UserCentrics Review: Practical Test of the Consent Tool for Websites

One of the better-known consent tools for websites is UserCentrics. In this UserCentrics review, I put the so-called cookie tool to a practical test and examine how well it manages to make websites compliant with data protection law.

Introduction

A ruling by the Administrative Court of Wiesbaden declares Cookiebot unlawful. According to their own statements, UserCentrics and Cookiebot merged on 1 September 2021. The case is still ongoing. Anyone unfamiliar with the legal system in our country should know that many proceedings are deliberately drawn out, so that the defendant (or respondent) has plenty of time before a negative judgment (or ruling) might be on the horizon.

In my perception, UserCentrics is one of the better-known consent tools. Other tools of this kind that I have also examined are Cookiebot, Borlabs Cookie, Consent Manager, CCM19, OneTrust (with its spin-offs CookieLaw and Optanon) and Klaro! (although it is not as well known). The results are shown in my practical test of consent tools.

Here I take a closer look at UserCentrics and examine its weaknesses in particular. The alleged strengths are described by the vendor on its own website, as every other vendor does.

First, let me mention what most vendors of so-called consent solutions keep quiet about: no consent tool in the world is currently, or will be for the foreseeable future, able to make websites reliably compliant with data protection law. This holds until a fundamental reform of the internet, which will probably never come. I describe the reasons in a separate article that even names objective, irrefutable reasons.

Practical test: UserCentrics review

Originally, I wanted to pick a few arbitrary websites that use the UserCentrics tool and run a practical test on them. Before that, I had started writing the following section, which deals with the UserCentrics website itself. In doing so, I found that UserCentrics shamefully fails to make its own website compliant with data protection law, even with its own consent tool.

So I saved myself the effort of examining further websites and only used the one from UserCentrics itself. I hope it becomes especially clear that the UserCentrics consent tool does not seem to be particularly valuable if the vendor of the tool cannot even manage to comply with data protection laws using its own tool.

Data retrieval from the USA

Update: In the meantime, the Data Privacy Framework (DPF) between the EU and the USA has been created. This framework appears more than questionable, as shown for example by Biden's executive order, on which the framework is based. This executive order contains numerous questionable provisions. In any case, until further notice, data transfers between the EU and the USA are not generally prohibited. A prerequisite for a transfer to be lawful is the vendor's (here UserCentrics) self-registration under the DPF. Even then, it must still be ensured that the collected data is based on a legal basis.

When a UserCentrics CMP script is retrieved, a data retrieval from the USA cannot be ruled out. At any rate, the certificate for the address used, app.usercentrics.eu, points to Google Trust Services LLC in the USA:

Furthermore, because UserCentrics uses Google Cloud, it cannot be ruled out that load balancing causes a data transfer to the USA. Incidentally, UserCentrics itself does not explicitly rule this out, as court submissions from UserCentrics that I have seen show.

As is well known, this is highly problematic, see Art. 44 et seq. GDPR. It seems to me that using UserCentrics on a website itself requires consent. Further keywords for a consent requirement when data is transferred to the USA are FISA 702, EO 12333 and the Cloud Act (more information). As is well known, IP addresses are personal data, and they are always transmitted when UserCentrics is retrieved.

What about the UserCentrics website?

Update: At the beginning of 2024, it has to be noted that things are happening on usercentrics.com/de/ that are the opposite of data protection. Google Analytics is loaded without consent. In my view, this can be called a cardinal sin. The Google Tag Manager (GTM) is also loaded without consent. The GTM is generally not necessary. Many people use it out of convenience, ignorance or both. Google also pushes the use of the GTM by offering Google Analytics together with it, which is completely unnecessary. Google Analytics can easily be integrated without the GTM.

The German version of the UserCentrics website uses the company's own consent tool. How does it fare on data protection here? I believe that a vendor's credibility depends very much on whether everything was done correctly on its own website.

Since I am not paid to point out commercial vendors' own data protection errors, I will not be overly specific here, but will first say:

To be on the safe side, I had a witness make a recording of the current state of the UserCentrics website, in case anyone feels attacked and claims I am not telling the truth.

Here is just one of several possible pieces of evidence to demonstrate the not really fully present data protection competence of UserCentrics. On the home page there is an embedded YouTube video. The YouTube script is not loaded directly (which is good). Instead, the following dialog appears after the user has clicked the play button:

This dialog clearly violates at least one legal requirement. Who can find the violations? A small hint: anyone who looks at the GDPR will find them.

OK, here is another little problem from the UserCentrics website, this time with the defect named specifically. If you click Mehr Informationen (more information) in the dialog just shown, the following popup appears:

Can you explain to me since when an email address no longer contains an @ sign but is given in the form of a web address (URL)? Incidentally, anyone who clicks the link is taken to a Google web page on which no email address is visible …

This is how seriously UserCentrics apparently takes data protection, in that, in my eyes, misleading statements like the one just shown are made.

Also interesting in this context is the entry Verwendete Technologien (technologies used) for the video:

Two things come to mind here. The law states that information must be provided

I am not sure everyone knows what Privacy-Enhanced Mode means.

The law also states:

A statement like “Cookies are set, depending on what you happen to have configured on your computer” is therefore not permitted. I am referring to the above-mentioned conditional statement by UserCentrics that cookies are used if “Privacy Enhanced Mode” is not activated. As a computer scientist with more than 30 years of IT experience, I do not know what the Privacy Enhanced Mode is supposed to be. I have an idea, but it does not quite fit the statement, because the private mode of browsers, if that is what is meant, does not in itself generally prevent cookies from being set. It leaves me somewhat baffled, to put it politely, that terms are apparently invented on purpose that as few people as possible understand. I could write this article so that as many people understand it as understood the theory of relativity in Einstein's time. Why don't I do that …?

Conclusion

As with very many websites, your website will not really become compliant with data protection law if it was not compliant before you deployed UserCentrics. The truth is that you yourself have to take care of data protection on your website. UserCentrics does not do the dirty work for you. Unfortunately, many consent tool vendors work with people's fear and ignorance and pretend that their "solution" will certainly help you get a compliant website. That is bullshit. Do not fall for these marketing lies, but build a website with your core content. Then you do not need a so-called "cookie popup". Yes, that's right. A website does not need a cookie banner if nothing unnecessary happens there.

I think the fact that the UserCentrics website and the company's own consent tool used there are deficient in several respects under data protection law speaks for itself. Anyone who wants even more evidence of the tool's lack of suitability, in my view, will find further tests in my large practical test of numerous popular consent tools.

Anyone who wants to use this tool out of sheer desperation should rather use a free alternative that is at worst just as bad, possibly better, but certainly not more expensive.

If you are at a loss, feel free to contact me for free advice.

Also interesting

• Cookies and consent on websites: overview
• Practical test of Borlabs Cookie
• Practical test of OneTrust
• Practical test of popular consent tools
• Using Cookiebot can result in cease-and-desist letters
• Checklist for consent requests
• Five reasons why cookie popups are not a good idea
• The funniest cookie descriptions
• Alternatives to Google tools