User consent for Google Ads snippet under GDPR?
<p>Let's assume I run a website that doesn't place any cookies and doesn't track visitor's information. However, it uses Google Ads to attract visitors. And Google demands that advertisers disclose conversion data for each ad, and requires that I include a JavaScript tracking snippet on each page.</p>
<p>As far as I can tell, this snippet does not place cookies and neither does it collect personal data. I assume that if tracking data is connected to an individual, the individual gave their consent to that by signing up to a Google. The only thing the snippet does is telling Google's servers when a conversion takes place and that somehow they do some cross-site tracking.</p>
<p>Is running the Google Ads snippet something that visitors of my website should consent to, before I do this?</p>
<p>My assumption for now is that disclosing this in a privacy statement should suffice.</p>

<p>You are responsible for what data is being processed by your website. When you embed third party components on your website (e.g. iframes, scripts), you are at least jointly responsible with the third party providing these components. You are only responsible for what happens on the website (i.e. what processing is under your control), not for what the third party provider does with collected data on their services. However, note that information will be transferred to Google's servers regardless of whether the visitor has a Google account! The <em>Fashion ID</em> case is relevant case law establishing and explaining these points.</p>
<p>Since you are (jointly) responsible, you need a legal basis for collecting personal data through the tracking snippet and sharing it with the third party (here Google). For example, the legal basis could be a <em>legitimate interest</em>, or could be <em>consent</em>. A legitimate interest requires that you balance this interests against the interests, rights, and freedoms of the data subject (the site visitor). If the data subject wouldn't reasonably expect this tracking, you cannot rely on a legitimate interest. Consent can always work, except that it is a freely given, informed opt-in – likely unsuitable for conversion tracking. Which legal basis to use is primarily your responsibility.</p>
<p>You argue that the tracking snippet does not collect personal data. However, this argument is not well supported. Under the GDPR, personal data does not only include directly identifying information such as an email address, but also any information “relating” to an identifiable person. Identification includes the ability to single out someone, e.g. by a browser fingerprint. For purposes of conversion tracking, Google will clearly try to collect data that allows the visitor to be singled out, thus collecting personal data. Furthermore, specific kinds of information are regulated by the ePrivacy directive. This includes “traffic data” and “information stored on a terminal device”, regardless of whether this information is personal data under the GDPR. Under ePrivacy, such information can only be used as strictly necessary to provide the service requested by the user (and conversion tracking is not strictly necessary), or when the user gives their consent. Depending on what information is collected by the tracking snippet and on whether you are subject to ePrivacy, you would have to collect consent anyway.</p>
<p>There is also the issue that Google Ads is an US-based service, and transferring data to the US is largely illegal since the 2020 Schrems II ruling. The US do not provide an adequate level of data protection, so that transfers would require additional safeguards. Standard Contractual Clauses (SCCs) for Controller to Controller transfers are not sufficient by itself. Of course those extra safeguards are effectively impossible to implement and no one is doing this correctly, but it's worth considering that there is additional legal risk. Explicit consent can provide a legal basis for transfers even to a country with inadequate protections, but that mechanism is intended for occasional transfers.</p>
<p>In conclusion:</p>
<ul>
<li>you have wrongly concluded that no personal data would be involved</li>
<li>you are jointly responsible with Google for whatever data is processed by the conversion tracking snippet</li>
<li>you need a legal basis for sharing this data with Google</li>
<li>legitimate interest may be sufficient, depending on what data is involved (consider ePrivacy) and depending on the result of your legitimate interest balancing test</li>
<li>alternatively, you may require every visitors consent to track their conversions – unlikely to result in good data</li>
<li>additionally, such use of Google Ads may run into issues around international transfers due to the Schrems II ruling</li>
<li>this kind of stuff is difficult, and no one is really doing this correctly :/</li>
</ul>

gdpr