GDPR is set to cause some significant changes in how we use Google Analytics.
Over the past month, the Jeffalytics team has been investigating how these changes affect your Analytics data. And we've delved deep into some of potential GDPR compliance problems with your analytics data collection.
But many Analytics account owners simply want to know: Can I use Google Analytics and be GDPR compliant? The answer to that question is:
“Yes, but only if you change this one setting...”
The standard version of the Google Analytics tracking code temporarily collects personal data out of the box, so configuration is required if you want to prevent the collection of personal data in Google Analytics.
In this post, I am going to help you understand what type of personal data you are collecting in Google Analytics, and how you can adjust your tracking code to eliminate personal data collection from your Analytics installation.
Specifically, we are going to review:
- Is the standard “out-of-the-box” Google Analytics tracking code compliant with GDPR?
- What type of personal information Google Analytics collects.
- How GDPR compliance impacts your Google Analytics data.
- What you'll lose if you eliminate personal data from your Google Analytics account.
Is Google Analytics GDPR compliant out of the box?
The answer is, No. It's my understanding that the standard Google Analytics setup does not comply with GDPR. And that's because Google Analytics automatically collects personal data.
The basic Google Analytics tracking setup does not collect very much personal data, and the utility of this data is debatable, but it does record personal information. This data is enough to fall under the rules of GDPR for users located in the EEA.
Does Google Analytics collect IP addresses?
The standard Google Analytics tracking installation collects your users' IP addresses.
Now, you might be thinking: “What are you talking about, I can't see IPs in my analytics account.”
When users land on your website, your Google Analytics tracking code collects their IP addresses. But Google strips IP data before it enters your reports.
So although you can't see user IPs in Google Analytics, your account still collects this data.
What reports does this IP data enable? This data fuels your Geo reports, service provider reports, and also allows you to filter specific users from reports by entering their IP address which can allow you to do several things including filtering internal traffic.
If you know of more reports that utilize by IPs, please leave a comment, and I will update this post.
Under GDPR, IP addresses are considered personal data. Tracking the IPs of your EEA based users without their consent falls under the rules of GDPR.
Advanced Google Analytics installs and personal data
Advanced Google Analytics installations can track many forms of personal and third-party data. These installations can track demographics, display features, user IDs, custom dimensions, etc.
We will not spend too much time talking about advanced GA installs in this article, because if you want to track this data, you should be strongly considering asking for consent from users instead of trying to circumvent the system.
What I want to talk about is that even the standard installations of Google Analytics collect personal data. That collection occurs on each hit your analytics tracking code sends to Google Analytics, and the personal data that you collect is your users' IP address.
So how do you use Google Analytics without causing GDPR compliance problems?
You can anonymize your users' IP addresses, which prevents the collection of personal data from your Google Analytics tracking code.
How to anonymize IP addresses in Google Analytics
You can anonymize your users' IP addresses by adding a function to your analytics tracking code.
Source: Google Developer site.
Here's how this function works. The anonymize function sets the octet (the fourth string of numbers in an IP address) to zero.
By stripping the octet from your IPs, you are eliminating the collection of your users' personal data.
Let's look at how to add the anonymize function to your Google Analytics Javascript tag.
The syntax for this function will be different depending upon which version of the Analytics tracking code you're using.
Anonymizing IP addresses in gtag.js
Here's what the anonymize function looks like for the newest Analytics tracking tag, gtag.js:
It's important to compare your function syntax against the Google developers example before you add it to your existing tracking code. Verifying your function will help you avoid any syntax errors.
Once you verified you are tracking correctly, you can add this function to your tracking tag, and it will anonymize user IPs at the point of collection.
Anonymizing IP addresses in Universal Analytics
If you're using universal analytics (i.e., analytics.js), the anonymize function looks like this:
You'll notice that this function is different from the function for gtag.js. The I in “Ip” is in caps, and there is no underscore. I am not sure why these functions are different. But, these differences can cause some confusion. So, if you're adding these functions to multiple accounts, make sure you're using the right syntax for each tracking tag.
Hide IP addresses with Old school ga.js
If you are using ga.js – well, all I have to say is… It might finally be time to update your tracking code.
Ok, maybe it wasn't your choice to use a tracking tag that's five years past its prime. In that case, I'm sorry that I'm not sorry for calling you out. Here's what the anonymize function looks like for ga.js:
If you work for a company that's still using ga.js, the GDPR fines might be hefty enough provoke your employer to update their tracking.
Inform the decision makers at your company that it will be easier to make GDPR related changes with the newest, shiniest tracking code. Hopefully, that will help you move your company's tracking capabilities out of the Google Analytics stone age.
Anonymize your IP addresses in your Google Analytics WordPress plugin
What if you use a plugin to manage your Google Analytics tracking code?
The most popular WordPress plugin for Google Analytics is Monsterinsights. You can choose to anonymize user IP addresses inside of your Monsterinsights settings. All you have to do is check the button in your demographic settings to anonymize user IPs.
Anonymize IP addresses for GDPR compliance using Google Tag Manager (GTM)
To anonymize IP addresses in GTM, you need to adjust your Google Analytics Settings variable. Or you can do this directly in your Universal Analytics tag.
In the GA settings variable, change your Fields to Set to “anonymizeIp,” and set your value to “true.”
Note that this is the syntax for Universal Analytics. Making this adjustment in GTM is the equivalent of changing your code in Analytics.js.
What about GA classic served through GTM?
If you are using GTM and GA Classic tags, then I am sad for you. Either you have some master-plan we don't know about, or your life is filled with sadness.
Concealing user IP addresses and GDPR compliance
Anonymizing IPs in your Google Analytics tracking code eliminates the collection of user data for basic installations. And if you don't collect any other personal data on your website, I believe that you will have mitigated any GDPR consent issues within your Google Analytics data.
But if you have an advanced Google Analytics installation, you're going to have to make some choices. You're either going to have to stop collecting user data or obtain tacking consent.
Do you want to learn more about tracking consent?
A lot of analytics geeks will utilize advanced Google Analytics tracking code installations. In these cases, there's not one setting you can change to become GDPR compliant. It's going to take more work than that. It's probably going to require gathering user consent.
I was thinking about doing an upcoming video and post about how to obtain tracking consent on your website. If you want to see that video, leave a comment below. If we get enough comments, we'll do a full tutorial on tracking consent.
Of course, even if you have an advanced installation of Google Analytics, you will probably still benefit from concealing your user IPs. But before we make that determination let’s look at the impact of removing IP address data from Google Analytics.
What is the impact of GDPR compliance on your Google Analytics data?
You might be wondering if losing IP data will compromise the accuracy of your reports. Let's look at how the loss of IP data affects our measurement accuracy.
Huiyan at Conversion Works did an excellent study about the impact of anonymizing IPs on Google Analytics data.
Huiyan found that IP anonymization only affects city-level data in Google Analytics.
Her study found that losing IP data had almost no impact on the accuracy of your continent or country-level data.
With the result of this study in mind, let's talk about our final question.
What will you lose if you eliminate personal data from Google Analytics?
Huiyan's study showed us that you will lose some accuracy from your city-level reporting data. Your city-level reporting accuracy may even decrease by about 30% for users on desktop or tablet devices.
So what's my reaction to this? I'll let the late, great Chris Farley answer that question.
The loss of IP address data is not a significant loss (for me)
I don't see losing some city-level reporting accuracy as a big deal. Keep in mind your city-level data won't be entirely inaccurate, it will just be less accurate. So, you'll still have a good idea of the general city area of your users. But your reports might not be able to identify your user’s specific locations or neighborhoods.
Essentially, the city dots on your Google Analytics reporting map might get a little bigger if you give up your user IP data.
I suppose if you're doing highly targeted, local market analysis, this data loss could be a cause for concern. And in that case, it’s likely that you are tracking enough data that you will want to consider obtaining tracking consent anyway.
Spoiler alert: IP addresses report the wrong city all the time!
IP addresses commonly misreport your location. I know this because every time I log on to this blog, my dashboard tells me I am in a city 20 miles away from where I am currently located.
That said, Google Analytics seems to have a more accurate IP reporting database than most other platforms. And if you anonymize your IPs, your Google Analytics data will be about 30% less accurate at the city level.
But, the loss of city-level location data is a small price to pay for GDPR compliance.
I'll leave you with this conclusion and call-to-action:
You should anonymize your IP address data in Google Analytics
If you're using Google Analytics, you're collecting IP addresses. By anonymizing IPs addresses, you're eliminating the collection of personal data from your installation (assuming you have made no other changes to your code).
In a GDPR world, you gain compliance by anonymizing user IP addresses. You don't lose all that much.
Have questions about Google Analytics and GDPR?
What are your questions about Google Analytics and GDPR compliance? Leave your questions in the comments below. I'll try to answer as many of your questions as I can.
