One issue that the cookie law doesn't specifically tackle, which I think is more important for privacy in practice, is one point about Google Analytics which, let's face it, is used by most or at least a vast number of blogs and sites.
The point is this. When a site adds Google Analytics code to its webpages, it's enabling Google to set cookies on the machines of the site's users, through which Google collects information about the users' browsing. Of course, the reason the site does this is so to enable it to view and analyse the metrics and statistics collected for it by Google, and Google provide some excellent analytics tools, reports and visualisations etc for that, all for free.
But the side effect of this is that Google gets the collected information too. It stores it on its own servers, and is able to use it - if you share it with Google. This data sharing is turned on by default. You have to take active steps to turn it off, if you don't want to share your Analytics data with Google (I'll explain how below).
Google Analytics data sharing
When you go to your Analytics settings there's a page (on which more below) all about "data sharing". The info on Google Analytics privacy is scattered around. Here are a few links (if anyone finds any I've missed please let me know):
- Analytics privacy overview
- Another, slightly different, page - Google Analytics privacy
- How to disable tracking on your site (needs coding experience!)
- Data sharing overview
- Analytics data sharing FAQs
What can Google do with your Analytics data?
The FAQs say:
Shared data will be used to improve the services we provide you and will help create more powerful features for you to choose from. As they become available, only those who share their data with Google will gain access to these services and features (e.g. benchmarking and an enhanced version of AdWords Conversion Optimizer). The DoubleClick Ad Planner Publisher Center will also offer greater insight to the customers who have opted in to share their data in Analytics and Ad Planner.
As for data sharing specifics:
What does it mean to share my Google Analytics data anonymously with Google and others?
If you only choose the anonymous data sharing option, Google will remove all identifiable information about your website, then combine that data with hundreds of other anonymous sites in comparable industries and report them in an aggregate form. Google will use this anonymous data to improve products and services and provide you with a benchmarking report.
What does it mean to share my Google Analytics data with Google products only?
If you choose to share your site's data, Google will use the data to improve the products and services we provide you. Additionally, only users who have opted to share their site's data with Google may use these new or improved services.
There's a bit more detail once you get to your Analytics settings data sharing page (on which more below). There are two types of sharing you can disable or enable:
1. With other Google products only optional
Enable enhanced ad features and an improved experience with AdWords, AdSense and other Google products by sharing your website's Google Analytics data with other Google services. Only Google services (no third parties) will be able to access your data.
Example Use:Google Conversion Optimizer
If you are an AdWords customer, selecting this option will allow you to use Conversion Optimizer once it is available, with the following key benefits:
- Meet your ROI objectives by automatically managing your bids according to maximum CPA goals.
- Minimize your conversion costs while saving your time.
2. Anonymously with Google and others optional
Enable benchmarking by sharing your website data in an anonymous form. Google will remove all identifiable information about your website, combine the data with hundreds of other anonymous sites in comparable industries and report aggregate trends in the benchmarking service.
Example Use: Google Analytics Industry Benchmarking
- Use Benchmarking to compare your site's performance with those of other websites in your industry.
- Pinpoint performance problems and estimate how much you can improve your site metrics.
How to disable Google Analytics data sharing
The data sharing overview says "Data sharing settings may be edited on the Account Settings page."
The trick is to get to that Account Settings page. After hours, OK certainly tens of minutes, of clicking around, I found it. It's the hardest settings page to find that I've ever had to deal with, I won't venture to suggest why…
So here's how to find the Account Settings page for data sharing (should work until Google changes it!).
- Log in to Google Analytics. You'll see something like this (but with your sites listed rather than mine, of course).
- UPDATE: there's an alternative, you can just click the Accounts tab on the right, then drill down on the page itself by clicking each account/sub-site etc if necessary, until you can see the Account Settings tab shown in step 7.
Click the + against your site's name.
- Click the + against the "UA-whatever" link under that.
- Just keep going on the + signs till you've expanded it all, to find the site you want to change settings for.
- Click the site's name, under all that (in my case, it's ACE). You'll see something like what's below. On the right, click Admin.
- Now after "All Accounts >", along the top (ish), click the name of your site, the one where you want to disable sharing.
- Finally, click Account Settings.
- You're there at the Data Sharing settings page!
- Here you can UNtick either or both of the data sharing options. Then click Apply, and that's it.
The cynical might ask, how do you really know whether Google are in fact honouring that setting, if you disable sharing?
Well, you don't know, you'll just have to take on trust - but at least you've done the best you can, and hopefully that will make your use of Analytics more defensible from a cookie law viewpoint.