Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Poland. Sectoral rules (healthcare, banking, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- Art 5 Child consent age — kept at 16 (Poland did not derogate downward under GDPR Art 8(1))
- Art 8 DPO designation procedures — notification to UODO within 14 days
- Art 102 Public-sector fine cap — 100,000 PLN max for state/local government bodies
- Art 107 Criminal liability — up to 3 years' imprisonment for unlawful processing of special-category data
- Art 173(1) Storage / read access on terminal equipment requires prior, informed consent of the subscriber/end-user
- Art 173(2) Strictly-necessary exception — narrow; analytics, marketing and A/B testing do not qualify
- Art 173(3) Information duty — purpose, scope, and means of withdrawal must be presented before consent
- Art 10(1) Unsolicited commercial electronic communication prohibited without prior consent
- Art 10(2) Consent must be obtained before any commercial message is sent — written form not required, but evidentiary burden lies with the sender
- Art 24 Administrative fines for spam — up to 5,000 PLN per offence (in addition to UODO sanctions on data side)
- Art 22(1) Closed catalogue of employee data — analytics on internal tools handling more must have a non-consent legal basis
- Art 22(2) CCTV monitoring — limited to safety, property protection, work-organisation control
- Art 22(3) Email/IT monitoring — only with employee notification 2 weeks before launch
- Art 22(3b) Other monitoring (location, biometrics, productivity tools) — same procedural rules as email/IT
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2019-09-19 · Morele.net fine — First major Polish GDPR fine — 2.8M PLN against e-commerce retailer for inadequate security measures after data breach affecting 2.2M customers.
- 2022-01 · Cookie consent guidance — UODO + UKE joint position — pre-ticked boxes invalid, equal-prominence reject button required, scrolling does not constitute consent.
- 2024-06 · PESEL handling — UODO President emphasised heightened obligations around PESEL national identifier — must not be requested unnecessarily, never displayed in user interfaces in full, breach reports prioritised when PESEL is implicated.
- 2025-03 · Polish-language notices — UODO position aligned with Ustawa o języku polskim — privacy notices and consent banners on Polish-targeted sites must be available in Polish; English-only is insufficient where Polish consumers are addressed.
Notable enforcement
UODO sits in the middle tier of EU enforcers by fine volume — fewer headline-amount cases than France/Italy/Germany, but consistent quarterly activity in security, telecom, and unsolicited-marketing dossiers. Polish administrative courts (WSA Warsaw, NSA) have annulled or reduced several flagship fines (Bisnode, ClickQuickNow), creating a trend where UODO pursues smaller-but-defensible amounts. Recent focus areas: PESEL handling, telecom sector (Toya, Wirtualna Polska, telco breach notifications), digital-platform consent layers, and finance-sector security breaches.
-
Major bank (anonymised) UODO · Art 5, 32 stood
Finance-sector breach — improper PESEL handling in internal tools + retention beyond purpose. UODO 2025 PESEL-focus dossier.
-
Morele.net (re-issued) UODO · Art 32, 5(1)(f) stood
Re-issued fine after NSA annulment of 2019 decision. PLN 3.8M for the same 2018 data breach — UODO confirmed inadequate technical-organisational measures (encryption, two-factor authentication absent).
-
Morele.net UODO · Art 32 annulled-then-reissued
2.8M PLN fine — inadequate security measures after data breach affecting 2.2M customers (e-commerce retailer). Annulled by Supreme Administrative Court (NSA) Feb 2023 (case III OSK 3945/21) on procedural grounds (UODO refused Morele's request to appoint an external technical expert). UODO re-issued a fresh decision 8 Feb 2024 — PLN 3.8M (~€870K) confirming the underlying security failures.
-
ID Finance Poland UODO · Art 32 stood
1M PLN — security failures around lender platform. Stood on appeal.
-
Wirtualna Polska UODO · Art 32 stood
Digital-media group — security incident affecting reader accounts. Fine reflects mitigation steps taken; UODO emphasised PESEL-adjacent identifiers in published decision.
-
Toya Sp. z o.o. UODO · Art 33, 34 stood
Telecom operator — late notification of personal-data breach (subscriber data exposed). 247K PLN. Stood.
-
Bisnode Poland UODO · Art 14 annulled
220K PLN — failure to fulfil information duty toward 6M individuals whose data was scraped from public registers. Annulled by NSA (Polish Supreme Administrative Court) in 2022 — proportionality grounds.
GA4 status
GA4 is usable in Poland with prior, explicit, granular consent under Art 173 Prawo telekomunikacyjne. UODO has aligned with EDPB and accepts post-DPF transfers (10 Jul 2023) while Google LLC remains DPF-certified. UODO has not issued the GA4-specific decisions seen in CNIL/Datatilsynet/Garante; posture is moderate. Polish-language consent banner and privacy notice required.
| DPA | Stance |
|---|---|
| UODO | Moderate post-DPF — transfers lawful with DPF + explicit consent. Polish-language banner and notice required. PESEL must never enter the analytics dataset. |
Cross-border transfers + Schrems II
UODO accepts EU-US Data Privacy Framework adequacy (10 Jul 2023) for DPF-certified US importers — moderate posture aligned with EDPB. For non-DPF US recipients, Schrems II Transfer Impact Assessment + supplementary measures expected. UODO has not issued enforcement action against GA4 specifically (unlike CNIL or Datatilsynet), but expects documented basis where transfers are involved.
EU 2021/914 SCCs remain the fallback when DPF certification is absent or revoked. UODO references EDPB Recommendations 01/2020 on supplementary measures. Onward-transfer documentation under SCC Module 2/3 is reviewed during inspections.
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 4 · 0 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in Poland in 2026?
Does UODO actively enforce against analytics and cookies?
Do I need a Polish DPO?
What is the child-consent age in Poland?
Must my privacy notice be in Polish?
How must I handle the PESEL number?
Is 'legitimate interest' a valid basis for analytics in Poland?
What about employee monitoring and analytics tools (Kodeks pracy)?
Do I need a Polish Article 27 representative?
Is double opt-in required for email marketing in Poland?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Poland's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.