After receiving a letter from a German supervisory authority, we would like to urgently inform you that the use of Google Tag Manager cannot be based on legitimate interest. It requires active consent by the user in the cookie banner to agree to the data transfer to Google. Any integration of Google services carries a high risk for the individual. It is not possible to rely on legitimate interest, even if the service is highly useful for the website operator.
In the case of the Google ReCAPTCHA service, German supervisory authorities are speaking out against its use in accordance with data protection regulations. Here, too, data is transferred to Google in the USA „without being asked“. Website operators should definitely check alternatives. If Google ReCAPTCHA is nevertheless integrated, the responsible party must be aware that it must be able to prove its lawful use in accordance with Art. 5 par. 2 GDPR. Anyone who cannot demonstrate how Google processes the user data cannot inform the user transparently and cannot prove the lawful use.
The website operator not only has a legitimate interest in using captchas, but is even obliged to do so, as he must ensure the availability of the service. This means „self-built“ captchas are desirable.