There has been a possibility for some time that Google Analytics might be banned or perhaps restricted. Decisions in other countries in Europe led to a ban in 2022, but in the Netherlands, the Data Protection Authority has not yet made a definitive decision. How great is the risk that this will happen in 2023, and how do you prepare your organization for it? In this article, we delve into the background and risks and provide several solution directions that your organization can work on. By taking simple measures in time, you significantly reduce the impact of a possible ban and even gain a competitive advantage now.
Background of potential ban
All analytics environments must comply with European privacy legislation, based on the GDPR/AVG. In the Netherlands, the Data Protection Authority oversees this, and on their website, you can find a simple guide that clearly explains the legislation. The Data Protection Authority is not alone in this. In other countries, European privacy legislation is also enforced, and in Austria, France, and recently Italy, this has already led to a ban on the use of Google Analytics. Two important conclusions underpinned this ruling:
- As a ‘provider of electronic communication services,’ Google falls under the legislation 50 US Code § 1881 (b) (4). This allows the US intelligence agency to require Google to provide access to all data they manage.
- The measures subsequently taken in addition to the Standard Contractual Clauses (SCC) have been deemed insufficient by the EU, as they do not exclude the possibility of monitoring and access to data by US intelligence agencies.
- This judgment follows the invalidation of the Safe Harbor and Privacy Shield agreements between the United States and Europe. These agreements ensured strict rules for American processors of European personal data, to align the processing of personal data with the GDPR.
- On June 24, 2022, the Italian privacy regulator Garante per la Protezione dei Dati Personali (GPDP) announced yet another reason to ban the use of Google Analytics. They state that IP addresses, considered personal data, are not anonymized by default.
The rulings so far have mainly focused on Universal Analytics. Google Analytics 4 offers additional options to ensure visitor privacy.
Partly due to the ban in other countries in Europe, we see a real chance that additional measures will also be taken in the Netherlands. Whether there will actually be a ban is the question. It is also quite conceivable that the use will be significantly restricted, so you should already be thinking about measures to keep the impact limited.
How do you prepare for a ban on Google Analytics?
There are multiple solutions for Google Analytics, with some solutions, such as those from Adobe, potentially facing the same risks. Analytics solutions that comply with privacy legislation and manage data in Europe are especially recommended. But is it really necessary to switch? There is also a chance that Google Analytics can still be used. Roughly, we can identify four scenarios:
Scenario 1 “Do nothing and wait”
This scenario has worked quite successfully in recent years. If a ban never comes, you have incurred no costs. But if you wait until the last moment, you run the risk of not being able to carry over much historical data.
Scenario 2 “Take preparatory measures and implement GA4”
You ensure that you comply with the rules as currently provided by the Data Protection Authority and implement GA4 even alongside your Universal Analytics. By doing this in a timely manner, you build up a lot of data and can compare GA4 well with UA, allowing you to see the differences and advantages clearly. You can even use dashboards to view the differences between GA4 and UA. An interesting article with a free dashboard is available on the Follo website.
Scenario 3 “Implement an alternative data collection method or tool
The alternative data collection then functions alongside Google Analytics, so you already start collecting data now and can switch quickly if necessary. You preferably do this in combination with scenario 2, so you are prepared within Google Analytics for phasing out UA. The advantage of this scenario is that you start a second data collection at relatively low cost, which you only need to use if really necessary, but at the same time, it is a nice lifeline if something unexpectedly goes wrong in Google Analytics now.
Scenario 4 switch to another analytics environment.
If you choose this scenario, you will preferably use two environments alongside each other, as in scenario 3, but you have also already decided to actually turn off Google Analytics at some point. The organization can then save on the (paid) version of Google Analytics, but the costs for a migration and the break in historical data can certainly be complicating factors.
Advice
The best time to repair the roof is when the sun is shining. And the privacy laws and regulations have been implemented, and the expectation is not that these regulations will be relaxed in the medium term. Given the ban in other countries in Europe and the ongoing developments around legislation in the EU and the US, it is more likely that the use of Google Analytics will be further restricted. In other words, that storm will come eventually.
Of the scenarios mentioned above, scenario 1 is certainly not recommended. You can hold out for a while, but it is certain that Universal Analytics (UA) will end on July 1, 2023. It has been postponed a few times, but betting on it being postponed again is very risky. The minimum scenario is scenario 2, where there is a migration to GA4, but this scenario is also not without risk in terms of privacy laws and regulations. The combination of scenario 2 and 3 is better because you build up enough alternative data. If a ban comes, you have had plenty of time to collect data in an alternative analytics environment. An additional advantage is that you can also measure things where GA4 sometimes falls short, and you also have a safety net. Scenario 4 is by far the most labor-intensive and costly scenario. Certainly a good scenario, but costly and with a number of other risks as mentioned.
In summary, our advice is to migrate to GA4 and set up an alternative analytics environment alongside it where you already start collecting data. This way, you run the least risks and keep costs low. During the migration to GA4, you can still run UA alongside it until July 1, so you can monitor the differences with the mentioned report. There are also more than enough alternatives for Google Analytics environments that you can deploy for relatively little investment. Think, for example, of Piwik (pro) or Matomo. Both solutions are now widely used and are therefore sufficiently future-proof solutions.
