Google Analytics & GDPR: The Updates You Need to Know About

The new European data protection law GDPR is coming into force on 25 May 2018. It’s going to have implications for all businesses, and especially on those that deal primarily with large volumes of data. Google Analytics is an essential and integral tool for SEO businesses, so you need to be aware of the changes being made and how they will affect your operations.

1. New User Deletion Tool

GDPR will mean that more importance is placed on the correct deletion of user data. For this reason, Google will be introducing a user deletion tool before the legislation comes into force. The tool will facilitate the management of deleting all data associated with a particular user for properties in Google Analytics and/or Analytics 360. It will be an automated tool that uses common identifiers that are sent to Analytics Client ID, User ID or App Instance ID. There will be information to follow on this from Google.

2. Introduction of Granular Data Retention Controls

On 11 April Google introduced new controls for managing how long information about users and events is stored on their servers. Once GDPR comes into force, the settings you have selected via these granular data retention controls will determine how long the corresponding data is retained for. Any user or event data that is older than specified will automatically be deleted by Google Analytics—this won’t affect reports using aggregated data though.

3. Contractual Changes

The new legislation inevitably means that there will be changes to Google’s contracts. It has been bringing out changes since August 2017. The new terms relating to GDPR will become effective on 25 May 2018 and will supplement any existing contracts that you have with Google for Analytics and/or Analytics 360. Many of the new contractual updates for Google products are based on whether Google counts as a data processor or a data controller under the new legislation. For Google Analytics, Google is a data processor. Companies using Google Analytics outside of the EEA can view and accept the new terms under their account settings. For EEA-based Google Analytic clients, the updated terms for data processing have been automatically included in your terms.

4. Updated Consent Policy for EU Users

Another big topic surrounding GDPR is user consent. As a result, Google is updating its EU user consent policy. It will incorporate new legal requirements under GDPR, and all Google Analytics and Analytics 360 customers who are making use of advertising features need to comply. The new provisions will lay out responsibilities in terms of disclosures and consent as regards end users of sites within the EEA. Even companies who are not based in the EEA should consult with legal advisors to determine whether your company will fall under the scope of the GDPR if you use Google Analytics or Analytics 360, and ensure acceptance and compliance with the new policy.

Continue Utilising Existing Features

As well as these new updates, there are multiple tools that Google already offers around data management and to help companies safeguard their data. These include privacy controls, customisable cookie settings, IP anonymization and data sharing settings. Take a look at what exactly GDPR will mean for your company on an individual basis and see which of these features you can utilise to ensure your compliance.

Conclusion

If your company collects, uses and stores large amounts of data on a day-to-day basis, now legislation about data, such as GDPR, can seem an intimidating and worrying prospect. The measures that Google is taking and the corresponding features it is offering will certainly be a big help in implementing the changes needed. However, you shouldn’t stop there. Make sure you have done your own research as well and implement measures that fit the specifics of your company.