66% of the websites on the internet use an analytics tool, and more than 86% of those use Google Analytics. Chances are you are using it to collect information on your website visitors.
In order to do this, Google Analytics uses cookies to identify website visitors and collect information that helps you to understand how your website is performing.
It's important to understand how Google Analytics works and what data it's collecting to make sure you are using it in a compliant way and not breaking any laws.
Let's dive in!
💡 Oh one more thing, the easiest way to make sure you are compliant is using privacy-friendly website analytics analytics that don't use cookies or trackers at all. No need for consent, no breaking any laws and you still get the insights you need: Try Simple Analytics
- How Google Analytics collects data
- Google Analytics datapoints collection
- Google Analytics metrics collection
- Google Analytics and cookie consent
- Missing data from opt-out website visitors
- Does Google Analytics collect personal data?
- Google Analytics vs Cookie-less Analytics
- Final thoughts
How Google Analytics collects data
Google Analytics collects data through short lines of Javascript or HTML code called tags. These tags are placed on a web page and collect data points when triggered by a specific event- for instance, when a visitor views a page or clicks on a link.
Google Analytics processes these data points to provide users with metrics. For instance, page views are used to count visits, and these data are then shown in a dashboard to tell you how many visitors came to your website this week.
Google Analytics organizes these metrics into reports to give the user an overview of the performance of their website.
Google Analytics datapoints collection
Google Analytics tracks various hits (or datapoints), including pageviews, events, and transactions.
Pageviews are the most basic type of hits. They represent a user visiting a page on your website. Every time a visitor loads a page on your website, a pageview hit is recorded in Google Analytics.
Events are interactions with specific elements on your website such as clicking on a button or playing a video. You can use events to track user behavior and get more detailed insights into how visitors interact with your website.
Transactions are completed purchases or other conversions on your website. They represent the result of a user's journey on your website, and they are often used to measure the success of your website's performance. Transactions are mainly used by e-commerce websites and are sometimes referred to as e-commerce tracking.
There is quite a few more datapoints that Google collects. See the full list here.
Google Analytics metrics collection
Using the datapoints Google Analytics organizes a large range of metrics that are shown in your dashboard. Here are some of the most important ones:
User demographics: Google Analytics collects data about the age, gender, and interests of your users, as well as their location and language. This metric is processed using data from third-party sources as well, such as Google's advertising network. The practice is highly privacy-invasive as you collect personal information on your website visitors. If you don’t need this, you can also look at other analytics tools that are more privacy-friendly.
Unique visitors: Google Analytics can tell whether a page view comes from a first-time or returning visitor. This metric can help you assess whether your audience is growing and which pages are the most successful in attracting new visitors to your website.
Traffic sources: data is collected on the sources of your website traffic, including data about the search engines, websites, and social networks that are referring traffic to your website. This data helps you understand how people find your website.
Traffic channels: this metric is similar to traffic sources but not quite the same. Traffic channel is based on classifying traffic sources into different groups, such as organic search, direct traffic, referral traffic, and paid search.
Conversions and goals: the customer can set up specific goals in Google Analytics. Goals and conversion data are collected, including the number of times a goal is completed, the value of each goal, and the conversion rate for each goal.
Device and browser information: Type of devices, operating systems, and web browsers. This data can help optimize the user experience for different devices and browsers.
User engagement: GA collects data on how engaged your website visitors are, based on how many pages they view, the time they spend on each page, and the bounce rate (the percentage of users who leave after viewing only one page).
Campaigns and promotions: data about the campaigns that you are running for your website, including data about the keywords, ads, and landing pages that are associated with each campaign.
Google Analytics and cookie consent
Google Analytics is built around cookies. Cookies are small files that Google Analytics reads and writes on a user’s browser. Google Analytics cookies include unique identifiers. This identifier allows Google Analytics to recognize an individual user by simply reading their cookies.
Cookies allow Google Analytics to refer data points to the same visitor. Some key metrics simply cannot be collected without cookies! This is why Google Analytics 4 still uses first-party cookies despite being advertised by Google as a cookieless tool.
For instance, knowing what pages attract the newest visitors to your website can be useful. But Google Analytics cannot count unique visitors without using cookies. It will still register each page view, but because it cannot link them with a unique ID, it will have no idea whether each page view came from a unique or a returning visitor.
Analytics cookies, including Google Analytics, are considered non-essential cookies under European law and can only be placed with the user’s consent. This is why websites that use Google Analytics need a cookie banner for the European audience.
If you want to learn more about cookie consent using Google Analytics check this article here
Missing data from opt-out website visitors
That's a really big problem for Google Analytics and other cookie-based tools.
An ever growing number of jurisdictions- including the key EU and UK markets- require opt-in consent for cookies. Websites that use Google Analytics need to display a cookie banner and may not write cookies unless the user actively accepts cookies.
More and more users reject the cookie banner. This creates a data gap for cookie-based analytics. Only users that consented can be tracked using Google Analytics. This results into incomplete data and you are missing a big portion of your total website visitors.
It is difficult to find reliable estimates for cookie opt-outs but the general consensus among marketers is that numbers are around 20%. We ran a real-life case study showing this. Togehter with media production company Hebban we ran a test to benchmark Google Analytics numbers with Simple Analytics numbers. (Simple Analytics does not use cookies, so it doesn't need consent to collect visitor data. You can read more about the results here.
Does Google Analytics collect personal data?
The answer depends because every legal system defines personal data in its own way.
As we explained, the Terms of Service for Google Analytics prohibit customers from collecting personally identifiable information (PII). But it is no guarantee that Google Analytics does not collect PII: it is up to the customer to set up Google Analytics in a way that prevents them from being collected.
Furthermore, PII are defined rather narrowly and may not cover the notion of personal data in every jurisdiction. So, a customer may correctly set up Google Analytics to avoid collecting PII and still end up collecting personal information under the applicable privacy law.
For instance, the notion of personal data under the GDPR is much broader than PII as defined in the Terms of Service. The unique identifiers found in Google Analytics cookies are personal data under the GDPR because they refer specifically to an individual user.
As outlined in the beginning of this article, the easiest way to be secure is to use a privacy-friendly website analytics tool that does not use cookies.
Google Analytics vs Cookie-less Analytics
There are a few flavours in the cookie-less options:
Fingerprinting-based analytics services. Those can be even more invasive, as they combine browser and device data in a way that aggressively identifies visitors. Unlike cookies, fingerprinting techniques cannot be detected by visitors, which creates the potential for abuse.
The second flavour is more privacy-friendly but still raise some question marks. For instance, Piwik Pro and Google Analytics collect similar data points, but Piwik's cookies have more reasonable expiration dates. Others, like Plausible Analytics, do away with cookies entirely but still collect personal data like IP addresses.
Simple Analytics does not collect personal data at all. Instead, we rely on referrers to calculate crucial metrics such as unique visitors and traffic sources (you can learn more about this in our documentation).
Final thoughts
Let's be clear: Google Analytics has its pros. It is most comprehensie and powerful analytics tool on the market and within a certain amount of hits, it is free to use (you could argue you pay with your data).
On the other hand, collecting many data points is a double-edged sword. With power comes responsibility and Google Analytics is dodging theirs. You could state that Google Analytics is a privacy disaster because of the aggressive tracking of users and because they share personal data with countless advertisers.
Last but not least, Google Analytics greatly suffers from the data gap created by cookie banner opt-outs. If you are missing the data for 20% of your visitors, then your analytics are going to be wildly inaccurate.
If you are open to exploring privacy-friendly alternatives: Simple Analytics gives you the insights you need without tracking visitors and collecting personal data. We believe web analytics and privacy do not need to be at odds with each other. If this sounds good to you, feel free to give us a try!