Google Analytics 4 Privacy Updates for the EU

Google Analytics 4 (GA4) is Google’s new digital analytics platform, which is set to replace Universal Analytics (UA) in 2023 (or 2024, if you’re a 360 customer). GA4 and UA are different in a variety of ways, and one of the areas in which GA4 significantly improves on UA is with respect to data privacy and governance. 

As many readers will know, data privacy is a complex, ever-changing topic, as new regulations continue to come into force around the world, while the technologies they aim to regulate evolve in real time. Fortunately for organizations using GA4, the platform comes with a variety of new tools and controls to help manage analytics in a more privacy-safe manner. 

One critical area in which GA4 has made improvements over UA is the way it handles the collection and storage of data from people in the EU. In UA, data collected from EU citizens is processed just the same as data collected from any other region of the world — despite the fact that the EU’s data privacy regulations are arguably the most robust in the world. More specifically, in UA, data from EU citizens could wind up being stored in an American data center, which is potentially an issue given the invalidation of the EU-US Privacy Shield.

GA4, by contrast, utilizes a customized approach for collecting EU data. First, while GA4 does use IP address for geolocation, GA4 always drops EU users’ IP addresses before their data is processed. This is important because a user’s IP address is considered by most to be “personal data” for the purposes of GDPR. Furthermore, all data collected from EU users is collected on servers located within the EU. This is a concrete improvement compared to UA, but is far from the only advancement GA4 has made when it comes to data privacy.

Indeed, GA4 introduces a whole suite of tools to help manage privacy — and to do so on a country-by-country basis. This flexibility is crucial given the ever-changing regulatory environment around the world. For example, GA4 users will be able to enable or disable Google Signals by country. Similarly, GA4 allows for the enablement/disablement of collection of granular location and device data on a country-by-country basis.

When it comes to data privacy, the one constant is change. Against that backdrop, GA4’s several new privacy controls — and the ability to granularly manage them — are a welcome development. They mean that organizations can feel confident that they are deploying Google Analytics in a more privacy-safe manner than ever, both for EU citizens in particular and for everyone in general.