Google Analytics and Your Privacy Policy

If your website or app runs Google Analytics, you will need to have a Privacy Policy in place in order to comply with current privacy laws and with Google's Terms of Service.

If your company already has a Privacy Policy in place, you can update it so that it includes a new section that covers Google Analytics and online advertising.

With new laws coming online and with the probable ongoing evolution of your business, it's always a good time to take a fresh look at your Privacy Policy.

What is Google Analytics and why do you need to have a Privacy Policy if you use this service on your website or app?

What is Google Analytics?

Google Analytics a free web analytics service provided by Google that tracks and reports on all traffic that passes through your website or app. It also integrates with AdWords, allowing you to review the performance of your online ad campaigns by tracking site visits, conversion rates, and other key metrics.

You can use Google Analytics with AdWords to refine and adjust your keywords and ads to improve ROI and make better use of your marketing budget.

Google Analytics and Privacy Laws

Google Analytics uses a technical tool called cookies to collect information about your website visitors, app users and their online behaviors.

Because several laws govern the use of cookies and collection of personal information, you will need to have a compliant Privacy Policy posted to your site if you use Google Analytics.

These laws include the EU Cookies Directive, CalOPPA and the GDPR, all of which require a Privacy Policy if you collect personal information or use cookies.

Google Analytics Terms of Service

In its Terms of Service, Google Analytics clearly states that users of the service must have a Privacy Policy in place. This is necessary in order to comply with privacy laws that require certain disclosures and protections for the management of personal consumer information.

Specifically, Google requires any business using Analytics to disclose use of the service and explain how user data is gathered and stored.

These terms also require Google Analytics users to disclose their use of cookies.

You can do this by including a clause similar to this one from Indeed in your Privacy Policy:

Indeed informs users that Google Analytics is in use in order to "improve the functionality of your site."

This not only presents the company as transparent, but it also tells users that the collected information is used to enhance and improve their browsing experience. How collected information is used is an important component of many privacy laws.

Another way you can inform users of your use of cookies is with a cookies notice.

In the example below, Audi UK places a cookies notice in a pop-up header banner on its website.

In this notice, users are told that by clicking the "Continue" button and continuing to browse the site, they accept that cookies will be used. There also is a link for users to read more about cookies and the company's Privacy Policy.

This means that users will know about cookies right away without needing to check for a clause in a Privacy Policy.

Create your Cookie Consent

Google Analytics Advertising Tools

One popular feature of Google Analytics is its advertising tools. These tools enable businesses to use data gleaned from cookies for advertising purposes. Remarketing, also called retargeting, is a popular function that Google Analytics provides.

Google Analytics has grouped tools such as Remarketing, Google Analytics Demographics, Google Display Network Impression Reporting, and Interest Reporting under the umbrella of Advertising Features.

All Google Advertising Features must be disclosed to your users in a Privacy Policy.

You must do this by including the following three points in your Privacy Policy:

1. Which Google Analytics advertising features have you implemented on your site or app?

Create a list of every advertising feature you use on your app or site, including links to more information about each feature.

For example, if you use AdWords for retargeting, you must disclose this in your company Privacy Policy. It would also be helpful for users if you included links to Google's Privacy Policy and to its Remarketing website.

Here's how Audi MediaCenter tells its clients it uses Google Analytics remarketing service:

2. Disclose that you and your third-party vendors use both first and third party cookies (including Google advertising cookies).

It's important to advise your users that you use third parties for advertising purposes. Remember to point out that these third parties may use cookies and why, as in the example below from Audi MediaCenter's Privacy Policy:

3. Explain how visitors can choose to opt out of the Google Analytics' advertising features you are using on your site or app.

You must provide users with an easy-to-use option that enables them to opt-out of any Google Analytics features that your site or app uses. An easy way of doing this is to offer a link to the Google Analytics opt-out tool.

Indeed provides a link to Google's opt-out browser add-on.

This enables users to decline the use of cookies, thus emphasizing the company's desire for transparency, honesty, and trustworthiness.

Google Analytics Remarketing

If your site or app uses Google Analytics Remarketing Lists, you must agree to the Google Analytics Terms of Service. This Agreement requires that you have a Privacy Policy in place that clearly tells your users that cookies are used by Google Analytics Remarketing.

You must inform your users that cookies will be used to track visitors to your app or site and to show your ads to those users when they visit other sites.

The precise language that you should use to disclose your use of Google Analytics is not provided by Google. However, your emphasis should be on clarity, conciseness, and on providing relevant information to your users.

The following points should be included:

1. Tell your users that remarketing metrics are used on your site or app, and that this will present your products or website across other sites that they may visit.
2. Inform your users that Google and other third parties will present your ads on sites that your users visit subsequently.
3. Tell users that your ads will be presented on other sites because they have previously visited your site.
4. Clearly inform your users that they can choose to opt out of remarketing via the Google Ad Settings page. Providing users with a convenient link to this page is recommended.

In the following example, Etermax covers all 4 of those things in a clear and concise clause.

Another good example is provided by Storkie. Its Privacy Policy uses language that is specific to Google Analytics and clearly tells users that the site uses Google's cookies.

Users are also given information on how they can opt out of cookie placement via the Network Advertising Initiative Opt-out page.

If your website or mobile app uses Google Analytics to collect user data, you must ensure that you have a Privacy Policy in place in order to operate within the EU laws on data protection and to comply with Google's terms of use.

You must include clauses in your Privacy Policy that clearly explain what data is collected via Google Analytics, how it is collected, and why.

How to Create a Privacy Policy