Google Analytics forbidden: What are the data protection-friendly alternatives?

Google Analytics was quickly deemed unlawful by two data protection authorities. In both cases, the transfer of data to the US through the tracking tool was the reason. The contribution shows that there are good alternatives that are legally compliant. Even conversion tracking can be done without Google Analytics.

Introduction

The Austrian data protection authority had conducted an investigation on the basis of a complaint from the data protection organization noyb and found that consent for the use of Google Analytics was missing. Specifically, it was about consent under Art. 49 Abs. 1 b GDPR .

The French data protection authority CNIL came to a similar conclusion, but went further in my understanding. The CNIL argued that Google Analytics is not usable at all in the EU because Google does not do enough to protect the data of European citizens from access by American intelligence services.

The Netherlands have also announced that they will issue a ruling on Google Analytics. One doesn't need to be a seer to guess that it won't turn out well. Generally, I've been convinced for a long time now: Google Analytics can (at most) be used lawfully after prior consent. An exception is the server-side tracking.

Decisions by authorities do not automatically mean a ban. However, they have some relevance. Courts may possibly take them into account.

Google Analytics processes all analytics data in the US, as Google itself had to admit. The Cloud Act, as well as other American laws (such as EO12333, FISA 702), give American authorities far-reaching powers that are not compatible with the GDPR.

There is probably only a ban in a legal sense if either a competition infringement has been provided with an injunction; in this case, the ban would only apply to one market participant. It would be similar if an authority had issued a resolution against a market participant. Or, if the BGH or the ECJ had rendered such a judgment and it would be applicable to other individual cases. What I mean to say: The question of the ban is rather philosophical in nature. The risk of getting into trouble is certainly much greater when Google Analytics is used.

I claim from experience: Most operators of German websites do not need Google Analytics in general. Many would not be worse off if they didn't even have a visitor counter on their website. But even the benefit gain, which Google Analytics allegedly has compared to other analytics tools, is mostly zero. This benefit gain is also called marginal benefit.

For those who absolutely need to know how many visitors their own website has, I present below some data protection compliant possibilities. Not only simple Visitor Counting is possible with this. Even detailed statistics can be generated and evaluated in a data protection compliant manner. These details are almost never needed. But they suggest that you get everything you need. So you save yourself one or the other discussion with people who want to measure everything, although no more sales revenue is generated thereby.

As if that weren't enough, conversion tracking is also possible without Google Analytics. It may be hard for some to imagine, but a life without Google is possible. This also applies when online marketing is at the forefront. Even your smartphone works without sending data to Google.

Website Visitors Analysis

Simplifying, I'm talking about visitor counting here. As I will show you shortly, these analysis tools do much more than that. I am sure: Most of you don't need this many information. Not to mention the even more comprehensive statistics Google Analytics provides.

Here are some recommendations for analysis tools that I can particularly give:

• Piwik
• Trackboxx
• WordPress statistics
• Log File Analyzer (here I'll limit myself to a random example. You will certainly find more examples using a search engine)

I am familiar with the first two mentioned tools. I know that the provider of Trackboxx attaches great importance to data protection. Even fingerprinting was aligned so that it is in line with TTDSG.

Piwik

Matomo should be installed locally. Local operation means that the service runs on its own server, preferably on the same server as your website is running. Matomo will then not send data to third parties. This differs from the cloud service of Matomo which runs on the server of the Matomo provider. That is legally possible but requires a suitable contract such as an DPA.

The Matomo configuration should also be adjusted so that no cookies are used. Details can be found in my article on Matomo. Matomo can be easily integrated into WordPress with a plugin, for example. The basic version is free and misses no important features.

Trackboxx

Trackboxx is an analytics tool of a German provider. In contrast to Matomo, Trackboxx is chargeable. For this reason, the tool appears easier to handle and offers good support. As far as I understand it, Trackboxx is intended to be easy to use and has perhaps taken the lead over Matomo in this regard. As shown by the dashboard, it is indeed possible with Trackboxx to gain a well-founded overview of visitors to a website.

The Trackboxx-dashboard shows all important information. A graph shows the visitor trend. Those who want to know which pages and contributions are most popular must only scroll down in the dashboard.

A list of referrers shows the source of calls. As can be seen in the picture, unfortunately Google is still the largest traffic bringer. Hopefully this will change soon. Have you already switched your search engine to DuckDuckGo, Ecosia or another data-protecting variant?

A very nice feature of Trackboxx is the display of keywords by which visitors arrived on your website through search.

With this knowledge, one's own website can be content-wise better aligned. Good keywords can be further optimized and bad ones improved if it seems promising.

WP Statistics

WP Statistics is a WordPress plugin. To avoid confusion: A completely different tool with a similar name is WP-Stats. There's also a tool called WordPress Stats. These are both other services that are even critically to be evaluated from a data protection point of view. Here it's about WP Statistics. The plugin is free and offers everything needed. A comprehensive configuration allows cookies to be disabled and IP addresses to be considered with care. There's also an option for a report by email if desired.

The statistics are displayed directly in the WordPress dashboard.

Under the main menu point Statistics (in the WordPress dashboard) are further statistics hidden. Among other things, these include the top 10 pages including total hits, the top 10 browsers used by visitors as well as search engine referrals. Overall a very useful service for WordPress websites.

Webalizer Alternatives for Web Server Log Analysis

Another way to analyze visitors of a website is by examining Server Logs. This can be done most easily with so-called Log File Analyzers. A prominent example is AWStats. AWStats is Open Source and can therefore be easily adapted to one's own needs.

A server log file is also referred to as a protocol file. This file contains information about accesses of a website on network level. With this, visitors can be counted.

The statistics from AWStats are more technically oriented. However, you don't have to be a mathematician to read them.

Be sure to check that there is no unjustified logging of full IP addresses in your server logs, as this is currently illegal. If you disagree, follow the link I mentioned and read my contribution on the subject!

My own analysis tool

On my website, my own analysis tool runs for counting visitors and measuring conversions. It uses no cookie and does not otherwise access the user's device. Instead, URL parameters are used that are dynamically added.

I'm currently working on a solution that evaluates collected data using Artificial Intelligence. New visitors can convert even better through optimized content. This is particularly interesting for online shops or click-out affiliate sites. But also websites that collect leads via a form can benefit greatly from my solution.

Conversion Tracking

When it comes to Conversion Tracking, one tries to determine whether an advertising measure has been successful. A common example is the analysis of displayed ads on the Google Advertising Platform (Google Ads). I mention Google Ads here exclusively because Google Analytics was optimized for this purpose.

Often several different versions of an ad are displayed. Ads are optimized for different keywords or linguistically slightly differently designed. For example, one can try to find out whether an ad works better if the advertiser is addressed with "You" instead of "You".

A conversion occurs when a Minimal goal is reached after a user clicks on an ad. You don't need to measure how often an ad was shown or clicked, because there are reports that Google provides to advertisers for this purpose.

If you have three ads, you might want to know which one generated the most sales. Other goals, therefore Conversions, could be subscribing to a newsletter, ordering a white paper, filling out a contact form or registering for a webinar.

To measure whether an ad has led to such a conversion, Google Analytics is of course not necessary. Rather, one must be able to uniquely identify each own advertisement. This can be done through at least three different mechanisms:

1. Each ad call a different landing page (i.e., a different URL on your website).
2. Each ad uses different URL parameters or parameter values.
3. Google Ads is configured so that the gclid is passed to you when clicking on an ad (or use UTM parameters).

The gclid is the Google Click Identifier. The gclid is passed to you in the form of a URL parameter. Google Analytics automatically tracks this gclid. This makes it tempting to use this data protection hostile tracker. However, you can also activate the so-called Auto-Tagging in a Google Ads account. With this, the gclid will be automatically tracked when one of your ads is clicked. The setting for this should be found in the account settings of Google Ads.

With so-called UTM-Parameters, it can also be concluded which campaign or ad group led to a click and visit of your landing page. UTM stands for Urchin Tracking Module. Urchin was the former name of Google Analytics. UTM-parameters are nothing other than URL parameters that are directly supported by Google Analytics. Instead of Analytics, any other tool or a custom script can process the parameters.

If each of your ads directs to its own page (URL), it already follows which ad led to how many page views. To distinguish direct traffic from clicks on ads, you can evaluate the link source. The link source is also referred to as Referer.

Instead of using the referrer, you can simply set certain URL parameters in your ads that are not used outside of your ads. In most cases this should be enough to identify the origin of a click. If you have evil competitors, attempts at cheating could skew your statistics.

So or so. With the options mentioned above, you can safely identify which ad led to a call of one of your pages. Now, when performing a conversion on your system, it must be recorded that the conversion was made by ad X. To do this, the path from clicking the ad to executing the conversion must be followed. This is possible through

• Cookies
• URL-Parameter
• Referrer Analysis

Cookies are no longer a good idea since § 25 TTDSG as of 01.12.2021.

URL-Parameter are a good way that even works when it's about two different pages: the Entry page for the ad and the page where the conversion took place.

A Referrer Analysis is useful when the landing page is also the conversion page. It seems sensible at least to think about having a common entry and conversion page. This way, at least the user doesn't have to wait for the transition from the landing page to the conversion page. Also, this makes conversion tracking easier.

What can I tell you? To do conversion tracking without Google Analytics, you need someone who can program. Maybe a talented amateur can get it done themselves if the landing page and conversion page are the same page. Whoever runs Google Ads has got some thousands of euros to spare anyway. Because whoever starts with 50 euro ad spend can just leave it be. Here one could dig deeper. Google is not dumb. The first ads will probably be favored by Google, according to my theory and own observation, in order to make the appetite grow bigger.

I'm sorry to have to tell you that you need to spend money to measure conversions properly. Actually, I don't regret saying this either. After all, we live in a highly complex world. There's hardly anything for free. And if there is, it's usually a bad or underdeveloped or even illegal solution. Whoever can do everything themselves can certainly not only program but also tile their own bathroom, repair their own car, build their own house, file their own tax return, or conduct their own court case. Everyone else should accept that for certain tasks you need an expert who will usually be paid in the currency of capitalism.

For most of you I have a good news. Google Ads are Bullshit, at least for almost all potential advertisers. You don't need Google Ads. Anyone can book Google Ads. Why should you be successful with Google Ads in particular? I recently received an milestone email from Google that this website, which you're seeing right now, was able to register tens of thousands of clicks within 28 days in the Google search engine. The exact number I won't mention here. It was a pretty impressive number anyway. I'm happy to tell you here that my advertising expenses were exactly zero euros.

To not lose sight of objectivity entirely, I would like to recommend a guest contribution on Google Ads at Dr. DSGVO. In it, Michael Hammer describes not only how it works but also when Google Ads can be sensible. Form your own opinion. I think most experts will agree with me: spending money on advertising only makes sense and at best then, after all important measures have been taken. A quick victory is rarely realistic.

Conclusion

Google Analytics is of no value for most website operators. For those still many who could benefit from tracking tool by Google, there are good alternatives.

For pure visitor counting and determining the most popular contributions, tools like Trackboxx, Matomo or a Log File Analyzer are sufficient. For widely used web systems such as WordPress there are further powerful options that should be more than enough for most needs.

I consider it a fairy tale that Google Ads advertising really brings something. In individual cases, success may indeed be present. Above all, I see success with advertising agencies that sell Google ads, as well as with Google as money magnets. Looking at all markets, not many market participants are successful with Google Ads advertising, if one looks at it proportionally. This is only a claim based on my own experience and numerous conversations with other entrepreneurs. Even my provocative question to please name an example of successful Google Ads marketing remained unanswered so far.

By the way, I could myself name a positive example for Google Ads advertising. The restriction here is that the market was extremely favorable at the time. I call this Singularity. Whoever waits for such extraordinary conditions will however also find other possibilities than Google Ads to be successful.

I was once told of a success with Google Ads in response to my critical question. It later turned out that only one of many ads led to a purchase. Since the product was high-priced, it was worth it.

When do you start boycotting Google services? You could also unsubscribe from Facebook, if you're still using this platform at all. Also WhatsApp can be avoided. Better are Threema, Signal or MySMS.