If you have a Google Analytics account you probably received an email with the subject, “[Action Required] Important updates on Google Analytics Data Retention and the General Data Protection Regulation (GDPR).” Over the past few days, Google Analytics has been informing all of its users of upcoming changes to meet the requirements of the GDPR, a new data protection law that will take effect May 25, 2018.
The updates being put in place will help Google remain compliant with the GDPR guidelines and help protect website visitors. By default, all website visitors in Google Analytics are anonymous and can not be tracked individually. However, in rare cases it may be possible to track an individual's activities based on email addresses or User IDs. The goal of these updates is to help protect people’s information and to ensure website users remain anonymous.
Most of your Google Analytics data will not be affected. All aggregate data such as, sessions, conversions, and acquisition will remain the same. The data retention period applies to user-level and event-level data associated with cookies, user-identifiers and advertising identifiers. This means it affects data from User-IDs, DoubleClick cookies, Android’s Advertising IDs and Apple’s Identifier for Advertisers.
Google Analytics is offering five different options for data retention. Users can choose between 14 months, 26 months, 38 months, 50 months or “do not automatically expire.” When data reaches the end of the retention period, it is deleted automatically on a monthly basis unless the “do not automatically expire” option is selected.
To set your controls:
*You need to have Edit permission for the property to set these options.
Google also announced the introduction of a user deletion tool. According to their report it will, “allow you to manage the deletion of all data associated with an individual user (e.g. site visitor) from your Google Analytics and/or Analytics 360 properties. This new automated tool will work based on any of the common identifiers sent to Analytics Client ID (i.e. standard Google Analytics first party cookie), User ID (if enabled), or App Instance ID (if using Google Analytics for Firebase).” The details surrounding this tool have yet to be released, but will be available soon on Google’s developer site.