How does Google Analytics collect data?

Image of Iron Brands

Published on Apr 14, 2023 and edited on Oct 10, 2024 by Iron Brands

66% of the websites on the internet use an analytics tool, and more than 86% of those use Google Analytics. Most people have heard of Google Analytics, but how does it really work?

To find out what Google Analytics can do for your business, it is vital to understand the basic concepts and inner workings of the tool.

  1. How does Google Analytics collect data?
  2. What data points does Google Analytics collect?
  3. What metrics does Google Analytics collect?
  4. What are cookies and why are they important?
  5. What about users who turn down cookies?
  6. What data does Google Analytics not collect?
  7. Does Google Analytics collect personal data?
  8. How long does Google Analytics store data?
  9. Is Google Analytics difficult to use?
  10. What are the differences with privacy-friendly analytics in terms of data collection?
  11. Are data transfers an issue for privacy-friendly tools?
  12. What else should you look for in a privacy-friendly analytics service?
  13. Conclusion
Logo of the Government of the United KingdomThe UK Government chose Simple AnalyticsJoin them

In this article, we will dig a bit into Google Analytics and explain what data it collects, and how.

How does Google Analytics collect data?

Google Analytics collects data through short lines of Javascript or HTML code called tags. These tags are placed on a web page and collect data points when triggered by a specific event- for instance, when a visitor views a page, clicks on a link or plays an embedded video.

Google Analytics processes data points to provide users with metrics. Metrics are aggregate data that give useful information about the performance of their website. For instance, page views are used to count visits, and these data are then aggregated to show a customer how many times their website was visited within a day, week, or month. This metric tells the user whether their traffic is growing or shrinking.

Google Analytics organizes metrics into reports to give the user an overview of the performance of their website. Users can customize reports to get an overview of the metrics they deem the most important.

What data points does Google Analytics collect?

Google Analytics tracks various hits (or datapoints), including pageviews, events, and transactions.

  • Pageviews are the most basic type of hits. They represent a user visiting a page on your website. Every time a visitor loads a page on your website, a pageview hit is recorded in Google Analytics.

  • Events are interactions with specific elements on your website such as clicking on a button or playing a video. You can use events to track user behavior and get more detailed insights into how visitors interact with your website.

  • Transactions are completed purchases or other conversions on your website. They represent the result of a user's journey on your website, and they are often used to measure the success of your website's performance. Transactions are mainly used by e-commerce websites and are sometimes referred to as e-commerce tracking.

Google Analytics tracks other datapoints such as social interactions and user timings.

What metrics does Google Analytics collect?

Google Analytics collects a wide range of metrics. Here are some of the most important:

  • User demographics: Google Analytics collects data about the age, gender, and interests of your users, as well as their location and language. This metric is processed using data from third-party sources as well, such as Google's advertising network. The practice is highly privacy-invasive as you collect personal information on your website visitors. If you don’t need this, you can also look at other analytics tools that are more privacy-friendly.
  • Unique visitors: Google Analytics can tell whether a page view comes from a first-time or returning visitor. This metric can help you assess whether your audience is growing and which pages are the most successful in attracting new visitors to your website. Unique visitors are a key performance metric for so called "landing pages"- that is, pages that are mostly meant to attract new visitors to the websites
  • Traffic sources: data is collected on the sources of your website traffic, including data about the search engines, websites, and social networks that are referring traffic to your website. This data helps you understand how people find your website.
  • Traffic channels: this metric is similar to traffic sources but not quite the same. Traffic channel is based on classifying traffic sources into different groups, such as organic search, direct traffic, referral traffic, and paid search.
  • Conversions and goals: the customer can set up specific goals in Google Analytics. Goals and conversion data are collected, including the number of times a goal is completed, the value of each goal, and the conversion rate for each goal.
  • Device and browser information: Type of devices, operating systems, and web browsers. This data can help optimize the user experience for different devices and browsers.
  • User engagement: GA collects data on how engaged your website visitors are, based on how many pages they view, the time they spend on each page, and the bounce rate (the percentage of users who leave after viewing only one page).
  • Campaigns and promotions: data about the campaigns that you are running for your website, including data about the keywords, ads, and landing pages that are associated with each campaign.

Metrics that Google Analytics collect

What are cookies and why are they important?

Google Analytics is built around cookies. Cookies are small files that Google Analytics reads and writes on a user’s browser. Google Analytics cookies include unique identifiers- strings of numbers and letters unique to each cookie. This identifier allows Google Analytics to recognize an individual user by simply reading their cookies.

Cookies allow Google Analytics to refer data points to the same visitor. Some key metrics simply cannot be collected without cookies! This is why Google Analytics 4 still uses first-party cookies despite being advertised by Google as a cookieless tool.

For instance, knowing what pages attract the newest visitors to your website can be useful. But Google Analytics cannot count unique visitors without using cookies. It will still register each page view, but because it cannot link them with a unique ID, it will have no idea whether each page view came from a unique or a returning visitor.

This is not to say you cannot use Google Analytics without cookies. You can- it just won’t work very well because it won’t provide you with unique visitors and other important metrics. This is also why Google Analytics suffers greatly from the increasing popularity of ad blockers- browser plug-ins that prevent certain cookies from being written.

It is worth mentioning that all analytics cookies, including Google Analytics, are considered non-essential cookies under European law and can only be placed with the user’s consent. This is why websites that use Google Analytics need a cookie banner for the European audience.

Some other data points can be collected without consent, provided their collection does not involve cookies. But these data points will give you an incomplete and inaccurate picture when Google Analytics cannot piece them together with cookies.

What about users who turn down cookies?

That's a really big problem for Google Analytics and other cookie-based tools.

An ever growing number of jurisdictions- including the key EU and UK markets- require opt-in consent for cookies (with very narrow carve-outs that do not apply to web analytics). Websites that use Google Analytics need to display a cookie banner and may not write cookies unless the user actively accepts cookies.

Stronger consent rules empower users to reject cookies, and reject them they do. This creates a data gap for cookie-based analytics: metrics are be quite accurate for the portion of the user base the accepts cookies and absolutely terrible for the portion that does not. This compromises the main pro of cookie-based analytics: data accuracy.

It is difficult to find reliable estimates for cookie opt-outs but the general consensus among marketers is that numbers are quite high and problematic (from their viewpoint- we at Simple Analytics are very happy that the public is rejecting cookies!).

What data does Google Analytics not collect?

As a web analytics tool, Google Analytics cannot collect any data unrelated to your visitor’s online activity.

Additionally, Google Analytics Terms of Use prohibit customers from collecting personally identifiable information (PII). Google defines PII as information directly identifying a visitor, such as a name, username, email address, or phone number.

This does not mean that Google Analytics does not collect personal data. As Google’s own documentation points out, data that do not qualify as PII under Google’s policies may still qualify as PII or personal data under some privacy laws.

Does Google Analytics collect personal data?

The answer depends because every legal system defines personal data in its own way.

As we explained, the Terms of Service for Google Analytics prohibit customers from collecting personally identifiable information (PII). But it is no guarantee that Google Analytics does not collect PII: it is up to the customer to set up Google Analytics in a way that prevents them from being collected.

Furthermore, PII are defined rather narrowly and may not cover the notion of personal data in every jurisdiction. So, a customer may correctly set up Google Analytics to avoid collecting PII and still end up collecting personal information under the applicable privacy law.

For instance, the notion of personal data under the GDPR is much broader than PII as defined in the Terms of Service. The unique identifiers found in Google Analytics cookies are personal data under the GDPR because they refer specifically to an individual user.

Other data points collected by Google Analytics are not personal data in and of themselves but might count as personal data under the GDPR when combined with other information that allows Google to single out a user among the rest of the Internet traffic. For instance: device data, language data, and OS are not, in and of themselves, personal data. But if only one person browses the Icelandic version of a website with a certain device and OS, these data are personal data.

How long does Google Analytics store data?

Google Analytics 4 stores user-level data for 2 or 14 months, depending on the settings. Aggregated metrics are never deleted.

Is Google Analytics difficult to use?

Google Analytics is a complex tool. Adding tags to your website is relatively straightforward, as another Google service called Google Tag Manager can automate the process. However, setting up the tags to do exactly what you want requires some know-how and coding skills. Organizing custom reports is also complex since Google Analytics collects many data points by default, most of which are unneeded for many customers.

If you are looking for a more straightforward analytics tool that provides the insights you need in a straightforward dashboard, you might want to check out other tools like Simple Analytics instead.

What are the differences with privacy-friendly analytics in terms of data collection?

Not all alternatives to Google Analytics are privacy-friendly. For instance, Adobe Analytics collects similar data points to Google Analytics.

Fingerprinting-based analytics services can be even more invasive, as they combine browser and device data in a way that aggressively identifies visitors. Unlike cookies, fingerprinting techniques cannot be detected by visitors, which creates the potential for abuse.

Other analytics services are more privacy-friendly but still differ in what data points they collect and how they process them to preserve privacy. For instance, Piwik Pro and Google Analytics collect similar data points, but Piwik's cookies have more reasonable expiration dates. Others, like Plausible Analytics, do away with cookies entirely but still collect personal data like IP addresses.

We at Simple Analytics do not collect personal data at all. Instead, we rely on referrers to calculate crucial metrics such as unique visitors and traffic sources (you can learn more about this in our documentation).

Are data transfers an issue for privacy-friendly tools?

Since the Schrems II ruling of the EU Court of Justice, Google Analytics has come under fire from European privacy watchdogs because it transfers personal data to the US. These data transfers expose personal data to the risk of surveillance from US authorities, and Google does not have sufficient safeguards in place to eliminate this risk.

This is why the Austrian, French, Italian, Danish, and Finnish privacy authorities all took a stance against Google Analytics, and why Meta was fined for €1.2 billion.

The long legal saga around data transfers was temporarily halted by the adoption of a new data transfer framework between the EU and the US, but we don't expect this to last for long. Two such frameworks were already invalidated by the EU Court of Justice and the new frameworks will likely meet the same fate.

Are data transfers an issue for privacy-friendly alternatives to Google Analytics as well? It depends.

The core of Google’s legal troubles is that personal data are transferred to the US. If a web analytics service collects personal data, you should carefully read its documentation and ensure that it is hosted in the EU/EEA and relies on European content delivery systems (CNS). IData transfers are not an issue as long as the data does not leave the EU.

For services that require data transfers to non-EU/EEA countries other than the US, it’s a bit more complicated. Such services can also be GDPR compliant, depending on the country and on the safeguards in place. The rules are somewhat convoluted- you can check this blog if you want to know more.

Finally, data transfers are not an issue for services that do not track users or collect personal data. Non-personal data do not fall under the GDPR and can be transferred anywhere with no limitations or compliance burdens.

We at Simple Analytics do not collect any personal data, so our customers don’t need to worry about data transfers at all. We are also EU-hosted and only rely on EU-based CDNs, just to be on the safe side.

What else should you look for in a privacy-friendly analytics service?

Data collection is not the only factor that makes a service privacy-friendly. Data disclosure policies are as important, if not more.

In fact, the aggressive tracking of visitors is not even the biggest problem with Google Analytics. The main problem is how Google monetizes the enormous amounts of personal information they collect through Google Analytics and other services by sharing them with advertisers.

If you are looking for a truly privacy-friendly service, closely check their data disclosure policy.

In case you’re wondering, Simple Analytics never shares your data with anyone.

Conclusion

Let’s be clear: Google Analytics has its pros. It is a good analytics software that collects many data points and provides fine-grained metrics. And within a certain amount of hits, it is free to use (more exactly: you pay with your data).

On the other hand, collecting many data points is a double-edged sword. There are countless tags, which makes it tricky to set them up the way you want. Reports are harder to organize, and it can be difficult to figure out which metrics are important to your organization and which are not.

More importantly, Google Analytics is a privacy disaster because of the aggressive tracking of users and because Google shares personal data with countless advertisers.

Google Analytics forwards unprotected personal data to the EU. This is likely to become a legal issue in the near future. Privacy activists are pushing back against EU-US data transfers and the upcoming "Schrems III" decision may very well make GDPR-compliant use of Google Analytics impossible- or at least, way too cumbersome to be worth it.

Last but not least, Google Analytics greatly suffers from the data gap created by ad-blockers and cookie banner opt-outs. If you are missing the data for 30% of your visitors, then your analytics are going to be wildly unaccurate, and crucial metrics such as unique visitors are going to be an educated guess at best.

That’s a long list of negatives, isn’t it? That’s why many organizations could benefit from switching to a more user-friendly, privacy-friendly tool with no compliance issues.

We build Simple Analytics to be just that. Simple Analytics can provide your business with valuable insights without tracking visitors and collecting personal data. We believe web analytics and privacy do not need to be at odds with each other. If this sounds good to you, feel free to give us a try!

GA4 is complex. Try Simple Analytics

GA4 is like sitting in an airplane cockpit without a pilot license

Start 14-day trial