Why is consent required to place Google Analytics cookies? Following the new guidelines and recommendations, the practical guide on audience measurement has been updated by the CNIL for developers.
Google Analytics is a helpful tool, but do users need to consent to cookies placed by Google?
The CNIL provides some answers, and the answer is mostly YES.
Exemptions from consent concern cookies necessary for the delivery of the service.
From a legal point of view, your website allows you to deliver a service with additional features.
For example, a user navigates on a news website. By default, they are supposed to accept cookies considered strictly necessary for the publisher to deliver this online news service. Audience measurement is part of it.
More specifically, what does it cover?
- Performance measurement;
- Detection of navigation issues;
- Technical performance optimization;
- Site ergonomics optimization;
- Estimation of necessary server power;
- Analysis of viewed content.
Conversely, other forms of data usage are considered secondary. They are associated with additional features the user is supposed to have yet to accept by default when connecting to and browsing the site.
- The ability to share articles on social media pages;
- Display of personalized ads;
- The editorialization of a list of products or articles displayed on the site based on the user’s interests.
Consent is necessary for these features and the associated cookie placement.
Google Analytics cookies are subject to consent.
And there are multiple reasons for this.
- Like Facebook Analytics or Quantcast Analytics, Google Analytics allows Google to collect data for its own service improvement needs. Your audience will enable you to measure your site’s audience. But by default, they did not accept that you would share their data with Google.
- You use Google Analytics to measure your site’s audience… and more. The data is also used for advertising performance measurement and personalized ads displayed to users. You may be doing multi-site tracking of your audience’s browsing behaviors.
For these reasons, you cannot place analytics cookies when loading your site’s web pages. It cannot be considered that these cookies are only used to measure the site’s audience, strictly speaking.
How to be exempt from consent for Google Analytics cookies?
Clarifying rules governing audience measurement solutions will undoubtedly lead you to reconsider your website’s GDPR compliance.
Do you know the importance of ensuring GDPR compliance for your subcontractors? It is time to ask yourself if Google Analytics is the solution or the problem.
- Your transparency and ethical data use efforts are weakened. Google is not your subcontractor; you are one of its data acquisition sources.
- You depend on Google’s goodwill regarding the possibility of preventing it from using data for its needs. And therefore, not asking users for consent to place analytics cookies.
- Since the Privacy Shield’s invalidation, transferring personal data to the United States has become more sensitive. And that is what you are doing with this solution.
It may be time to look for an alternative to Google Analytics.
But if the tool is essential to you, how can you make it GDPR compliant? You will need to configure the device to continue using it properly. Be sure to check the GDPR compliance of your website. This involves:
- Signing a data processing addendum with Google;
- Anonymizing IP addresses;
- Configuring cookies and tags inserted in the source code to restrict the necessary data collection to the minimum;
- Limiting cookie lifespan and data retention
Conclusion: User consent is required to use Google Analytics.
It’s not surprising.
Like other actors, Google provides a free solution to the market. In return, Google can use the collected data for itself.
You can use your audience measurement solution for statistical and analytics purposes but for personalization or any other advertising purpose.
This means the user connecting to your site must be offered the option to accept or refuse this type of cookie when loading the site. The cookie management module used, and you know that Axeptio offers one, will subject their deposit to a prior consent rule.
Not asking for consent would assume that Google can be prevented from using the data for its purposes. But also restrict your behavioral measurement to exclusively analytical purposes.
That’s why you can consider using another solution.
In any case, it is essential to review the configuration of your tool to limit the collection and storage of personal data.
