Gclid: data protection assessment

The admissibility under data protection law of the transmission of conversion data via etracker analytics to Google Ads using the status ad_user_data=granted under the legal basis of overriding legitimate interest.

---

Consent-free transmission of conversion data to Google Ads via etracker analytics

1. subject of the investigation

It must be examined whether the transmission of the Google Click ID (GCLID) for conversion measurement without active consent complies with the requirements of the GDPR and the TDDDG and whether the labeling as granted in the Google interface protocol is legally justifiable.

2 Legal basis and applicability of the TDDDG

According to § Section 25 (1) TDDDG consent is required for access to information in the user’s terminal equipment. However, since etracker analytics works without cookies as standard (cookieless) and does not read any information on the end device that is not technically required, the consent requirement under the TDDDG does not apply. The data protection assessment is therefore primarily based on the GDPR.

3. personal reference of the GCLID

A central aspect is the qualification of GCLID as personal data in accordance with Art. 4 No. 1 GDPR.

• Lack of additional knowledge: The website operator cannot identify a natural person on the basis of the GCLID alone.
• ECJ case law (C-413/23 P – “SRB”): On 04.09.2025, the ECJ confirmed that pseudonymous data does not constitute personal data for a third party (in this case the website operator) unless the latter has the legal or factual means to carry out re-identification with reasonable effort.
• Earmarking: As remarketing and target group segments are technically excluded, the website operator lacks the necessary additional knowledge for identification. In this context, the GCLID is merely a technical assignment key for an ad for the processor, not an online identifier of a person.

4. balancing of interests pursuant to Art. 6 para. 1 lit. f GDPR

Even if a theoretical personal reference is assumed, the processing is justified by legitimate interests. The criteria of the ECJ (judgment C-252/21) are met as follows:

• Genuine interest: The optimization of advertising bids and the measurement of success are legitimate economic interests (Recital 47 GDPR).
• Necessity and milder means: The server-side upload via etracker is a much milder means than the use of the Google Tag. No IP addresses, device fingerprints or detailed time stamps are transmitted. The data is reduced to the absolute minimum.
• Reasonable expectations: Users must expect a statistical analysis of advertising clicks, provided that no profiling or re-identification for advertising purposes (remarketing) takes place. This is ensured by the etracker configuration.
• Audit confirmation: The expert opinion from ePrivacy Consult dated 14.10.2025 confirms the legality of this procedure on the basis of legitimate interest.

5. interpretation of the parameter ad_user_data=granted

The Google interface only offers binary options (granted / denied).

• Legal interpretation: The parameter controls the permissibility of the data transfer. Since the transfer here is based on Art. 6 para. 1 lit. f GDPR (legitimate interest) is lawful, the technical flag granted is set correctly.
• Lack of exclusivity of consent: Neither the GDPR nor the TDDDG stipulate that a transfer must be based exclusively on consent. “Granted” in this context means “legally authorized”.

6. consideration of official guidelines

The guidelines of the German Data Protection Conference (DSK) recognize that in individual cases, the legitimate interest may apply if the appropriate considerations are made. The etracker solution represents precisely such a qualified special case, which fulfills the strict proportionality requirements by reducing traffic data. The transmission of user data for retargeting, on the other hand, requires at least the data protection safeguard of informed and voluntary consent (consent banner).

---

Conclusion

The transmission of conversion data via etracker analytics to Google Ads is permitted without consent. The use of the status granted is legally compliant, as it technically reflects the existing legal basis of legitimate interest (Art. 6 para. 1 lit. f GDPR). It is used solely for the purpose of conversion measurement to statistically check the success of an ad and not to identify and track the individual. Processing is carried out in accordance with the principle of data minimization and purpose limitation.

---