytics as a tracking tool.

We show you in this article how to correctly create and implement the opt-out addition.

Notice on the Use of Web Analysis in Data Protection

When using web analysis, it is essential to regularly check and update the data protection of your website.

Figure 1: Excerpt from the Data Protection Page of internetwarriors GmbH (I)

However, in addition to the written presentation, you are required to implement an opt-out addition. There are several ways to disable the Google Analytics tracking code:

1. Installation of the Google Analytics Add-on, which prevents data collection by Analytics for all common browsers. The add-on works independently of the visited websites and generally prevents the data collection by Google Analytics.

2. Setting a so-called opt-out cookie.

To use Google Analytics in compliance with data protection, both variants must be implemented.

If the user chooses the opt-out cookie, this only refers to the registered UA number of the Google Analytics property defined in the cookie.

Figure 2: Excerpt from the Data Protection Page of internetwarriors GmbH (II)

Disable Google Analytics with the Opt-Out Cookie

To implement the opt-out cookie, you must first write a JavaScript and integrate it on your pages. Via a link on your data protection page, users can then start the script execution and thereby deactivate Google Analytics. The JavaScript should be embedded in your source code before the closing tag. It is essential that the script is integrated before the actual Google Analytics code so that the activated script can take effect before data collection. If you are using the Google Tag Manager, you must also ensure that the cookie is set before the Google Tag Manager.

The script for the opt-out cookie looks as follows:

Figure 3: The Script of the Opt-Out Cookie

The sequence 'UA-XXXXXXX-X' in the first line must be replaced with your Google Analytics property. The following four lines until window[disableStr] = true;} disable the Analytics cookie. The command function gaOptout() sets the opt-out cookie once the respective link on the data protection page is embedded and clicked. The set opt-out cookie is valid in our example until December 31, 2099, at 11:59:59 PM, provided it is not deleted by the user in advance. Once you have created the above script and integrated it into the head area of your pages, the next step is to set an HTML link on your data protection page, so the command "function gaOptout()" can be executed.

The link can look like this:

<a href="javascript:gaOptout();" onclick="alert('Google Analytics has been disabled');">Disable Google Analytics data collection for this website</a>

The addition: onclick="alert('Google Analytics has been disabled') informs the user in a small window after the click that Google Analytics has now been disabled.

Figure 4: An "alert" opens an additional window

If you, as a website operator, want to ensure that the cookie is set, we recommend that you first delete all your cookies in the browser settings. Then visit your data protection website and click on the link to disable Google Analytics. The info window should appear first. In the next step, you can check whether the opt-out cookie (ga-disable-UA-XXXXXX-X) has been set:

Figure 5: Check if the Opt-Out Cookie is set (View from Google Chrome; UA number is anonymized)

An alternative is using the browser plugin EditThisCookie to check if the Google Analytics opt-out cookie is functioning.

Figure 6: Check if the Opt-Out Cookie is set - with the Add-On "EditThisCookie"

Note: If the user has disabled JavaScript, the cookie will not trigger, but Google Analytics would not receive any data either, as Analytics is also embedded via a JavaScript.

If you insert the Google Analytics opt-out link on the data protection page with the WordPress Visual Composer, please note that the Visual Composer block system overwrites the JavaScript snippet, and the opt-out cookie will no longer be set. The solution for this is to embed the script in the HTML mode of the page.

The Additional Cookie Notice

Many websites currently set an additional cookie notice. This alerts the visitor that the page uses cookies to improve usability. There is also the option to confirm this via the OK button or to be redirected to the data protection page.

Figure 7: Cookie Notice on Websites

A good tool for a simple implementation of the cookie notice is available for free on the Cookie Consent website.

Figure 8: With the Cookie Consent Tool, you can create a cookie notice for your site

The tool offers a straightforward interface to build a cookie notice snippet. You can choose between different positions, layouts, and colors. The link to more information, i.e., to the data protection page, can be directly specified in the tool.

Under "Compliance type," you can choose whether the banner should only display a notice on your website or whether you want to set an opt-out cookie directly in the banner; alternatively, an opt-in cookie could also work. However, JavaScript knowledge is required here to correctly implement the respective scripts on your website or in the Google Tag Manager.

On the right side is the code that gets embedded in the header of the page. Please ensure that the code is implemented before the closing tag in your site's source code.

You can read the legal basis on the www.e-recht24.de page.

Currently, there is also consideration to introduce a mandatory opt-in solution for data collection instead of a recall addition. However, no exact details are known yet, so for now, implementing the opt-out cookie and/or setting the link to the Google Analytics add-on puts you on the right side.

The so-called ePrivacy Regulation would lay the foundation for a completely mandatory opt-in solution. There is no binding information yet on when ePrivacy, in addition to the GDPR, will come into force. For more information and the current status, we recommend the Federal Association of Digital Industry (BVDW) e.V.

What We Can Do for You

Changes in the guidelines for data protection can be quickly decided. Then it means you have to react fast before it gets expensive. We gladly support you in implementing online marketing measures on your website and always strive to ensure compliance with data protection guidelines in the areas of web analysis, Google AdWords, and social media (without legal obligation). If you have questions, we are happy to assist you. We look forward to your inquiry.