Menu Close

Is user data truly protected in the Google Analytics universe?

Is user data truly protected in the Google Analytics universe

30-second summary:

  • Fair data collection is when people are willing to share segments of their digital selves without giving away the whole picture
  • Google’s data empire seems to backfire on its presence in Europe as Italy  joined France and Austria in ruling that Google Analytics is overstepping boundaries
  • Whispers soon became shouts when the Italian Data Protection Authority (DPA) found that Google wasn’t in fact doing enough to mask these IP addresses, meaning users could be easily identified
  • What impact will this have on the SEO industry and will more countries join this revolt?

Think of your online data like pieces of a jigsaw. All assembled, these make a crystal clear picture of you – your IP address, interests, name, and so on. Look at one or two pieces at a time though, and you can’t get much from it.

This is what is considered fair data collection. You’re willing to share segments of yourself, but not the whole picture.

GDPR (General Data Protection Regulation) is partly about making sure businesses like Google don’t get enough individual pieces to see the whole of you. This is also why their Analytics service is getting some bad press at the moment, particularly in Europe. 

The service is used to track both quantitative and qualitative information about people on a website, such as how many active users there are and what their gender may be. Financial information like revenue or advertising ROI is also available if relevant to your website. In terms of user data, there is not enough to identify someone specifically, but there is enough to help businesses understand their demographics.

However, Italy recently joined France and Austria in ruling that Google Analytics is overstepping the boundaries of ‘fair collection’ and breaching GDPR rules.

While Google does anonymize data to a certain extent, there were always whispers that the IP addresses of users were easily accessible. These whispers soon became shouts when the Italian Data Protection Authority (DPA) found that Google wasn’t in fact doing enough to mask these IP addresses, meaning users could be easily identified.

At this point, the empire of technology they’ve built is almost working against the search giant. When they collect so much data, those jigsaw pieces start to pile up quickly and when they have all the tools to put the jigsaw together, that’s when countries like Italy have to put their foot down.   

The argument of Italy, and soon to be many other regions, is that Google simply has too much information that isn’t masked properly. This is far beyond the typical fingerprints, people leave as they use the internet. As the data used on Google Analytics must travel through servers on American soil, they also consider this a further violation – citing the 2020 Schrems II ruling in particular. 

A lot of questions still remain. How will this affect the SEO industry in these countries? With GA4 still a fair way off, should business owners put in place a different solution? Which other countries will follow suit – Japan, California, or any other EU country?

I’ve teamed up with Laura from Ruler Analytics to bring you some tips and facts to help you both understand, and deal with, what’s going on.

Move to GA4, the sooner the better

Google Analytics is set for change. As of July 2023, Universal Analytics will no longer be available. What exactly Google Analytics 4 will finally look like is uncertain at this point. 

But what we do know is that you need to create a GA4 account sooner rather than later. 

By setting it up now, you’ll have the historic data you need to apply new tools and features too down the line.

Remember, Google Analytics 4 will only offer you data retention for 14 months. Setting up GA4 now and learning how to use the platform will pay dividends in the future and keep you prepared for the change. 

Even though the cookie death is in 2024, move away now

Invest in first-party cookies. As we saw with iOS 14.5, advertisers like Google and Facebook are hugely impacted when it comes to data tracking with third-party cookies.

First-party cookies are cookies that you own, that live on your website. The data you collect and create is your own. And that means you have unbiased data that can’t be removed at a whim’s notice.

Data autonomy, while still respecting GDPR rules, is absolutely paramount for marketers. 

Manage the trust of your customers but also collect the data you need to create personalized, trackable customer journeys. 

Once the cornerstone of paid advertising, third-party cookies will soon be redundant with platforms like Facebook and Google scrambling to create a replacement that still works for their advertising models.

Stop relying on Google Analytics for more than web analytics

Google Analytics is a web analytics platform. And a really good one at that too.

What Google Analytics is not, is a visitor-level revenue analytics tool. 

That means you can’t access data like: 

  • Individual full customer journeys
  • Accurate marketing source 
  • Closed revenue or pipeline generation 

But as Google is continually looked upon unfavorably from a data protection standpoint, it’s possible that we might see more countries fight against it. 

To prepare for this, you need to sort your data. 

Look at the tools you’re currently using and how you can make your tools work smarter for you.  

Google Analytics will continue to be a great tool for understanding your website analytics. While it might see tighter restrictions on the data it uses and shares, you should still get access to general website metrics. So, when it comes to accurately track users from your website and connecting them to closed leads and revenue, you need to be looking elsewhere.

Marketing attribution is one such tool that can help. It uses first-party cookies on your website meaning you have total autonomy over your data. 


To wrap up, the next steps are clear. How we use data is changing. And more importantly, how tech giants like Google are being regulated on data is changing as well. 

To get ahead of it, set up a Google Analytics 4 account first and foremost. Next, look at what data you’re collecting and how you’re collecting it. Revaluate your data-capturing journey and practices. 

If you are tracking data like lead conversions, or crave more insight on touchpoint data, then you need to reevaluate your marketing tech stack.

Be prepared for the fact that you might lose insight into website visitor data and start looking for alternatives to make sure you continue to feed your tools the data they need.

Matthew Rogers is Head of Campaign Management at the top Manchester-based digital market agency Add People and has over 14 years of marketing experience. You can follow him on LinkedIn here. He is also a long-standing member of the Click Z Collective Advisory Board.

Laura Caveney is Head of Marketing at Ruler AnalyticsLaura has over 6 years of experience in delivering end-to-end marketing campaigns and discusses the trials and tribulations marketers face day to day on her LinkedIn channel.

Subscribe to the Search Engine Watch newsletter for insights on SEO, the search landscape, search marketing, digital marketing, leadership, podcasts, and more.

Join the conversation with us on LinkedIn and Twitter.

The post Is user data truly protected in the Google Analytics universe? appeared first on Search Engine Watch.