Google Analytics: Latest GDPR Changes

As mentioned previously, Google has started implementing major product and contractual changes in preparation for the GDPR. The latest update comes with a clear message that action is required regardless of location. Google states, in no uncertain terms, that even non-EEA customers will have their service impacted by the updates.

This latest statement focuses on the particular changes to the Google Analytics and Analytics 360 products, and highlights which actions you need to take as a result.

Product Changes

The first major product changed mentioned is the new granular data retention controls which allows you to manage how long your end user data is kept on Google servers before being automatically deleted. The controls allow you to set retention periods on both a user and event level, with the settings taking effect on 25th May 2018, when the GDPR becomes enforceable. The retention period applies to data associated with cookies, user-identifiers (e.g., User-ID) and advertising identifiers and the settings will not affect reports based on aggregated data. You are required to take action in the form of reviewing and modifying your retention settings to prevent accidental data loss. You can read more about the new controls here.

The second product change mentioned is the new user deletion tool which seems to be aimed at meeting the requirements outlined within the user’s “Right to erasure” under the GDPR. The tool will allow you to manage the deletion of all data associated with any individual end-user from within your Google Analytics and/or Analytics 360 properties. The tool isn’t actually launched yet, but the company states that it will be made available before 25th May, with details to be released on the developer site here.

Google also mentions a number of Analytics and Analytics 360 data related tools/features made available to assist you in meeting your particular GDPR obligations while continuing to use Google products. They include features for customizable cookie settings, privacy controls, data sharing settings, data deletion on account termination, and IP anonymization.

Contractual Changes

Google is including the new GDPR terms as a supplement to your contract with Google, where (regarding Analytics and Analytics 360 products) Google has defined itself as the “data processor”. If you’re based in the EEA, your contract has already been updated to include the updated terms; for Analytics and 360 clients based outside the EEA, the updated terms are available in your account (under Admin→ Account settings) for your review.

Even if you are not based in the EEA, please consider together with your legal department or advisors, whether your business will be in scope of the GDPR when using Google Analytics and Analytics 360 and review/accept the updated data processing terms as well as define your path for compliance with the EU User Consent Policy.

You can view the full email text from Google here.

Updated EU User Consent Policy

As previously outlined here Google is making significant changes to their EU User Consent policy in order to meet GDPR requirements. The new changes set out your responsibilities for informing and obtaining valid consent from EEA users. As GDPR requirements can apply to you whether or not you’re based in the EEA, Google requires that you accept the updated terms if continuing to use Analytics and related products, and suggests that you review and define your path for compliance with the Regulation.

Looking for more in-depth information on the GDPR?

You can access the recording from our last GDPR webinar here (it’s free).

You’re also welcome to join us at our upcoming GDPR Webinar. It’s free to attend and you can have your most pressing questions answered. You can use this link to reserve your spot NOW (as our webinars often fill up quickly).

iubenda helps you with the generation of your privacy policy and a fully fledged cookie management system (Cookie Solution). You can try our privacy policy generator here and our cookie solution here

Originally published at www.iubenda.com.