Many website administrators use Google Analytics in order to measure the efficiency of their online marketing activities. Web analytics systems such as Google Analytics record page views and page interactions of a website visit.
Isolated page visits and interaction events, however, do not provide for useful analytics data.
Only in assigning those actions to users, a meaningful picture of a website's usage can arise.
So in tagging users with individual IDs, it becomes possible to analyze user sessions as a journey of interrelated actions throughout a website and session.
The individual ID, the client ID, is stored in a cookie.
Additionally to the recorded website interactions, technical information about the browser and the operating system is being captured with the tracking.
And by adding in information from other Google services such as Google Ads and Signals, the user information can then be further enriched.
For this purpose, Google utilizes unique click IDs from Google Ads link urls as well as active browser and client device log-in data.
Based on Google Click Identifier (GCLID), deeper campaign analysis is then possible.
And with active logins, demographic characteristics, interests and store visits are displayed in Google Analytics, for example.
For the site operator, these reports are anonymized, but with the help of all participating site operators, Google can further expand personal profiles in the background.
So even without involvement of additional Google services, a website owner must invoke active user consent for integration and execution of the Google Analytics script in the user's browser.
Because by tracking the user interactions on the website, individual user data including the ip address is being sent on to Google and stored a cookie in the user's device.
In adherance with GDPR, this form of tracking would still be justifiable as legitimate interest.
The ePrivacy regulation, however, makes any storage of data within the browser subject to active user consent, if the purpose of this data is to identify the user.
The German Federal Court (BGH) issued a decision based on this regulation in the Planet49 case (October 2017), requiring users to actively consent to the storage of cookies prior to playing.
As with Google Analytics, user-related data is being sent to servers in the USA, according to another popular case, the "Schrems II ruling", even with active consent regulatory conformity is disputable.