In recent months, there has been a lot of talk about how Google Analytics may be illegal in the EU as it may violate GDPR. There has been one verdict in Austria similar verdicts in France.
Google has now made its public statement about the implications of GDPR and Google Analytics. Specifically, Google goes through the Austrian ruling and points out that the verdict is based on a theoretical possibility that the US intelligence service could demand user data from Google. According to Google, this has never happened and will probably never happen either.
Google’s standpoint is that EU and the US must agree on matters related to data transfer. And that this issue is much bigger than whether only Google Analytics is illegal in the EU or not.
No more world wide web?
One danger is that the world will be separated into geographic areas. Europe will have its closed network, as will the US. Something we already have seen happen in other parts of the world. If we want an open, global internet, then the European Union and the US government will need to agree on a new data framework to keep us all connected.
Will server side be the solution?
Google Tag Manager Server Side makes it is possible to run our own server and own your data. The world is moving away from cookies and over to server side tracking. So this could be a viable way for Google Analytics to meet this concern and compete with other analysis tools like Matomo.
Bigger than Google Analytics
This issue is so much bigger than just Google Analytics. The EU and the US have to agree on having a functioning global web. Max Schrems says this regarding the issue: “In the long run we either need proper protections in the US, or we will end up with separate products for the US and the EU. I would personally prefer better protections in the US, but this is up to the US legislator — not to anyone in Europe.”
What does this mean for brands?
We expect that Google will go to great lengths to put in place a better-adapted scheme for GDPR. And that it will not necessarily be necessary to replace Google Analytics immediately. But you have to make an active choice if you want to own the data yourself. If you want to check out other options, there is, for example, Matomo.
Google Analytics already has some functionality to comply with the GDPR, but you may need to make changes actively. You can control data collection (eg IP anonymization, remarketing, data deletion), and Google also points out that there will be more functionality in Google Analytics within the next few weeks.
Recommendation
We do not recommend hasty decisions. Google takes the GDPR seriously and works on solutions to meet the EU’s demands.
Make sure your brand is GDPR compliant, collect consent for users where it is needed to save data (e.g., Google Analytics). Brands need to be sure to anonymize IP addresses for Google Universal Analytics (Google Analytics 4 does this automatically) and ensure that Google Analytics does not collect personal data.