Düsseldorf Tourism: How the Company Increases its Google Analytics Data by 40% in Compliance with GDPR

Düsseldorf Tourismus GmbH is managed by a public body. Therefore, compliance with German data protection laws such as the General Data Protection Regulation (GDPR) and the Telecommunications-Telemedia Data Protection Act (TTDSG) is a high priority. The use of Google Analytics, a web analytics software from an American provider, was internally criticized due to the transfer of personal data to the USA. This was particularly frustrating since most of the metrics evaluated by Düsseldorf Tourismus (such as page views, popular products, entry and exit pages) are not personal data. With the functionality of client-side tracking, even when tracking a single page view, a variety of metadata, some of which are personal (such as IP address), are transmitted directly to the web analytics provider (in this case, Google).

Because of these metadata, client-side tracking always requires consent. Due to ungranted consents and additional browser tracking preventions (e.g., in the Safari browser) or ad blockers, a large part of the available data was lost.

The challenge was to implement privacy-compliant tracking to personalize the customer experience while also meeting the high data protection requirements as a public entity. Düsseldorf Tourismus wanted to ensure that all customer data were protected yet still enable effective tracking to generate tailored recommendations and offers. Due to the previous cookie banner, the company was missing out on many consents and therefore essential customer data for analysis purposes. For this reason, the company was looking for a consulting firm specialized in consent management and server-side tracking.

So, the task was to solve various problems: no processing of basic data due to the avoidance of personal data, a reduced data basis due to lack of consent and browser tracking preventions, and a lack of control over the data sent to Google.
‍
To solve these problems, a server-side tag manager is now being used. This first-party server receives the data from the browser and transmits different information to Google depending on the consent status. If a website visitor has not given consent, no personal data are collected & no cookies are used - the server-side tag manager only transmits the basic data (see below for an example) without meta-information to Google. Users who have consented to the processing of their personal data via the consent management tool will continue to be tracked fully – however, the first-party server-side tag manager prevents browser tracking preventions or ad blockers from taking effect.

In the search for an expert in consent management and server-side tracking, Düsseldorf Tourism came across DWC. The decision was made in favor of DWC due to their profound expertise and years of experience in the field of consent management and server-side tracking. It was ultimately the intersectional competence between data protection, digital analytics, and cloud management that convinced them.

The first-party setup consists of a Google Server Tag Manager in the cloud as well as the content delivery network Cloudflare. Within this construct, depending on consent, personal data are removed, data are enriched, and then forwarded to Google Analytics.

The infrastructure ensures efficient use of cloud resources, resulting in a cost-effective overall model. Through caching and a firewall, the load on the origin server is kept low, which results in less traffic and computing power being charged in the cloud. The App Engine is a cloud product that is characterized by its rapid, automatic scaling with increased traffic and short latencies.

While users who have given their consent are tracked in full, data collection for users without consent is limited to so-called "basic data". These basic data consist only of non-personalizable values such as:

These pieces of information, along with a generated user ID, are transmitted to Google. Unlike tracking with consent, the user ID is not stored in the browser in the form of a cookie, but is instead calculated server-side based on various characteristics of the visitor, supplemented with a timestamp and a salt (security key), and encrypted using SHA256. Neither Google nor Düsseldorf Tourismus has the ability to read the original values from this ID.