Google Analytics is by far the most widely-adopted analytics tool on the market. It’s free and relatively easy to implement.

However, some of its failings – particularly in the realm of privacy – make it an option with risks for you (potentially monetary ones) that outweigh the fact that it’s free. And it's important that you start to factor those in when looking at ROI overall.

If you’ve been using GA for any amount of time, you’re probably already aware that you had to migrate to GA4 in 2022, at least if you wanted to be able to keep year-over-year insights in tact.

In the much-pushed migration, Google hyped GA4 as a privacy-friendly alternative to its predecessor, Universal Analytics. And it’s true that Google made some updates that position its customers – and their audiences – to be more protected. It's also true that GA4 was officially deemed not GDPR-compliant. 

The challenges that remain are ones that you need to understand before choosing GA4 as your analytics platform of choice.

Key Considerations

Google owns your data. And it uses visitor data for its own purposes, including for its advertising.

The fact that Google owns your data is the biggest red flag in my book and is enough of a challenge to consider an alternative solution. Any time an entity outside of you owns your data, you’re essentially giving up earning potential and putting yourself at risk through the transfer of your audiences’ data to a third party – which also has monetary implications.

If you have Google Analytics code on your website and enable data sharing, advertisers in Google Ads know your visitors’ preferences based on the content they consume. That, in turn, allows Google to target those users with advertising.

The more entities that have access to your data, the bigger the chance of its security being compromised. In addition, you also have to disclose to your audiences – via your privacy policy and your cookie opt-in banner – that their data can be used in this way. The greater the number of third parties you release data to, the worse the look for you from a trust-building perspective. This practice increases the chances that your audiences will simply opt out of tracking, which means that you will lose the ability to understand key usage metrics on your site.

All told, the implications here mean that you should be extremely discerning about to whom you're willing to release audience data, because how those third parties handle it will impact whether audiences want to engage or not.

The most privacy-friendly option in GA4 is to disable data sharing. But then you lose access to many functionalities, including personalized retargeting of Google Ads products and demographic data reports. It’s all just… not great.

Google Analytics doesn’t offer a reliable consent framework. 

Google Analytics collects unique user identifiers by default. Using such identifiable data requires the user’s consent. Google initially tried to assign the task of collecting visitors’ consent to its publishers and Google Analytics users – i.e. YOU. 

That hasn’t really worked, based on EU countries’ interpretation of how Google’s plan was implemented. So, the second option proposed by Google is its consent mode. 

Consent mode is essentially meant to be Google’s answer to the increasing number of audience members who opt-out of tracking. Instead of using cookies when users opt out of tracking, it employs cookieless “pings.” Cookieless pings work by sending data from your website or app to Google's servers through browser APIs like the Beacon API or the Navigation Timing API. This allows websites and apps to collect and send data to Google Analytics without setting or accessing cookies, thereby helping to ensure compliance with data privacy regulations. Kind of. It also fills the data gaps you see due to opt-outs by estimating “lost” online conversions by using an AI-based algorithm.

If that sounds sketchy, that’s because it is. With the default settings recommended by Google, the platform continues to collect user data without the user’s permission. The info sent to Google still contains the user’s IP address and potentially other unique identifiers, such as device information and user_id and transaction_id. Because gathering this information is not considered strictly necessary, you can do it only with visitors’ consent. 

You can prevent sending users’ details to Google by changing the settings of the consent mode. But users unaware of this issue will still share data with GA, compromising the compliance of their consent collection. 

Google still transfers transatlantic data, which is the key reason it’s not considered GDPR-compliant. 

 The key compliance issue with Google Analytics is that it stores user data, including information about EU residents, on US-based cloud servers. On top of that, Google LLC is a US-owned company and subject to US surveillance laws, such as the Cloud Act.

Why do you need to care about this? Because if you use GA on your site, it means your privacy policy has to cover the bases of making sure your European consumers understand that you’re also not up to compliance by engaging with a company that isn’t compliant. Now, you don’t have to state it in those terms, of course, but you do have to assert that your use of GA4 means that EU data isn’t processed in the preferred manner.

Is It Time to Consider an Alternative?

In my book, yes. There are many analytics alternatives that are considered GDPR-compliant and actually offer more benefits that GA does. Check out a list of alternative options.

A few of those benefits:

• No data sampling. Unlike Google Analytics, tools like Matomo track all user data to offer accurate results.
• Data ownership. You own 100% of the data that alternative tools find.
• Some other tools are GDPR- and CCPA-compliant. This means that your privacy policy doesn’t have to do the work of explaining to audiences that their data is being used in ways that don’t jive.
• Behavioral analytics, such as heatmaps and session recordings, are included.
• You can easily import historical data from Google Analytics into your alternative.
• Matomo can be configured to automatically anonymize data so you don’t process any personal data. This puts you much less at-risk.

The downside that most organizations will point to is that these alternatives will come at a cost, whereas Google Analytics is free. 

With that rationale in mind, consider the costs if your organization is caught in a data breach in which you exposed your audiences’ data by way of GA. Consider the fact that, to be compliant, you’ll have to tell audiences that their data can be used entirely at GA’s discretion, and factor in the opt-out costs as a result of that. Consider that by using GA, you don’t own your organization’s site usage data and the associated costs that would arise should you migrate tools later or your data becomes damaged externally. Consider that even Google’s consent mode doesn’t truly honor audience opt-outs.

And most of all, consider the gains that could be seen by asserting to your audiences that you respect their choices in how they do and don't want their data to be used.

These are all factors that should become part of your ROI framework in assessing your analytics path forward.

--

If you'd like to talk about how to get your marketing program ready for changes related to audience demand for privacy, contact me for 1:1 support or customized sessions for your organization.