At the end of March, Google sent out a lengthy email to their advertisers and users of their various data services, particularly in Europe but also throughout the world with regard to the General Data Protection Regulation (GDPR). In the light of the recent Facebook issue where personal data was shared without consent, this move by Google seemed timely and also in preparation of possible future changes to legal restrictions that could be imposed.
The GDPR is a new data protection law which came into force in Europe on May 25, 2018. The GDPR affects European and non-European businesses using online advertising (such as AdWords) and measurement solutions (such as Analytics) when their sites and apps are accessed by users in the European Economic Area (EEA).
Google’s EU User Consent Policy is being updated to reflect the new legal requirements of the GDPR. It sets out the responsibilities of companies for making disclosures to, and obtaining consents from, end users of their websites and apps in the EEA. The policy is incorporated into the contracts for most Google ads and measurement products globally.
Google has been rolling out updates to their contractual terms for many products since last August, reflecting Google’s status as either data processor or data controller under the new law.
For users of Google Analytics (GA), Attribution, Optimize, Tag Manager or Data Studio, whether the free or paid versions, Google operates as a processor of personal data that is handled in the service. Data processing terms for these products are already available for users of these tools to accept (in Admin → Account Settings pages).
If users are an EEA client of Google Analytics, data processing will be included in their terms shortly. GA customers based outside the EEA and all GA 360 customers may accept the terms from within GA.
To comply with and support the compliance of companies with the GDPR laws, Google will be launching new controls for Google Analytics customers to manage the retention and deletion of their data. The policy will also require that publishers take extra steps in obtaining consent from their users and so, before May, Google will launch a solution to support publishers that want to show non-personalized ads, and they are also working with industry groups, such as IAB Europe, to explore proposed consent solutions for publishers.
At present these laws mostly apply to European countries, but could herald further restrictions and controls for online business and advertising around the world. It you’d like to know more, please get in touch.