Are the days of Google Analytics numbered?
13 January 2022
2020 and 2021 have been chaotic, to say the least. For digital marketers, 2022 is already off to a similar start. An Austrian judge ruled that the use of Google Analytics violates the GDPR. Considering that the tool has a market share of 85.2%, this has caused a lot of panic in the industry. However, before we start making rash decisions, it's time to look at the facts. Put all of those ideas of throwing your entire analytics stack out the window aside, sit down and read this.
Where the problem begins
The GDPR is applicable to personal data. But what does the EU regard as personal data? The fact that you can't process names, addresses or phone numbers without legal grounds is, by now, accepted as common sense. However, there's one piece of commonly processed data that's often forgotten: the IP address. An IP address can be used to trace a person's geographical location. As such, the GDPR classifies it as personal data.
The entire internet is built around IP addresses. A web server has to receive your IP address to serve you the content you want to see. Luckily you can do this under "legitimate interest", which means you don't need the user's explicit consent. Requests that send data to Google's servers are not as fortunate. Even though you can enable IP anonymisation in Universal Analytics, and GA4 anonymises it by default. However, when you send the data to Google's server, your IP address will still be part of the request itself. And that's where things get tricky.
Data transfers between the EU and the US
You see, at the time of writing, Google Analytics doesn't give you the option to exclusively use European data centres. This means that your data will end up in the US. Once it's in the US, the data is processed according to the US Privacy Act. A legal framework that's far less robust than the GDPR. US law also allows intelligence agencies to collect and use the personal data from US electronic communications services like Google. This also applies to the collected data of European citizens, which is not in line with the GDPR.
In the past, the EU tried to reach an agreement with the US when it comes to the personal data of European citizens being processed in the US. This culminated in the "Privacy Shield" (former Safe Harbor Privacy Principles). The Privacy Shield was supposed to enforce proper 'etiquette' when it came to transferring data to the US. It would safeguard the data of European citizens.
Except it wasn't thorough enough. After a case initiated and won by privacy activist Max Schremms, it was dismissed in July 2020. As a result, US service providers had to find other means to protect the data of EU citizens like: IP anonymisation, offering EU-based hosting…
The Austrian ruling that changed it all
Despite the Schremms ruling from 2020 , everything carried on as it always had. Or at least, that's what it seemed like. Privacy activist group 'noyb' (None of Your Business) had already filed multiple complaints against the use of Google Analytics and similar tools by several EU-based companies (101 to be exact). In the meantime, one was already dealt with by an Austrian court. A summary of their conclusion on page 38 & 39: "Google cannot guarantee our data's safety from the US intelligence agencies."
As a result, other European countries have begun to reevaluate their stance on the use of Google Analytics. The Netherlands, for example, have since changed their 'privacy-friendly tracking guidelines'. Their guide now opens with a large disclaimer, saying "Google Analytics might not be allowed anymore soon". It looks like it's just a matter of time before they come out and announce a ban as well.
- Everything is evolving – marketing and analytics are no exception.Read more
The end of advertising cookie brings opportunitiesData collection and developments in legislation and browsers are hot topics in digital marketing. Safari and Firefox are blocking third-party cookies by default, and Chrome will follow in 2024 – with a market share of no less than 65%. We’ll walk you through the main developments and opportunities that these changes bring in this article.Read more
Webinar: Alternatives for Google Analytics 4Google Analytics 4 is the undisputed king of analytics platforms. Still, alternative tools are increasingly finding their way into organisations — thanks to different features, a greater focus on privacy, or better customer support.Read more
Getting started with Google Analytics 4Universal Analytics, the older brother of Google Analytics 4, will stop collecting data in July 2023. In other words: marketers will need to find an alternative. In this whitepaper, we discuss the most recent version of Google's data analysis tool: Google Analytics 4.Read more
Alternatives to Google Analytics 4How well do you know today’s web analytics landscape?When talking about web analytics, Google Analytics is usually at the top of the list. Google Analytics 4, is the undisputed king of web analytics tools. Or is it?Read more
Life after Universal AnalyticsUniversal Analytics will stop collecting data on 1 July 2023. This was recently announced by Google. Users with a paying license get 3 extra months — for them, the data collection stops on 1 October 2023. As a result, many companies are sounding the alarm.Read more
First-party data strategy: the core of your organisationThe digital landscape will change significantly with the elimination of third-party cookies and the introduction of new European legislation. Advertisers will have to innovate and make the way that they market themselves more sustainable. First-party cookies and a review of the customer relationship are key to this.Read more
Creating a data-driven content strategyWith a content strategy, several goals are within reach: you serve your target group, you get to put your (sectorial) knowledge on an appropriate digital stage and bring structure to your content marketing. However, doing so successfully requires thorough preparation and that can feel overwhelming at first, especially when starting from scratch. Thanks to our experts, you’re never on your own - starting with a step-by-step plan.Read more
Is it set in stone?
We still don't know how this story will end. As said this ruling is just the first in the 101 series, meaning that it'll take 100 more rulings before we can see the full picture. For now, there are still plenty of ways this can pan out.
What are your options?
1. This could be an edge case
An often omitted detail, this specific complaint featured a Google Analytics implementation where IP anonymisation was not properly configured. There's a small chance that Google Analytics is perfectly okay as long as this feature is enabled.
2. The US could change or scrap FISA
FISA is what allows US intelligence agencies to collect and process the data tech companies like Google have. Once the US can no longer freely spy on non-US citizens, Google Analytics will be in the clear again. However, it's highly unlikely that this will happen.
3. Google simply stops transferring data to the US
It could be as simple as an extra checkbox in a property. If they can guarantee that our data remains in their European data centres, they're in the clear.
4. Google Analytics does end up becoming illegal
Even though it seems unlikely, it might still happen. If that happened most websites would have to move away from Google Analytics and to one of their (EU-based) competitors.
Is it growth you’re after?
From auditing to market research, brand & communication strategies and intelligent UX design, your brand’s path upwards can kick off today. High time we sparked interaction with your audience – together?
We have to keep moving forward
There's no immediate need for most businesses to migrate to Google Analytics alternatives overnight. There will be some big changes in the industry, that's for certain. Make sure you don't rush to another tool, just to make the same mistake all over again. If you migrate to another platform, make sure it doesn't have the same legal issues as Google Analytics. Look for something that's self- of EU-hosted & supports full anonymisation.
See this event as an opportunity to reevaluate your current tracking setup and in general map the tools that might be exporting your data. For. eg. Do we really need all of these tools? Do we really need to track all the data that we do? These are the important questions you need to be asking yourself right now.
Start from the beginning, redefine your KPIs and adjust your tech stack accordingly. It might even be a good time to start moving towards a completely cookieless solution. At the rate at which browsers are discontinuing third-party cookies, this might even be the more urgent matter. Who knows, GA might not even be a part of your cookieless tracking setup.
With contributions from Laura Debruyne, Martijn Lijten & Dumky de Wilde.
Glenn WeutsHead of Marketing Technology - iO
As Head of Marketing Technology at iO, Glenn Weuts is absolutely in the right place. Convinced of the watertight truth that only data can offer — in combination with his profound knowledge of analytical tools and platforms — measuring and interpreting user data energises him every day. His output? Advice for sound marketing.