Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data

Written by AI from the linked story. Not reviewed by an editor. How this works

Google failed to fulfill a complete data subject access request (DSAR) under GDPR Article 15 by omitting personal data processed through cookies and third-party tracking pixels (e.g., Facebook Pixel) on YouTube. This partial disclosure violates the fundamental right of individuals to know what personal data is held about them and how it is processed. The Austrian DSB ruling reinforces that controllers must account for all data processing activities — including those facilitated by third-party technologies embedded in their platforms — when responding to access requests. Incomplete DSARs erode user trust, expose organizations to regulatory enforcement, and signal broader gaps in data inventory and governance practices.

Tactical Insight

Immediate actions

Conduct a full audit of all personal data processing activities, including data collected via cookies, pixels, and third-party scripts, to ensure DSARs can be comprehensively fulfilled.
Establish a documented DSAR response procedure that explicitly maps all data sources — first-party and third-party — to ensure no data category is omitted.

Long-term improvements

Maintain a continuously updated Records of Processing Activities (RoPA) register as required by GDPR Article 30, covering all tracking technologies deployed across platforms.
Implement a centralized data subject rights management system to automate, track, and audit all access, erasure, and portability requests end-to-end.
Train legal, privacy, and engineering teams jointly on GDPR obligations to ensure technical data flows are accurately reflected in regulatory responses.

Detection & compliance measures

Schedule periodic internal audits and simulated DSARs to validate that response processes capture all personal data categories, including behavioral and tracking data.
Appoint or empower a Data Protection Officer (DPO) to review DSAR responses before submission to ensure completeness and regulatory accuracy.