Is Google Analytics again enforceable?

Talk of Google Analytics being illegal in the EU was watered down in the summer. The EU-US Data Privacy Framework, which comes into force in July 2023, allows the collection of personal data from EU citizens and its transfer to the US.

Still summer in Sweden companies fined for using Google Analytics. At the moment, there is no information on how the data protection authorities in the various EU countries will deal with Google Analytics, but at least from the point of view of EU law, the problem no longer exists.

The impact of the controversy?

The buzz around Google Analytics has raised awareness of analytics tools. At the same time, there is a growing awareness of the potential and security risks associated with them. Cookie surveys have become more prevalent on websites, although there is still much room for improvement in their correct use.

A few years of turmoil opened up the market for other analytical tools. These have included cookie-free analytics or data storage within the EU (Snoobi) or on-premises solutions (Snoobi and Matomo) that can provide fully GDPR risk-free analytics.

Use of Google Analytics in the future

We understand that the public sector in Finland will continue to avoid transmitting information about its citizens over the ocean. This trend has been going on for some time and official guidelines seem to be pointing in this direction. The issue may also be taken up by companies in certain industries for which the use of GA could be seen as a potential reputational risk.

It is very likely that data protection activists will continue to lobby against Google Analytics, because technically nothing has changed. The data collected by Analytics is still owned by Google and therefore subject to US law, i.e. it can be handed over to the US intelligence services, for example. For some organisations this may still be a threshold issue, but the vast majority of companies will continue to use Google Analytics as before. The impact of lobbying on legislation and public debate remains to be seen.

With or without cookies

Proper implementation of cookie settings will inevitably reduce the amount of analytics data collected. The drop is usually in the order of 25-40%, but there is variation between domains. Data losses of up to 80% have been seen. However, such figures are already rare.

In principle, collecting visitor data would be possible with a cookie-free measurement, but on the other hand, this would mean losing the identification of returning visitors (at least for the time being) and e.g. remarketing and attribution-based conversion measurement.

Are advertisers and website developers divided into separate analytics camps?

Google gets around the restrictions with data-driven measurement, where anonymised visitor data is combined with the mass of data Google collects about people and these are linked together in the Google Ads advertising tool, not in site analytics. In the hands of advertisers, the role of traditional site analytics will potentially diminish somewhat.

For those measuring website usage, cookie-free analytics can provide a more reliable source of data when all visitors and visits are measurable.

How to deal with Google Analytics now

So it's now officially OK to use Google Analytics. However, there is no guarantee that analytics will not be brought back into the tick box, as the EU-US Data Privacy Framework was not created for Google Analytics. The GDPR problem with data transfer was for much bigger entities, such as other systems from Microsoft, Meta and other giants.

Risks and their likelihood

The biggest risk for Google Analytics is probably reputational damage if Google Analytics is negatively labelled in the public debate. Now that the worst of the storm has passed, the risk seems relatively small for the time being. The second risk is that the use of Analytics could come under fire again from the authorities, but there has been no talk of this so far. For the time being, Google Analytics can be used quite safely as long as the cookie settings on the site are in order.

How to prepare

If you're worried about data leakage to Google, e.g. for intranet monitoring or other sensitive data, you can use other analytics tools in different systems to keep the data in your own hands.

If website analytics is mission-critical or even critical to your business, it's a good idea to have a plan in place in case any of the Google Analytics risks materialise. If you want to play it safe, you can get a proven alternative to collect data in the background.