GDPR and Google Analytics

Many businesses use Google Analytics as their only web analytics tool and are very happy with it. For a start, it’s relatively straightforward to use

It’s a system that works for many businesses.

So what has GDPR got to do with Google Analytics?

From 25 May 2018 if GDPR applies to you then you need to

We know that GDPR is going to apply to personal data of EU individuals when data controllers and data processors are either

But surely Google Analytics doesn’t ever use personal data?

The problem is that the much broader definition of personal data includes data from which you can identify someone “directly or indirectly” using “all means reasonably likely to be used”, so any such information is personal data. It includes pseudonymous data, online identifiers and cookies which, as the GDPR states, can be combined with other data to create “profiles of the natural persons and identify them”.

The Google Analytics process means that both you are Google are sharing data:

It is actually a breach of the Google Analytics agreement to share “personally identifiable” data – but what about

Yes, exchanging “personally identifiable” is not supposed to happen, but it does.

Remember also that it’s not just about one individual data set or Google Analytics report on its own. What happens if you combine data sets that may appear unrelated such as a Google Analytics report with existing data you hold? If you can identify an individual from that combined data then it’s personal data.

You might even have others involved in your Google Analytics process because you outsource your Google Analytics. Do you outsource? Does another organisation manage your account for you? If so, we then start to get into the realms of who owns the account (often a grey area anyway with agencies)

Will you be able to use the data that you collect from individuals as part of the Google Analytics process?

You can only process personal data if you have a lawful basis for doing so. At the moment, you may be relying on the individuals’ consent, but GDPR stamps all over that because your current consent mechanism is probably not GDPR complaint since the criteria is much tighter.