Web Analytics in the Age of Privacy

It was not long ago that web analytics simply meant to track everything, gather as much data as possible and then optimise your website based on the outcomes of your findings. With increased privacy regulations within the EU in GDPR (General Data Protection Regulation) and a revised Swiss FADP (Federal Act on Data Protection) tracking users has become a legal concern for all website owners. Thus bringing the challenge of how do you gather reliable data regarding your performance, without compromising privacy. 

Both data protection laws are quite similar, put in place to ensure companies follow strict rules regarding how they handle the personal data they collect. The most important principles are:

• Users must be informed about what is being tracked
• Users must give consent to the processing of their data
• Companies should only collect minimal data
• Personal data includes IP addresses and identifiers

Non compliance with these rules can lead to fines up to 250’000 CHF in Switzerland! Interestingly enough, these laws apply to any organisation that processes data from Swiss or EU users, not only Swiss companies. 

The most commonly used analytics tools such as Google Analytics are causing some issues with the new privacy laws, as the data is often transferred outside the EU and Switzerland. They also collect user level data such as IP addresses which allows for behavioral profiling which can require explicit consent. 

There are many new tools that are designed to fit with GDPR and Swiss FADP requirements, allowing for a cookieless website that does not collect any personal data, thus eliminating a cookie banner as well. Focusing on anonymous tracking modes is also becoming more and more trendy. 

To stay compliant with both GDPR and Swiss law, it is important to focus on the technical and legal measures! 

Legal requirements:

• Privacy policy needs to have your analytics usage clearly explained 
• Legal basis for data processing well defined
• Need to sign data processing agreements (DPAs) with analytics providers 

Technical measures:

• Enable IP anonymisation
• Limit data retention periods
• Ensure all data is transmitted securely, hosting within Switzerland/EU or self hosting can also help in ensuring the data is not transmitted elsewhere
• Allow users the ability to have their data deleted
• Use cookie banners when using cookies
• Ask for user consent!

With the evolution of web analytics, switching to privacy first principles early ensures that you can still gather useful information on your visitors, while staying within the new legal requirements. Be sure to discuss your options with our experts at Swiss Tomato!