Google Analytics 4 (GA4) is Google’s latest web analytics service, replacing Universal Analytics, which will stop collecting new data on 1 July 2023. 

News › Technology › Compliance ›

After this date, you'll be able to access your previously processed analytics for at least six months before Google will confirm when your historical data will be denied. 360 Universal Analytics properties are being granted a one-time processing extension to July 1st, 2024.

Many organisations, including government, are transitioning to GA4. There are a number of things to consider as you take steps towards migration:

  1. Inactivity or failure to migrate on time
  2. Migrating data to GA4, which requires a lot of prep work
  3. New interfaces and features
  4. Improved GDPR compliance

 

The GA4 era is upon us

Google Analytics 4 was first announced in 2019 and is now the default Google Analytics installation. It's set to become the sole user data collection tool at the end of June 2023, when Universal Analytics ceases to operate. The new property improves upon its predecessor in its ability to collect user data from websites, apps, or both, giving marketers a much clearer view of the user journey. Those who have not yet migrated to the latest iteration need to do so before the cut-off date, or risk a hole in their datasets.

An ilustrative representation of different GA4 screens, bars and graphs in a blue, yellow and orange colour scheme.

What are the benefits of GA4?


For the user

Google has been criticised by the EU for not being GDPR compliant, with 101 complaints filed across EU member states. In an initiative to make GA4 more compliant, Google has made more efforts to anonymise user data, allow users to delete their data, and reduce the time data is stored. Google tracks the anonymous journeys of users, but cannot collect personal information.

The tech giant has made the following changes to enhance compliance:

  • Default IP anonymisation. Google Analytics no longer stores the IP addresses of users’ devices. This IP anonymisation cannot be switched off, making it impossible for the software to track users, in line with GDPR regulations.
  • Personal data deletion. GDPR gives consumers the right to request data deletion, which GA4 enables in a set time range.
  • Personally Identifiable Information (PII). In line with the privacy laws contained in the GDPR, Google does not allow users to collect PII in GA4. Google has gone as far as reserving the right to delete all the data of a user if it finds PII.
  • Shorter data storage duration. Universal Analytics allowed sites to store data for up to 64 months, but GA4 only allows two data storage options: 2 months or 14 months, depending on the analytical activity. 

 

For businesses and marketers 

  • Tracking user journeys across multiple devices. In the past, you needed different versions of Google Analytics to track mobile apps and websites. You now have the ability to track and monitor all your data in one interface, for unified reporting and analysis. This gives a clear and instant indication of your marketing success across platforms.
  • Data sharing with other Google products. Sharing data with other Google products such as Google Signals and Google Ads can improve tracking outcomes for your business in the future, but may not be fully GDPR compliant as of now – see below.
  • Cookie consent improvements. Each country within the EU has its own cookie consent regulations, and it's up to you to ensure your website is compliant in that country. Usually, you need explicit consent from users to use cookies on your site. However, if you set up your GA4 IP anonymisation to not share user data with other Google products, you don’t need this consent. This may present an opportunity to do away with those pesky cookie banners and improve the user experience.
  • Consent mode. Google Consent Mode allows you to modify the behaviour of your site’s Google tags based on user consent preferences, and track their behaviour according to their stated preferences.
  • Other advantages. Some of the other advantages offered by GA4 include improved data accuracy through the tracking of more complex interactions, the capture of events instead of session-based data, automatic insights, and predictive data capabilities. 

 

Is GA4 GDPR compliant?

Despite all the measures listed above, GA4 is still not fully GDPR compliant. For instance, unlike with Universal Analytics, GA4 does not allow you to choose where you store your data. GDPR considers the transfer of personal data from the EU or UK to the USA as a restricted transfer, and it is therefore up to you to take additional steps to ensure your data remains in Europe. However, this may not be possible at present, as Google is still negotiating with regulators within the EU.

 

What can I do to increase GDPR compliance?

While Google is negotiating consensus with EU regulators, you can follow these steps to bring your site closer to GDPR compliance:

  • Only use GA4 with the default anonymisation turned on
  • Ensure you don’t share GA4 data with other Google products
  • Sign a data processing agreement with Google to restrict data transfer
  • Disable GA4’s advertising personalisation feature
  • Only use GA4 data for aggregate statistical reporting
  • Get explicit cookie consent from users for the time being
     

Key questions to ask yourself about migrating to Google Analytics 4

  • Transition: have you thought about transferring conversion tracking and goals to events?
  • Data storage: have you thought about how you will store GA4 data after 14 months?
  • GTM set-up: is your GTM property set up to handle GA4 and other items such as Google Ads?
  • Google Analytics Data Comparison: what is your data comparison strategy after moving to GA4?
  • Time to migrate: is your team qualified to handle the migration? Have you planned how the time required to do so?


So, what are the next steps?

Although GA4 is not yet fully GDPR compliant, it makes sense to migrate as soon as possible because it still offers more advanced privacy features than its predecessor. Google Analytics has proven its worth in the past, but because of the data storage location issue, some businesses are considering alternative EU-hosted web analytics tools such as Matomo, Fathom and Plausible, or even to self-host.

With the former, you ensure that your data is stored in Europe, and with the latter, the data is stored in the country of your choice. Whatever your personal preference, Cyber-Duck's Google Partner-Certified Data Analytics & Digital Optimisation team is standing by to guide you through the migration process.