On March 9th, we organized the second Yes We Trust webinar of the year (find the first one here), where we talked about Google Analytics 4 (GA4) and its impact on businesses.

To cover all angles, we gathered three speakers with a deep knowledge of the topic: Gabriel Luxembourger, Data & Analytics Director at Jellyfish, Adrien Hug-Korda, Group Data Protection Officer at Jellyfish, and Romain Gauthier, CEO at Didomi. the conversation was structured around 5 main questions:

• Is Google Analytics illegal in Europe?

• What are the main changes with Google Analytics 4?

• How to operate a successful migration to GA4?

• How to use Google Analytics 4 while ensuring compliance?

• How to leverage server-side tracking to future-proof your analytics performance?

In the end, participants in the webinar were able to ask questions directly to the speakers. Watch the recording below to get all your answers, or read the rest of the article for a quick summary of some of the most important highlights of the event.

Is Google Analytics 4 illegal in Europe?

The origins of this question date back to the complaints filed by Max Schrems' NOYB in 2020, revolving around EU-US transfers, which eventually led to a decision from the Austrian DPA in 2022, suggesting that the use of Google Analytics violates the GDPR and the French DPA (CNIL) publishing a decision on the topic.

For full context, head to this 2022 article, but long story short - Google eventually announced the release of Google Analytics 4, moving on from Universal Analytics for a more privacy-focused solution. 

Google Analytics 4 is not illegal in the EU. 

Because the Privacy Shield framework was invalidated, there is no valid EU-US data transfer framework - although the EU and the U.S. are working on one. In the meantime, every US-based solution is potentially impacted.

But there are ways to implement Google Analytics 4 in a GDPR-compliant way.

The main privacy changes in GA4

Google Analytics is introducing a variety of new features and controls allowing customers to govern how data is collected, stored, and used, adjustable at any time. The main categories for these controls are:

• Data collection (Granular location and device data)

• Data usage (Google Signals and ad personalization)

• Data storage (data retention)

• Data deletion (Deta deletion request and user deletion)

Each control can be turned on and off within the GA 4 admin interface at the property level. 

Additionally, other features shared by Google regarding GA4 reveal that GA4 doesn't log or store individual IP addresses, collects all data from EU-based devices through domains and on servers based in the EU before forwarding them to Analytics servers for processing, and introduces regional controls - the ability to enable/disable Google signals, granular location and device data on a per-region basis.

These privacy controls aim to mitigate risks using Google Analytics, with more or less impact based on the specific control and your specific use case.

What are the alternatives to Universal Analytics?

During the webinar, the audience was asked whether they were considering switching to another solution, away from Google Analytics: 

Our speakers identify three main alternatives to Universal Analytics, each with its pros and cons:

1) Choosing to focus on privacy

Opting for a privacy-first analytics approach, organizations could implement solutions such as Piwik Pri and TagCommander.

• Pros:

  • Risk on transfers reduced to a minimum

  • In some markets (France), exempt from consent

• Cons:

  • Loss of marketing capabilities, including analysis use-cases

  • Potentially time-consuming and costly migration, and fewer resources available on the market

2) Preferring a focus on marketing performance

Another option would be to focus on marketing performance, by switching to solutions like Adobe or Segment.

• Pros:

  • Similar features to Google Universal Analytics

• Cons:

  • US-based company: the DPA decisions against the use of GA also apply

  • Potentially time-consuming and costly migration

3) Migrating to Google Analytics 4

Finally, the last solution is to migrate to GA4.

• Pros:

  • Similar features to Google Universal Analytics

  • Additional privacy controls

  • Smoother transition, out of the 3 options

• Cons:

  • US-based company: implies a trade-off between marketing performance and compliance.

Interestingly, a poll with the audience revealed that over 80% of the participants were either already migrated, or actively preparing.

How to use Google Analytics 4 while ensuring compliance?

In the rest of the webinar, our speakers focus on how to implement Google Analytics in a compliant manner, specifically through 3 approaches:

• Using a proxy setup as recommended by the French DPA (CNIL), and considering the limitations involved with that method

• Exploring Google Analytics 4 configurations and data types

• Considering server-side tracking, its consequences, and benefits

For the full breakdown and detailed explanations, watch the recording here:

Will you make the switch to GA4?

Despite the eye-catching headlines, and as it's often the case in the data privacy industry, things are not as black and white as they seem with Google Analytics 4. Whether companies should make the switch or change analytics providers is an important decision that should be carefully thought-out, backed by their specific use case, industry, and reliance on analytics.

What about you? Are you planning to migrate to Google Analytics 4, or are you considering other alternatives for your analytics needs? To start a conversation, spark a debate, or receive guidance for fellow data privacy enthusiasts, head to the Yes We Trust community on LinkedIn: