Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting the Czech Republic. Sectoral rules (healthcare, banking, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- § 7 Child consent — age lowered to 15 (vs GDPR default 16)
- § 8 Special-category data — Czech-specific permissions (employment, social security, public health)
- § 11 Processing for journalistic, academic, artistic, and literary purposes — derogations from Chapters II/III of GDPR
- § 50 ÚOOÚ supervisory powers + administrative-offence catalogue
- § 62 Fines — aligned with GDPR Art 83 ceilings; ÚOOÚ scaling guidance applies
- § 89a(3) Storage / read access on terminal equipment requires prior informed consent — analytics, marketing, A/B testing all in scope
- § 89a(3) Strictly-necessary exception — narrowly construed; user-requested service delivery only
- § 93 Confidentiality of communications + traffic-data minimization
- § 7(2) Email/SMS marketing — prior express opt-in required (no double-opt-in mandate, but recommended for evidentiary value)
- § 7(3) Soft opt-in — narrow exception for existing-customer + similar products + opt-out at every contact
- § 316(2) Workplace surveillance — serious operational reason required; mere convenience or HR curiosity is insufficient
- § 316(3) Prior written notice to employees — scope, extent, methods, duration
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2021-10 · Cookies — opt-in transition — ÚOOÚ methodology accompanying Act 374/2021 amendment — confirms opt-in baseline from 1 Jan 2022; analytics, marketing, and A/B testing never qualify for the strictly-necessary exception.
- 2022-04 · Google Analytics — ÚOOÚ aligned with EDPB GA4 taskforce conclusions following the Austrian DSB ruling — explicit consent + Schrems II supplementary measures expected pre-DPF.
- 2024-04 · Avast / Jumpshot — ÚOOÚ Avast decision (351M CZK) became final and binding April 2024 — landmark on pseudonymisation-vs-anonymisation (browsing data was re-identifiable, not anonymous) and onward transfers via Jumpshot subsidiary; precedent on browsing-data monetization disclosed only deep in privacy notice.
- 2024-09 · Cookie banner sweep — ÚOOÚ targeted audit of major Czech publishers and e-commerce — equal-prominence reject button required, pre-ticked boxes invalid, dark patterns flagged.
Notable enforcement
ÚOOÚ rarely tops EU enforcement charts in absolute terms but is capable of headline-grabbing fines when consent transparency or onward-transfer disclosures fail (Avast 351M CZK, Feb 2024 — sale of browsing data via the Jumpshot subsidiary). The regulator's posture is pragmatic: aligned with EDPB consensus rather than first-mover, willing to settle, and focused on consent layer, transparency, and direct-marketing breaches more than transfer-mechanism formalism. Czech Republic was an opt-out outlier on cookies until 1 Jan 2022 — the post-2022 enforcement curve is still maturing.
-
Avast Software s.r.o. ÚOOÚ · Art 5, 6, 13, 14 final
351M CZK fine — Avast transferred browsing histories of ~100M antivirus users to its Jumpshot subsidiary (which sold the data to advertisers and market-research clients) during 2019. ÚOOÚ rejected Avast's claim that the data was anonymous: the data was pseudonymised but re-identifiable. Insufficient transparency in the antivirus product privacy notice. Largest Czech GDPR fine to date. Decision became final and binding April 2024. Approx €14M.
-
Unnamed Czech retailer ÚOOÚ · Art 32 verify
Insufficient technical-organizational measures resulting in customer-data breach (login credentials + order history). Fine reflects mid-tier retailer turnover. Subject to verification — ÚOOÚ does not always publish full case dossiers.
-
Unnamed health-tech provider ÚOOÚ · Art 9, 32 settled
Insufficient encryption of special-category health data + missing DPIA for new patient-portal feature. Settled.
GA4 status
GA4 is usable in the Czech Republic only with prior, explicit, granular consent under § 89a of Act 127/2005 (Electronic Communications Act). ÚOOÚ aligned with the EDPB GA4 taskforce post-Austrian-DSB but did not issue an independent first-mover ruling. After EU-US DPF (10 Jul 2023), transfers to Google's US servers are lawful in principle while Google LLC remains DPF-certified. ÚOOÚ posture is pragmatic — TIA documentation expected but not aggressively second-guessed when DPF is in force.
| DPA | Stance |
|---|---|
| ÚOOÚ | Single federal regulator — pragmatic post-DPF. Opt-in still required under § 89a; TIA documentation expected. Czech-language consent layer recommended for Czech-targeted sites. |
Cross-border transfers + Schrems II
ÚOOÚ has historically been pragmatic on transfers — less aggressive than the Austrian DSB or French CNIL. Pre-DPF, ÚOOÚ aligned with EDPB GA4 conclusions but did not issue an independent first-mover ruling. Post-DPF (10 Jul 2023) ÚOOÚ accepts adequacy for DPF-certified US importers. A documented Transfer Impact Assessment is recommended but not aggressively second-guessed in routine deployments. Loss of DPF certification reverts the recipient to the pre-DPF strict posture.
EU 2021/914 SCCs are the fallback when DPF certification is absent or revoked. ÚOOÚ scrutiny on Module 2 onward-transfer clauses is moderate — focus tends to fall on consent layer, transparency, and onward transfers via subsidiaries (Avast/Jumpshot template).
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 4 · 0 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in the Czech Republic in 2026?
Do I need a DPO in the Czech Republic?
Which DPA is competent for my company?
What changed when § 89a went opt-in in 2022?
Is 'legitimate interest' a valid basis for analytics in the Czech Republic?
What about the works council and analytics tools?
Do I need a Czech Article 27 representative?
What language must my privacy notice be in?
At what age can a child consent in the Czech Republic?
Is double-opt-in required for email marketing in the Czech Republic?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Czech Republic's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.