- Have you considered other analytics systems?
- If so, what does Google Analytics have that's important enough to send all user traffic to Google?
Google's understanding of what is and isn't okay has been challenged repeatedly by data protection authorities. If I understand your plan correctly, you do not intend to ask for any consent before transferring traffic and usage data to Google.
2020-03-11: The Swedish Data Protection Authority imposes administrative fine on Google:
The Swedish Data Protection Authority imposes a fine of 75 million Swedish kronor (approximately 7 million euro) on Google for failure to comply with the GDPR. Google as a search engine operator has not fulfilled its obligations in respect of the right to request delisting. […] Google does not have a legal basis for informing site-owners when search result listings are removed and furthermore gives individuals misleading information by the statement in the request form. That is why the DPA orders Google to cease and desist from this practice.
2022-01-12: Austrian DSB: EU-US data transfers to Google Analytics illegal:
[…] die Standarddatenschutzklauseln, die die Erstbeschwerdegegnerin mit dem Zweitbeschwerdegegner abgeschlossen hat, kein angemessenes Schutzniveau gemäß Art. 44 DSGVO bieten, […] die Maßnahmen, die zusätzlich zu den in Spruchpunkt 2. b) genannten Standarddatenschutzklauseln getroffenen wurden, nicht effektiv sind, da diese die Überwachungs- und Zugriffsmöglichkeiten durch US-Nachrichtendienste nicht beseitigen,
Soweit die Beschwerdegegner ins Treffen führen, dass keine „Mittel“ verwendet würden, um die hier gegenständlichen Kennnummern mit der Person des Beschwerdeführers in Verbindung zu bringen, ist ihnen neuerlich entgegenzuhalten, dass die Implementierung von Google Analytics auf www.[REDACTED].at eine Aussonderung iSd ErwGr 26 DSGVO zur Folge hat. Mit anderen Worten: Wer ein Tool verwendet, welches eine solche Aussonderung gerade erst ermöglicht, kann sich nicht auf den Standpunkt stellen, nach „allgemeinem Ermessen“ keine Mittel zu verwenden, um natürliche Personen identifizierbar zu machen.
The 10 February 2022, the CNIL, which was cooperating with its European counterparts, has issued and order to comply to several organizations using Google Analytics because of illegal transfers of data to the United States. […] A simple change in the tool's settings is not enough
2022-04-22: Austrian DPA rejects “risk based approach” for data transfers to third countries:
In seiner Stellungnahme vom 9. April 2021 im Parallelverfahren zur GZ: DSB- D155.027 hat der Zweitbeschwerdegegner bei Frage 9 zwar vorgebracht, dass er eine derartige Information nur bekommt, wenn gewisse Voraussetzungen erfüllt sind, wie etwa die Aktivierung von spezifischen Einstellungen im Google-Account. Nach Auffassung der Datenschutzbehörde vermag dieses Vorbringen nicht zu überzeugen. […] Dabei kann das Vorbringen der Beschwerdegegner rund um die „Anonymisierungsfunktion der IPAdresse“ dahingestellt bleiben, da die vollständige IP-Adresse jedenfalls für einen gewissen – wenn auch sehr kurzen – Zeitraum am Server von Google LLC verarbeitet wird. Dieser kurze Datenverarbeitungszeitraum ist ausreichend, damit der Tatbestand des Art. 4 Z 2 DSGVO erfüllt wird.
Es ist nämlich nicht erforderlich, dass die Beschwerdegegner jeweils alleine einen Personenbezug herstellen können, dass also alle für die Identifizierung erforderlichen Informationen bei diesen sind (vgl. die Urteile des EuGH vom 20. Dezember 2017, C-434/16, Rz 31, sowie vom 19. Oktober 2016, C 582/14, Rz 43). Vielmehr ist ausreichend, dass irgendjemand – mit rechtlich zulässigen Mitteln und vertretbarem Aufwand – diesen Personenbezug herstellen kann (vgl. Bergauer in Jahnel, DSGVO Kommentar Art. 4 Z 1 Rz 20 mVa Albrecht/Jotzo, Das neue Datenschutzrecht der EU 58).
The Italian SA found that the website operators using GA collected, via cookies, information on user interactions with the respective websites, visited pages and services on offer. The multifarious set of data collected in this connection included the user device IP address along with information on browser, operating system, screen resolution, selected language, date and time of page viewing. […] In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.
If you go ahead with this plan, will you at least consider respecting the Do Not Track header?
I've had a little look at Google Analytics 4, and – based solely on what Google claims about its functionality – it's not something you can opt users into without their consent.
The Internet Archive did not let me save a current version of the User exploration page, so I've documented the differences between the current version and that version:
Before:
To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from By User-ID and device to By device only:
Current:
To see all of a user's event data identified by only the anonymous ID, you need to change the reporting identity from Blended Identity which factors in User ID, Google Signals and Modeling to By Device only:
Aside from that, the page is identical, so I will quote:
When a user is logged in, event data associated with that user is identified by the user ID you provide. When the user is logged out, that user's event data is identified by an anonymous ID.
- Do you intend to give Google our user IDs, in association with our activity?
This information should be written in your privacy policy, but it's not. And the point is somewhat moot, since Google could easily deduce such information from just an "anonymous" ID.
I'm no Google Analytics expert, but it feels like you'd need to give them some ID anyway, so you could comply with GDPR Article 17 "Right to erasure" requests. It's a bit of a catch-22 for you, though: if you give Google this data, then you're giving them what's explicitly personally-identifying information. If you don't, though, what Google gets is already personally-identifying to Google – but we have no way of requesting it deleted, because you can't identify which information is ours!
Speaking of, [GA4] Data-deletion requests said (in June):
If you need to delete data from the Analytics servers for any reason, then you can use a data-deletion request to issue a request for its removal.
You can have a maximum of 12 active (in grace period / pending deletion) requests per property at any one time.
You can cancel any request within 7 days from the time it was created. Use the request-details page. During the first 7 days, you can also see a preview of the effects of the deletion in your reports and in Explorations.
A data-deletion request can take between 7 and 63 days to be processed, depending on the amount of data to be deleted, and data must be more than 12 days old before it can be deleted.
If you're using consent mode for your property, you may need to add seven calendar days to the end date of your data-deletion request to ensure that any value you are specifically targeting for deletion is deleted from behavioral models. This is because Analytics trains machine-learning models on data from consented users (i.e., the data you may be trying to delete) and approximates future user behavior based on that training data.
This raises red flags. Are "consented users" actually consenting to this use of their data? Your current consent system isn't consent, and the big button is labelled:
Accept all cookies
with the small print:
Your privacy
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
Your cookie policy says nothing about training machine learning models. Even if you stretch and assume people consent to what's in the cookie policy, they're not consenting to this. This terminology is misleading.