* Have you considered other analytics systems? * If so, what does Google Analytics have that's important enough to send all user traffic to Google? Google's understanding of what is and isn't okay has been challenged repeatedly by data protection authorities. If I understand your plan correctly, you do not intend to ask for _any_ consent before transferring traffic and usage data to Google. [2020-03-11: The Swedish Data Protection Authority imposes administrative fine on Google](https://edpb.europa.eu/news/national-news/2020/swedish-data-protection-authority-imposes-administrative-fine-google_en): > The Swedish Data Protection Authority imposes a fine of 75 million Swedish kronor (approximately 7 million euro) on Google for failure to comply with the GDPR. Google as a search engine operator has not fulfilled its obligations in respect of the right to request delisting. […] Google does not have a legal basis for informing site-owners when search result listings are removed and furthermore gives individuals misleading information by the statement in the request form. That is why the DPA orders Google to cease and desist from this practice. [2022-01-12: Austrian DSB: EU-US data transfers to Google Analytics illegal](https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal): > […] die Standarddatenschutzklauseln, die die Erstbeschwerdegegnerin mit dem Zweitbeschwerdegegner abgeschlossen hat, kein angemessenes Schutzniveau gemäß Art. 44 DSGVO bieten, […] die Maßnahmen, die zusätzlich zu den in Spruchpunkt 2. b) genannten Standarddatenschutzklauseln getroffenen wurden, nicht effektiv sind, da diese die Überwachungs- und Zugriffsmöglichkeiten durch US-Nachrichtendienste nicht beseitigen, > Soweit die Beschwerdegegner ins Treffen führen, dass keine „Mittel“ verwendet würden, um die hier gegenständlichen Kennnummern mit der Person des Beschwerdeführers in Verbindung zu bringen, ist ihnen neuerlich entgegenzuhalten, dass die Implementierung von Google Analytics auf www.[REDACTED].at eine Aussonderung iSd ErwGr 26 DSGVO zur Folge hat. Mit anderen Worten: Wer ein Tool verwendet, welches eine solche Aussonderung gerade erst ermöglicht, kann sich nicht auf den Standpunkt stellen, nach „allgemeinem Ermessen“ keine Mittel zu verwenden, um natürliche Personen identifizierbar zu machen. [2022-02-10: Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply](https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply): > The 10 February 2022, the CNIL, which was cooperating with its European counterparts, has issued and order to comply to several organizations using Google Analytics because of illegal transfers of data to the United States. […] A simple change in the tool's settings is not enough [2022-04-22: Austrian DPA rejects “risk based approach” for data transfers to third countries](https://noyb.eu/en/update-noybs-101-complaints-austrian-dpa-rejects-risk-based-approach-data-transfers-third-countries): > In seiner Stellungnahme vom 9. April 2021 im Parallelverfahren zur GZ: DSB- D155.027 hat der Zweitbeschwerdegegner bei Frage 9 zwar vorgebracht, dass er eine derartige Information nur bekommt, wenn gewisse Voraussetzungen erfüllt sind, wie etwa die Aktivierung von spezifischen Einstellungen im Google-Account. Nach Auffassung der Datenschutzbehörde vermag dieses Vorbringen nicht zu überzeugen. […] Dabei kann das Vorbringen der Beschwerdegegner rund um die „Anonymisierungsfunktion der IPAdresse“ dahingestellt bleiben, da die vollständige IP-Adresse jedenfalls für einen gewissen – wenn auch sehr kurzen – Zeitraum am Server von Google LLC verarbeitet wird. Dieser kurze Datenverarbeitungszeitraum ist ausreichend, damit der Tatbestand des Art. 4 Z 2 DSGVO erfüllt wird. > Es ist nämlich nicht erforderlich, dass die Beschwerdegegner jeweils alleine einen Personenbezug herstellen können, dass also alle für die Identifizierung erforderlichen Informationen bei diesen sind (vgl. die Urteile des EuGH vom 20. Dezember 2017, C-434/16, Rz 31, sowie vom 19. Oktober 2016, C 582/14, Rz 43). Vielmehr ist ausreichend, dass irgendjemand – mit rechtlich zulässigen Mitteln und vertretbarem Aufwand – diesen Personenbezug herstellen kann (vgl. Bergauer in Jahnel, DSGVO Kommentar Art. 4 Z 1 Rz 20 mVa Albrecht/Jotzo, Das neue Datenschutzrecht der EU 58). [2022-06-23: Italian SA bans use of Google Analytics No adequate safeguards for data transfers to the USA](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9782874#english): > The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. […] In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds. If you go ahead with this plan, will you at _least_ consider [respecting the Do Not Track header](https://meta.stackexchange.com/a/110308/308065)? --- I've had a little look at Google Analytics 4, and – based solely on what Google claims about its functionality – it's not something you can opt users into without their consent. The Internet Archive did not let me save a current version of the [User exploration](https://web.archive.org/web/20220417052210/https://support.google.com/analytics/answer/9283607) page, so I've documented the differences between the current version and that version: Before: > To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from By User-ID and device to By device only: Current: > To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from Blended Identity which factors in User ID, Google Signals and Modeling to By Device only: Aside from that, the page is identical, so I will quote: > When a user is logged in, event data associated with that user is identified by the user ID you provide. When the user is logged out, that user's event data is identified by an anonymous ID. * Do you intend to give Google our user IDs, in association with our activity? This information _should_ be written in your privacy policy, [but it's not](https://meta.stackexchange.com/a/370343/308065). And the point is somewhat moot, since Google could easily deduce such information from just an "anonymous" ID. I'm no Google Analytics expert, but it feels like you'd need to give them _some_ ID anyway, so you could comply with GDPR Article 17 "Right to erasure" requests. It's a bit of a catch-22 for you, though: if you _give_ Google this data, then you're giving them explicitly personally-identifying information that they can use to connect more dots about us. If you _don't_, though, what Google gets is _already_ personally-identifying to _Google_ – but we have no way of requesting it deleted, because _you_ can't identify which information is ours! Speaking of, [\[GA4\] Data-deletion requests](https://web.archive.org/web/20220630133659/https://support.google.com/analytics/answer/9940393?hl=en) said (in June): > If you need to delete data from the Analytics servers for any reason, then you can use a data-deletion request to issue a request for its removal. > > You can have a maximum of 12 active (in grace period / pending deletion) requests per property at any one time. > > You can cancel any request within 7 days from the time it was created. Use the request-details page. During the first 7 days, you can also see a preview of the effects of the deletion in your reports and in Explorations. > > A data-deletion request can take between 7 and 63 days to be processed, depending on the amount of data to be deleted, and data must be more than 12 days old before it can be deleted. > If you're using consent mode for your property, you may need to add seven calendar days to the end date of your data-deletion request to ensure that any value you are specifically targeting for deletion is deleted from behavioral models. This is because Analytics trains machine-learning models on data from consented users (i.e., the data you may be trying to delete) and approximates future user behavior based on that training data. This raises red flags. Are "consented users" actually consenting to this use of their data? Your _current_ consent system [isn't consent](https://meta.stackexchange.com/a/359493/308065), and the big button is labelled: > Accept all cookies with the small print: > **Your privacy** > > By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our [Cookie Polic](https://stackoverflow.com/legal/cookie-policy)y. Your [cookie policy](https://stackoverflow.com/legal/cookie-policy) says nothing about training machine learning models. Even if you _stretch_ and assume people consent to what's in the cookie policy, they're not consenting to this. This terminology is misleading. --- I've said all this before, more than once, so this time I'll just quote the UK's ICO. [How do we comply with the cookie rules? | ICO](https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-we-comply-with-the-cookie-rules/): > A number of services exist that provide an analytics function, and it could be easier for you to use these instead of building your own. However, it can be more difficult to obtain consent for third-party analytics cookies as there is no direct relationship between the third-party organisation and the user of your site. In these cases you need to ensure the information you provide to users about these cookies is absolutely clear and is highlighted in a prominent place – for example you can’t just include it through a general privacy policy link. [What are cookies and similar technologies? | ICO](https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-cookies-and-similar-technologies/): > Functions usually performed by a cookie can be achieved by other means. This could include, for example, using certain characteristics to identify devices so that visits to a website can be analysed. > > PECR applies to any technology that stores or accesses information on the user’s device. This could include, for example, HTML5 local storage, Local Shared Objects and fingerprinting techniques. > > **Example** > > Device fingerprinting is a technique that involves combining a set of information elements in order to uniquely identify a particular device. > > Examples of the information elements that device fingerprinting can single out, link, or infer include (but are not limited to): > > * data derived from the configuration of a device; > * data exposed by the use of particular network protocols; > * CSS information; > * JavaScript objects; > * HTTP header information, > * clock information; > * TCP stack variation; > * installed fonts; > * installed plugins within the browser; and > * use of any APIs (internal and/or external). > > It is also possible to combine these elements with other information, such as IP addresses or unique identifiers, etc. > > PECR also applies to technologies like scripts, tracking pixels and plugins, wherever these are used. > From now on, this guidance uses the single term ‘cookies’ to refer to cookies and similar technologies that PECR applies to, […] Let's compare this to [Mad Scientist's non-exhaustive list](https://meta.stackexchange.com/a/381671/308065) of what Google claims they collect from "non-consenting" users. Or maybe you could look at what the Austrian DSB has found that Google Analytics _actually_ collects? <!-- I am not a lawyer; in fact, I am laughably ignorant on privacy law. This is not legal advice, and what I've quoted is mere _guidance_. But I would recommend running this past your legal team some time _before_ your proposal goes live, because there are people on this network who are not ignorant on [privacy law](https://law.stackexchange.com/help/badges/247/privacy) or [GDPR](https://law.stackexchange.com/help/badges/135/gdpr). -->