Over 30 million sites use Google Analytics, so many marketers no doubt have the same question: is Google Analytics LGPD compliant?
The answer is "yes", but you should ask for consent first.
To make your GA usage LGPD-compliant, then, there are a couple steps you need to take, which are detailed below. The information pertains specifically to Google Analytics browser/website tracking - not to Google’s Firebase SDK, a tool for in-app analysis.
Please note, we are not a law firm. Please view this as informational, not legal advice, and speak to a lawyer before coming to a conclusion.
Table of Contents:
The LGPD is a Brazilian privacy law going into effect August 1, 2021. The LGPD regulates, amongst other things, how organizations may obtain, use, and store the personal data of Brazilian residents. For a detailed overview, read our LGPD summary. Its key highlights are:
Google Analytics is a free website tool that collects anonymized data on site visitors, aggregates it, and offers reports on where the traffic is coming from, what pages they browsed, for how long, etc.
Integrating with GA involves dropping a JavaScript tag or using a Tag Manager. These tags place a 1st-party browser cookie that has a randomly-generated ClientID.
While GA’s JavaScript tag doesn’t collect PII like name or email, the LGPD defines PII to include such persistent IDs as this ClientID. Many marketers may also use the UserID feature, which involves sending anonymous IDs to Google for more accurate tracking. On top of that, GA’s tracking tag sends Google the user’s IP Address, which the LGPD considers to be PII.
As such, since you are sharing your visitors’ PII with a third-party, this is information you must disclose to users.
The answer is likely "yes" - since it involves the collection/sharing of PII - but do know there's no 100% clear answer to this, as Google Analytics is not mentioned in the text.
Regardless of whether you choose to ask for consent or not, there are still steps you need to take to be fully compliant. Those actions are listed below.
Your privacy policy needs to detail the LGPD’s consumer data rights, which include, among others, the right to notice, access, opt-in, rectify, request deletion, and get equal services.
It must also detail - for every data use case - what information is being collected, why, how, and to whom it’s sent.
In this case, your privacy policy will need to specifically call out Google Analytics and explain what it is and why you use it. There’s no specific template for doing so, but one option is:
_"We use Google Analytics for aggregated, anonymized website traffic analysis. In order to track your session usage, Google drops a cookie (_ga) with a randomly-generated ClientID in your browser. This ID is anonymized and contains no identifiable information like email, phone number, name, etc. We also send Google your IP Address. We use GA to track aggregated website behavior, such as what pages you looked at, for how long, and so on. This information is important to us for improving the user experience and determining site effectiveness. If you would like to access what browsing information we have - or ask us to delete any GA data - please delete your ga cookies, reach out to us via this form, and/or install the Google Analytics Opt-Out Browser Add-On."
Understanding the LGPD’s data rights isn’t difficult: if they ask to delete or see their data, you must do it. This includes any Google Analytics data you or Google has on them.
What’s more complicated is figuring out how to honor that request from a technical standpoint. Even this is doable, though, and below lists multiple ways to delete or access their GA data.
First, ask the user to provide their Google Analytics ClientID. To find this, they’ll need to go to their browser’s settings and manually look at what cookies are stored. They should find one named "_ga", which is the Google Analytics cookie, and within it is a string like "GA1.2-2.318596131.1556642125".
The user’s ClientID are the numbers before and after the final period (in this case, "318596131.1556642125"). If they have multiple "_ga" cookies on their browser, they should send all of the ClientIDs.
If you are relying on UserIDs instead of ClientIDs (the differences are here), then you must grab the ID yourself (for instance, if you know their email and have their UserID tied to it).
Next, use Google's User Explorer Report to pull any data associated with this ClientID or UserID, and then send that user this information.
Alternatively, you could use Google's User Activity API to pull the data. The API Response will look like:
Alternatively you could use Google's User Deletion API and their ClientID/UserID to delete any data Google has on them.
Without doing this step, Google would store that user's data for 26 months, violating the LGPD deletion request. So you must manually delete their data via one of these steps should they request it.
This would be applicable if you are asking for consent before sending the user's anonymized data to Google. In this case, you would need to block the GA tag for non-consenting users.
What happens if Google Analytics somehow gets breached? Google would send an email to you first, but it’s on you to then contact your affected users. If you don't already have a plan in place, the UK’s Information Commission Office has a great guide on what you need to do. It was created for the GDPR but is just as applicable to the LGPD.
Fortunately, Google has been very proactive in regards to these laws, as noted in their security compliance page. Their actions include:
Nonetheless, there are still actions to take to limit what data you send Google.
To use Google Analytics and stay LGPD compliant, you'll need to:
Of course, further rulings may make this information obsolete, so we’ll track and report on any obvious changes.
