Google has started making some changes to the way its Remarketing option in Google Analytics works by enriching it with cross-device data available in AdWords and DoubleClick. That means this could have consequences for any Google Analytics users’ privacy policy. It’s seemingly something Google takes seriously as they’ve emailed anyone with a Remarketing option in their Google Analytics installation to take another look at their privacy policy:

Dear Google Analytics User,
Remarketing with Google Analytics will soon be enhanced to take advantage of new cross-device functionality available in AdWords and DoubleClick.
Please log in to your account for an important update to your remarketing settings, which may relate to your privacy policy.”

Then, in the Google Analytics admin it says:

The important parts are pasted below:

Starting 15 May 2017, Remarketing Audiences created in Google Analytics will be enhanced to automatically take advantage of new cross-device remarketing functionality now available in AdWords and DoubleClick. This will allow you to reach your customers across devices when using Google Analytics Audiences. (…)

The same message states:

No action is required for these changes to take effect but please review your privacy policies and make any necessary updates to explain what data your business collects and shares with Google.

Now what does that mean for a privacy policy?

Your use of the Remarketing option has certain consequences.

You are probably aware that any site using Google Analytics should display a privacy policy and disclose the use of Google Analytics. Using Remarketing for Google Analytics adds certain additional disclosure related requirements to your privacy policy. These requirements are outlined in Google’s “Policy requirements for Google Analytics Advertising Features“. You’ll find the important parts copied here:

If you’ve enabled any Google Analytics Advertising features, you are required to notify your visitors by disclosing the following information in your privacy policy:

  • The Google Analytics Advertising Features you’ve implemented.
  • How you and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together.
  • How visitors can opt-out of the Google Analytics Advertising Features you use, including through Ads Settings, Ad Settings for mobile apps, or any other available means (for example, the NAI’s consumer opt-out).

We also encourage you to point users to Google Analytics’ currently available opt-outs for the web.

European Union user consent policy

When using Google Analytics Advertising Features, you must also comply with the European Union User Consent Policy.

Interest-based advertising

If you’ve enabled interest-based advertising, including Remarketing, with Google Analytics in connection with other Google services, you must follow the policies applicable to those Google services (like the Google AdWords Policy for Personalized advertising and its sensitive category restrictions, and the DoubleClick Services Platform Program Policies). If you use Google Analytics to collect sensitive information about your visitors, as described in the Google AdWords sensitive category restrictions, you may not use Google Analytics to collect data for the purpose of interest based advertising.

In short it says two things: 

  • properly inform your users about the Google Analytics features you use and let them opt-out of these features. 
  • seek proper consent ahead of time if you target European Union users (like for example with a cookie banner).

We’ve written about various of these issues on this blog before:

If you’re handling your privacy policy yourself, then you know what the task is ahead of you, everyone else may be happy to hear that iubenda automates a lot of this process for its users.

With iubenda’s privacy policy generator you can get started fast on the path to equip your site with a privacy policy. Look for “Google Analytics” and “Remarketing through Google Analytics (…)” as well as the AdWords Remarketing service. The Google Analytics service itself is available for free to all users, while all additions with a commercial background are available to any iubenda paid tier subscribers.

If you are already a iubenda user, you can read the simple steps to take to add some of the disclosures required by Google on our help page

Generate a Privacy Policy for Google Analytics

Privacy Policy for Google AnalyticsGoogle Analytics User ID in Your Privacy PolicyDisplay Advertising for Google Analytics

About Us

iubenda is the easiest and most professional way to generate a privacy policy for your website, mobile app and facebook app

Generate a privacy policy now

Ready in a few steps and built to meet the needs of both website and mobile app owners

Generate your privacy policy now

Sometimes the best choice is to "just give it a try"

iubenda is the easiest and most professional way to generate a privacy policy for your website, mobile app and facebook app

Generate your privacy policy now