Google Analytics User ID in Your Privacy Policy

Google Analytics and Google are pushing their new standard hard. Soon all accounts will be required to use Universal Analytics instead of the older implementation technologies.

With Universal Analytics, users benefit from new technology and tracking features. Its best advertised feature is User ID which allows to “Connect multiple devices, sessions, and engagement data (…).”

In short User ID lets you more accurately track various sessions to one user. It’s not hard to see that this potentially makes the analytics data much more insightful. This is what Google itself is saying about the feature:

The User ID is a Universal Analytics feature that you can use to associate multiple sessions (and any activity within those sessions) with a unique ID. When you send an unique ID and any related engagement data to Google Analytics, all activity is attributed to one user in your reports. With the User ID, you can get a more accurate user count, analyze the signed-in user experience, and get access to the new Cross Device reports. 

What changes for my privacy policy with User ID?

With User ID you also have some changes coming to your privacy policy. Google itself asks you to make those changes. Let’s see what they are and where we can find these requirements.

The User ID feature is built for use with the Universal Analytics technologies. All implementations must comply with the Google Analytics Measurement Protocol / SDK / User ID Policy. The Universal Analytics usage guidelines, and security & privacy principles also apply.

Source https://support.google.com/analytics/answer/3123668?hl=en

 Let’s, therefore, dive in deeper.

The Google Analytics Measurement Protocol / SDK / User ID Policy requirements

Here are Google’s requirements from the Measurement Protocol:

• You will give your end users proper notice about the implementations and features of Google Analytics you use (e.g. notice about what data you will collect via Google Analytics, and whether this data can be connected to other data you have about the end user). You will either get consent from your end users, or provide them with the opportunity to opt-out from the implementations and features you use.
• If you use an SDK to implement any Google Analytics Advertising Features, such as Audience Reporting or Remarketing, you will abide by the Policy for Google Analytics Advertising Features, in addition to the Google Play Developer Program Policies , or any other applicable policy.

Source https://developers.google.com/analytics/devguides/collection/protocol/policy

 Three things are important here and will have direct impact on your privacy policy text. 

• proper notice about the implementations and features
• get consent or provide them with the opportunity to opt-out from the features and implementations
• if you use Audience Reporting or Remarketing you need to additionally abide by further policies

The Universal Analytics Usage Guidelines requirements

Let’s dive in right away:

Let your users know about these Google Analytics features, and give them proper notice about your implementation changes. Get consent or provide an opportunity to opt-out of your services.

When you implement Universal Analytics, it is your responsibility to ensure that your use is legally compliant, including with any local or regional requirements for specific notification to users.

Source https://support.google.com/analytics/answer/2795983?hl=en

Google wants you to let your users know about the changes (moving from the older version to Universal Analytics). There is no direct impact here on your privacy policy.

Security and privacy in Universal Analytics requirements

Here’s an outtake:

(…) In case you use a service that has implemented the Measurement Protocol, please check the notice given and choice offered by this service directly with the Google Analytics customer using such service, as the opt-out directly provided by Google Analytics does not affect data reported through the Measurement Protocol.

Source https://support.google.com/analytics/answer/2838718

The point her is that you need to offer your users a way to opt-out for the features you use with Google Analytics that Google cannot control. Add a way for people to opt-out of these features to your privacy policy.

How iubenda can help you

If you have a privacy policy that you are confident in, consider making the changes written about above. Here is a summary:

• proper notice about the implementations and features
• get consent or provide them with the opportunity to opt-out from the features and implementations
• if you use Audience Reporting or Remarketing you need to additionally abide by further policies

If you don’t have a privacy policy or you want to improve your existing privacy policy, iubenda generates the privacy policy for you and spits out text ready to use on your site (or app). Here is another, shorter post, that outlines some other rules set out by Google about how you should implement User ID.