Monday 19th November 2018

Google has begun serving GDPR notifications to Google Analytics users about data retention settings

The search giant has sent a number of communications to users in the last month about its new GDPR-related Analytics features and EU consent policy.
Jason Smith
by on 16th May 2018

Google has begun serving notifications to users in Google Analytics about its new data retention settings.

The notification appears in a bright yellow box at the top of the user’s screen and reads, “We’ve recently launched new Data Retention controls that may affect your data starting May 25, 2018.

“To dismiss this message, please visit your property’s Data Retention settings under Admin > Property > Tracking Info and click ‘Save’”.

Under the “tracking and info” category, Analytics allows users to select whether they’d like to retain account data for 14, 26, 38 or 50 months. There’s also an option that states, “do not automatically expire”.

The feature, which has been available since 11th April, is a response to the European Union’s General Data Protection Regulation (GDPR), which is set to come into force on the 25th May (which is also when the retention settings will come into effect).

Moreover, according to an email sent by Google on 10th May, 2018, “any user and event data that is older than your retention setting will be marked for permanent deletion, and will no longer be accessible in Google”.

The search giant has made it clear that the retention settings don’t apply to most standard reports in Analytics, which are based on aggregated data.

It also allows webmaster to select whether they wish to renew the data retention period with every new event logged by a user i.e. if a user returns to website and logs an additional event then the retention period associated with their ID will be reset.

In an email on the 11th April, Google states, “Even if you are not based in the EEA, please consider together with your legal department or advisors, whether your business will be in scope of the GDPR when using Google Analytics and Analytics 360”.

In the same email, Google also states, “Google Analytics and Analytics 360 customers using advertising features must comply with Google’s EU User Consent Policy,” which is available to read here.

The new policy demands that webmasters obtain “legally valid” end-user consent to “the use of cookies or other local storage where legally required” and “the collection, sharing, and use of personal data for personalization of ads or other services”.

It also states that when seeking consent, webmasters must retain records of consent given by end users and provide end users with clear instructions for revocation of consent.

Note: This article was updated on 23rd May to fix a typo. The article previously read “according to an email sent by Google on 10th May, 2018, any data in Google Analytics that is older than the retention setting specified will no longer be available to access as of the 25th May,” when it should have stated, “any user and event data”.