Are the days of Google Analytics numbered?
13 January 2022
2020 and 2021 have been chaotic, to say the least. For digital marketers, 2022 is already off to a similar start. An Austrian judge ruled that the use of Google Analytics violates the GDPR. Considering that the tool has a market share of 85.2%, this has caused a lot of panic in the industry. However, before we start making rash decisions, it's time to look at the facts. Put all of those ideas of throwing your entire analytics stack out the window aside, sit down and read this.
Where the problem begins
The GDPR is applicable to personal data. But what does the EU regard as personal data? The fact that you can't process names, addresses or phone numbers without legal grounds is, by now, accepted as common sense. However, there's one piece of commonly processed data that's often forgotten: the IP address. An IP address can be used to trace a person's geographical location. As such, the GDPR classifies it as personal data.
The entire internet is built around IP addresses. A web server has to receive your IP address to serve you the content you want to see. Luckily you can do this under "legitimate interest", which means you don't need the user's explicit consent. Requests that send data to Google's servers are not as fortunate. Even though you can enable IP anonymisation in Universal Analytics, and GA4 anonymises it by default. However, when you send the data to Google's server, your IP address will still be part of the request itself. And that's where things get tricky.
Data transfers between the EU and the US
You see, at the time of writing, Google Analytics doesn't give you the option to exclusively use European data centres. This means that your data will end up in the US. Once it's in the US, the data is processed according to the US Privacy Act. A legal framework that's far less robust than the GDPR. US law also allows intelligence agencies to collect and use the personal data from US electronic communications services like Google. This also applies to the collected data of European citizens, which is not in line with the GDPR.
In the past, the EU tried to reach an agreement with the US when it comes to the personal data of European citizens being processed in the US. This culminated in the "Privacy Shield" (former Safe Harbor Privacy Principles). The Privacy Shield was supposed to enforce proper 'etiquette' when it came to transferring data to the US. It would safeguard the data of European citizens.
Except it wasn't thorough enough. After a case initiated and won by privacy activist Max Schremms, it was dismissed in July 2020. As a result, US service providers had to find other means to protect the data of EU citizens like: IP anonymisation, offering EU-based hosting…
The Austrian ruling that changed it all
Despite the Schremms ruling from 2020 , everything carried on as it always had. Or at least, that's what it seemed like. Privacy activist group 'noyb' (None of Your Business) had already filed multiple complaints against the use of Google Analytics and similar tools by several EU-based companies (101 to be exact). In the meantime, one was already dealt with by an Austrian court. A summary of their conclusion on page 38 & 39: "Google cannot guarantee our data's safety from the US intelligence agencies."
As a result, other European countries have begun to reevaluate their stance on the use of Google Analytics. The Netherlands, for example, have since changed their 'privacy-friendly tracking guidelines'. Their guide now opens with a large disclaimer, saying "Google Analytics might not be allowed anymore soon". It looks like it's just a matter of time before they come out and announce a ban as well.
- Universal Analytics, Google Analytics 4's predecessor, will stop collecting data on 1 July 2023. That is what Google recently announced. In this Dutch webinar Glenn Weuts, Head of Marketing Technology at iO, explains what exactly will happen and how to best prepare for a migration to a new analytics platform.
Webinar: Life after Universal AnalyticsUniversal Analytics, Google Analytics 4's predecessor, will stop collecting data on 1 July 2023. That is what Google recently announced. In this English webinar Glenn Weuts, Head of Marketing Technology at iO, explains what exactly will happen and how to best prepare for a migration to a new analytics platform.
Cookieless futureCookieless future podcast
Get more out of your marketing budgetBy using dashboards efficiently and automating your data analysis, better results are within your reach.
Getting started with Google Analytics 4Universal Analytics, the older brother of Google Analytics 4, will stop collecting data in July 2023. In other words: marketers will need to find an alternative. In this whitepaper, we discuss the most recent version of Google's data analysis tool: Google Analytics 4.
All about inbound marketing with HubSpotWhich types of marketing are sure to serve your organisation well, instead of only making things harder? If you are consciously aiming for quality B2B leads, then inbound marketing makes up the proper course. In fact, this goes for digital marketing in general: approximately 90% of all B2B research is conducted via digital, online sources.
Four years of GDPR: where do we stand today?Four years ago, GDPR turned our digital processes upside down like a battering ram. Both in our private lives and in our professional environments: our data was never better cared for, seemingly overnight. At the risk of enormous fines, that is. Today, no organisation can afford to disregard GDPR. How has it changed, today - four years later?
How well do you know today’s web analytics landscape?Alternatives to Google Analytics 4
Is it set in stone?
We still don't know how this story will end. As said this ruling is just the first in the 101 series, meaning that it'll take 100 more rulings before we can see the full picture. For now, there are still plenty of ways this can pan out.
What are your options?
1. This could be an edge case
An often omitted detail, this specific complaint featured a Google Analytics implementation where IP anonymisation was not properly configured. There's a small chance that Google Analytics is perfectly okay as long as this feature is enabled.
2. The US could change or scrap FISA
FISA is what allows US intelligence agencies to collect and process the data tech companies like Google have. Once the US can no longer freely spy on non-US citizens, Google Analytics will be in the clear again. However, it's highly unlikely that this will happen.
3. Google simply stops transferring data to the US
It could be as simple as an extra checkbox in a property. If they can guarantee that our data remains in their European data centres, they're in the clear.
4. Google Analytics does end up becoming illegal
Even though it seems unlikely, it might still happen. If that happened most websites would have to move away from Google Analytics and to one of their (EU-based) competitors.
Is it growth you’re after?
From auditing to market research, brand & communication strategies and intelligent UX design, your brand’s path upwards can kick off today. High time we sparked interaction with your audience – together?
We have to keep moving forward
There's no immediate need for most businesses to migrate to Google Analytics alternatives overnight. There will be some big changes in the industry, that's for certain. Make sure you don't rush to another tool, just to make the same mistake all over again. If you migrate to another platform, make sure it doesn't have the same legal issues as Google Analytics. Look for something that's self- of EU-hosted & supports full anonymisation.
See this event as an opportunity to reevaluate your current tracking setup and in general map the tools that might be exporting your data. For. eg. Do we really need all of these tools? Do we really need to track all the data that we do? These are the important questions you need to be asking yourself right now.
Start from the beginning, redefine your KPIs and adjust your tech stack accordingly. It might even be a good time to start moving towards a completely cookieless solution. At the rate at which browsers are discontinuing third-party cookies, this might even be the more urgent matter. Who knows, GA might not even be a part of your cookieless tracking setup.
With contributions from Laura Debruyne, Martijn Lijten & Dumky de Wilde.
Brecht BeertensTeamlead Data & Insights - iO
Data specialist Brecht Beertens signed up for night school just one week after graduating. Today, he applies this lust for learning to achieving his goals, next to tracking, identifying, implementing & analysing the right pieces of data – along with a team that’s equally set to solve each puzzle.