Table of contents
TLTR
How to use Google Analytics on your website while complying with GDPR? In this article, we present several solutions, including the use of Iubenda for cookie management.
What is GDPR?
Effective since May 2018, the European General Data Protection Regulation (GDPR) has required website owners to strengthen their technical and organizational measures to ensure the utmost security of user data.
As explained in our article on GDPR and websites, to avoid heavy penalties, it’s essential to:
- clearly and comprehensively describe the purpose of data collection;
- block cookies and explicitly obtain user consent for activation;
- provide the option to revoke consent;
- record received consents;
- protect collected data;
- inform users of their rights and promptly notify them of any breaches.
How many websites are truly GDPR-compliant?
One year after GDPR’s implementation, what’s the situation? How many companies have adapted to the new regulation?
To answer these questions, we analyzed the behavior of numerous websites, all seemingly GDPR-compliant as they display the classic consent request banner for cookie installation upon initial access.
However, in many cases, Google Analytics cookies are not blocked and are already active even before the user provides consent.
Should Analytics cookies always be blocked?
Google Analytics cookies fall under the category of profiling cookies, which track user navigation online and transmit advertisements in line with expressed preferences.
As clarified by the Italian Data Protection Authority, unlike technical cookies, profiling cookies can only be installed on the user’s device after obtaining their consent.
Analytics cookies can be considered technical cookies and therefore can be installed even without consent, only when they collect information in aggregated form about the number of users and how they visit the site. This can be achieved through user IP anonymization.
However, while not affecting the basic Google Analytics statistics, this procedure prevents user geolocation by hiding information about their location.
Moreover, IP anonymization alone is not sufficient to prevent user profiling: Google Analytics could potentially cross-reference collected data with other products (it’s necessary, for instance, to disable sharing with other Google Products, Benchmarking, Audience Segments, and Demographic Reports in Google Analytics’ Account and Property settings).
How to Manage Privacy Effectively?
How can I ensure that Google Analytics cookies are blocked and that data is properly tracked upon obtaining consent?
To manage client privacy and cookie policies, our agency has chosen to use the Iubenda service, which provides solutions for adapting websites and apps to regulations like GDPR. To block Google Analytics cookies until user consent is obtained, we’ve integrated Iubenda with Google Tag Manager.
Iubenda’s cookie blocking settings allow you to choose whether to reload the page upon consent or not. However, this configuration negatively impacts Google Analytics statistics, as all sessions initiated after user consent are attributed to the Direct traffic channel, resulting in the loss of information about actual user sources.
Need Support? Antartika is a Iubenda Silver Partner!
Our agency is a Iubenda Silver Partner: a certification granted to agencies and web professionals experienced in configuring Iubenda’s compliance solutions.
If you require support or consultation, contact us, and we’ll assist you in making your website GDPR-compliant
Table of contents
