ATTENTION: UPDATE JULY 2022
As of late, the Italian Garante has made a ruling against the utilization of Analytics, citing concerns regarding the transfer of user data to the United States. To ensure compliance, if you wish to continue employing Google Analytics on your website, you must:
- Ensure that Google Analytics 4 is installed.
- Obtain explicit user consent, as Google Analytics no longer falls under the category of technical cookies.
- Implement a "data proxification" mechanism to transmit anonymized data to Google's servers.
In response to these requirements, we have developed My Agile Pixel: the ultimate solution for overcoming Analytics blocks.
Visit our site and discover how to seamlessly integrate Google Analytics with My Agile Pixel, enabling its continued use on your website.
The text below serves as a point of reference.
Let's address this unequivocally: analytical cookies constitute profiling, and this fact is beyond dispute.
Foreword
In the FAQ issued by the Italian Privacy Guarantor, specifically FAQ number 4 addressing the question "Are analytics cookies considered 'technical' cookies?" the response is clear-cut: "NO".
Furthermore, the second paragraph of the same FAQ elaborates:
"If, however, statistical analysis is outsourced to third parties, user data must be minimized in advance and must not be amalgamated with other processes or transmitted to additional third parties. Under these conditions, the same guidelines governing information dissemination and consent for technical cookies apply to analytics cookies"
In FAQ number 5, however, addressing the question "Is the user's consent required for the installation of cookies on his/her terminal?", the response is: "It depends on the purposes for which the cookies are used and, therefore, whether they are 'technical' or 'profiling' cookies."
Indeed, for the installation of technical and analytics cookies configured in accordance with data minimization principles, users' consent is not mandatory, although providing information (as per Article 13 of EU Regulation 2016/679) is still required.
However, genuine profiling cookies or other tracking tools can only be employed if users have provided consent after receiving simplified information."
In FAQ number 6, to the question.
<<How should the site owner provide the simplified disclosure and request consent for profiling cookies?>>, the answer is:
[...] "While respecting the accountability of the owner and therefore its freedom to choose the measures and solutions that best ensure compliance with legal obligations, the Guarantor nevertheless suggests the adoption of a mechanism whereby, the moment the user accesses a website (on the home page or any other page), a banner immediately appears containing an initial "brief" information notice, a request for consent to the use of cookies and a link to access a more "extended" information notice. On this page, the user can find more and more detailed information about cookies choose which specific cookies to allow."
Indeed, given these foundational premises, it is unequivocal to assert that analytics cookies fall under the category of profiling rather than technical cookies. While they can be utilized without explicit consent if implemented according to the principle of data minimization, they still necessitate a simplified disclosure, typically facilitated through a privacy banner.
To elaborate further, if a website refrains from installing cookies (apart from technical cookies essential for site functionality), the implementation of a "banner" system may not be necessary. However, it remains imperative to specify this aspect in the site's privacy policy, commonly referred to as the Privacy Policy.
Conversely, when employing analytics cookies, which are classified by the Guarantor as profiling cookies, a privacy banner for brief disclosure becomes imperative. Nevertheless, analytics may be executed without explicit consent if conducted in compliance with data minimization principles.
In Summary
As highlighted from the outset, analytics cookies are indeed classified as profiling cookies by the Italian Data Protection Authority.
It's worth noting that initially, the Authority categorized all analytics cookies, including those employing anonymization techniques, as profiling. However, they later corrected this stance, acknowledging the interpretation of data minimization. Consequently, in cases where data minimization and anonymization are effectively implemented, activation can proceed without the user's prior consent.
It's important to dispel any misconception regarding analytics cookies as technical cookies. Such misinterpretation could lead site operators to misconfigure them, potentially resulting in the tracking of personal data.
Furthermore, it's crucial to recognize that when discussing analytics, the Privacy Guarantor is addressing the broader spectrum, not solely focusing on Google Analytics and its ecosystem. Numerous other analytics tools exist, all subject to the same regulatory guidelines.
In conclusion, exercising caution with analytics cookies is paramount, given their complex nature. Seeking guidance from an expert in the field is advisable to ensure compliance and mitigate the risk of substantial penalties imposed by the Supervisory Authority.
