Google Analytics 4:
Privacy & GDPR: Current Status

Notice
If you are looking to learn how to implement Google analytics 4 in the most Privacy Preserving manner, please review this page: Google Analytics 4 Privacy Settings & Configurations

Recent Rulings by European Data Protection Authorities about Google Analytics

(Latest update: May 11th 2022)

*Please note that these rulings are based upon “Universal Analytics”, a product which Google is sunsetting in 2023. Google will no longer release any updates to Universal Analytics. However most of what is in the rulings can also be applied to Google Analytics 4.

March 25th 2022 - The Trans-Atlantic Data Privacy Framework
On March 25th, United States president Joe Biden and President of the European Commission Ursula von der Leyen announced that they found an “agreement in principle on a new framework for transatlantic data flows.” These transatlantic data flows are the basis of the “Schrems II” ruling, upon which the Austrian and French DPA’s based their ruling against Google Analytics.

Important documents and links to read about the Trans-Atlantic Data Privacy Framework (“Privacy Shield 2.0”)

NOYB (The privacy firm that filed the complaints against Google Analytics), and it’s founder Max Schrems, have issued a first reaction to the news of a “Privacy Shield 2.0” which can be read here. 

As could be expected, Google reacted quite positively to the news in their most recent blog post.

Google’s Position on Recent European Data Protection Authority Rulings

(Latest update: April 6th 2022)

Google’s Position on the recent European DPA’s decisions

From what we can gather, Google remains convinced that the measures they offer to Google Analytics customers to protect the data should suffice. This blog post by Russell Ketchum (Head of Product Management for Google Analytics) outlines that stance. This .PDF clearly outlines how Google safeguards international data transfers for it’s advertising and analytics products and specifically responds to the “Schrems II” decision.

Google’s Vision on “The Way Forward”

For the longer term, it looks like Google is aiming to get to a “Privacy Shield 2.0” situation, which basically means that the geopolitical forces (in this case, the EU and US) will have to decide on a framework that works for both parties. You can read Google’s stance on this in this blog post and Google also refers to this statement from the European Commission issued in March 2021 on the topic.

New: Google’s Reaction to the Trans-Atlantic Data Privacy Framework can be read here.

Privacy Documents and Links related to Google Analytics 4
(Latest update: March 22nd 2022)

A list of relevant links and documents that Google is referring to throughout Google Analytics and it’s publications on the topic.

  • Privacy Controls in Google Analytics (link)
  • The Data Processing Terms required to accept when creating a Google Analytics 4 account that does business in the European Economic Area. (link)
  • The “Read More” information article attached to the Data Processing Terms you are required to accept. (link)
  • Learn how Google safeguards Google Analytics Data (link)
  • Policy Requirement for Google Analytics Advertising Features (link)
  • Advanced settings to allow for ads personalization (link)
  • Information about Data Retention (link)
  • Information about using User ID’s (link)
  • Information about GA4 Data Deletion Requests (link)
  • Information about Linking Google Ads & Google Analytics (link)
  • Information about Linking Google Search Console & Google Analytics (link)