Google Analytics 4:
Privacy & GDPR: Current Status
Recent Rulings by European Data Protection Authorities about Google Analytics
(Latest update: May 11th 2022)
- Austrian DPA’s ruling about Google Analytics
- French DPA’s ruling about Google Analytics (the first)
- French DPA’s ruling about Google Analytics (2nd and 3rd)
- Austrian DPA’s reaction and clarification against Google’s response
*Please note that these rulings are based upon “Universal Analytics”, a product which Google is sunsetting in 2023. Google will no longer release any updates to Universal Analytics. However most of what is in the rulings can also be applied to Google Analytics 4.
Important documents and links to read about the Trans-Atlantic Data Privacy Framework (“Privacy Shield 2.0”)
- European Commission Announcement
- European Commission Fact Sheet (.PDF)
- Europen Commission Fact Sheet 2? (.PDF)
- US White House Fact Sheet Announcement
NOYB (The privacy firm that filed the complaints against Google Analytics), and it’s founder Max Schrems, have issued a first reaction to the news of a “Privacy Shield 2.0” which can be read here.
As could be expected, Google reacted quite positively to the news in their most recent blog post.
Google’s Position on Recent European Data Protection Authority Rulings
(Latest update: April 6th 2022)
Google’s Position on the recent European DPA’s decisions
From what we can gather, Google remains convinced that the measures they offer to Google Analytics customers to protect the data should suffice. This blog post by Russell Ketchum (Head of Product Management for Google Analytics) outlines that stance. This .PDF clearly outlines how Google safeguards international data transfers for it’s advertising and analytics products and specifically responds to the “Schrems II” decision.
Google’s Vision on “The Way Forward”
For the longer term, it looks like Google is aiming to get to a “Privacy Shield 2.0” situation, which basically means that the geopolitical forces (in this case, the EU and US) will have to decide on a framework that works for both parties. You can read Google’s stance on this in this blog post and Google also refers to this statement from the European Commission issued in March 2021 on the topic.
New: Google’s Reaction to the Trans-Atlantic Data Privacy Framework can be read here.
Privacy Documents and Links related to Google Analytics 4
(Latest update: March 22nd 2022)
A list of relevant links and documents that Google is referring to throughout Google Analytics and it’s publications on the topic.
- Privacy Controls in Google Analytics (link)
- The Data Processing Terms required to accept when creating a Google Analytics 4 account that does business in the European Economic Area. (link)
- The “Read More” information article attached to the Data Processing Terms you are required to accept. (link)
- Learn how Google safeguards Google Analytics Data (link)
- Policy Requirement for Google Analytics Advertising Features (link)
- Advanced settings to allow for ads personalization (link)
- Information about Data Retention (link)
- Information about using User ID’s (link)
- Information about GA4 Data Deletion Requests (link)
- Information about Linking Google Ads & Google Analytics (link)
- Information about Linking Google Search Console & Google Analytics (link)