You’re probably getting sick and tired of hearing about GDPR these days. We’ve covered it in a number of posts before (like this one), but it is a really big deal that every business and business owner needs to pay attention to. After all, the punishment for a data breach of the GDPR law is huge – €20,000,000 Euro or 4% of global turnover (whichever is higher).
However, there has been one question looming over the Digital Marketing industry; what about Google Analytics?
After all, Google Analytics collects and compiles an incredible amount of data, most of which count as “identifiable data”. As this comes under (and is the entire point of) the GDPR law, there has been serious concern about how much data we will actually get from Google Analytics moving forward.
One of the biggest concerns that many within the Digital Marketing industry had stemmed from Google’s relative silence on the subject. There had been almost no communication regarding GDPR and Google Analytics until early March.
We are currently looking into making Google Analytics compliant with GDPR.
This was a bit of a shock as, out of all businesses, you would expect a company like Google (who rely on data to make money) to have their GDPR plans in place already. Instead, we were shown the human side of Google as they revealed that they still had not sorted out their GDPR policy. They didn’t seem to have any answers about how to make Google Analytics work, following the release of GDPR on 25th May.
Due to the lack of a definitive plan of action regarding Google Analytics and GDPR, many business owners and people working in the Digital Marketing industry started to put together their own theories. There ranged from “nothing will change” to “we won’t have any data to use for our strategies anymore”.
On top of this, there was a strange occurrence that happened across multiple different properties within Google Analytics. For the first week of April, a portion of data was attributed into Direct, no matter what channel generated that data. This also caused a number of Digital Marketers to worry that this was the future of Google Analytics.
In essence, Google’s continued silence meant that everyone was in the dark, trying to find out what was going to happen without any assistance from Google itself.
The first slice of information that we received from Google came when we logged into Google Data Studio at the start of May. We were greeted by a notification telling us to update the details of our Data Protection Officer.
It finally seemed as though Google was moving forward with their GDPR compliance. However, the same information was not requested by Google Analytics. In fact, nothing was requested by Google Analytics. Ths, once again, lead to slight concern about the future of the data that Digital Marketers need for campaigns to reach to their full potential.
It wasn’t until the second week of May, just 17 days before the date that GDPR comes into force, that Google finally sent out information regarding Google Analytics’ new Data Retention Controls.
What are Google’s data retention controls?
As part of their preparation for GDPR, Google have released a new Data Retention Control section to Google Analytics, with a brief explanation on it here. However, this brief explanation can be slightly confusing as to what actually happens with the data collected. As such, we’re going to break it down and make it easier to understand.
There is no “one size fits all” recommendation that can be made about which retention period to use, either. Every website has a different use of and need for data, so it entirely depends on what is right for your business.
One very important thing to note about the new Data Retention Controls is that they only affect the personally identifiable information. For example, this can include user data such as location, demographics, mobile device, IP address and browser choice.
What these controls do not affect is the standard Google Analytics page view tracking. In order words, general data such as Sessions, Bounce Rate, Revenue and Session Duration will not be affected. Therefore, even after the Data Retention Period you have chosen expires, you will still have the basic level of Google Analytics data.
For the more detailed user data collected by Google Analytics, under the new GDPR legislation, it will be deleted from all records once the Data Retention Period has expired. On top of this, you are also unable to make any backup of this data without written and/or expressed consent of the individual being tracked.
That means that this data will eventually be lost to your business unless you chose the “do not automatically expire” Data Retention Period.
Therefore, you are probably wondering what anyone would choose the other options for a Data Retention Period. The reason for this is because the data only exists in Google Analytics for a set amount of time. After that timeframe has expired, a Data Protection Officer needn’t worry about it anymore.
The final aspect of the Data Retention Controls is how the retention period resets for users. In essence, each time a user creates a new Session on the website, the retention period restarts. This means that it is entirely possible to keep a user’s data indefinitely, as long as they keep coming back to the website.
User visits the website, starting a 14 month Data Retention Period.
The same user comes back within the 30 day cookie period.
The 14 month Data Retention Period countdown resets, whilst keeping the previous data on the user.
For businesses with repeat customers, this can be perfect as it means that they will be able to hold onto the data for longer periods of time. However, those businesses that typically have a very low or non-existent repeat customer base will lose the personally identifiable data at the end of the Data Retention Period.
If you have any questions about Google Analytics or are concerned about how to utilise the new Data Retention Controls, then don’t hesitate to get in touch with us today. We are happy to help.