4 ms·

I have high confidence that Google does not dip into Analytics data for its own uses without permission. I am an analytics consultant by profession, so this opi

by lmkg 6y ago

I have high confidence that Google does not dip into Analytics data for its own uses without permission. I am an analytics consultant by profession, so this opinion is colored by the old adage about not understanding something that prevents your paycheck. But it is also colored by a decade of experience with the technical and organizational capabilities and limitations of the tool. Let me lay out my reasoning. 1. Legal and contractual liability. For the Analytics service, Google is a Processor under GDPR and a Service Provider under CCPA. This means that legally, the only thing they are allowed to do with the data is provide the service requested by their customers. Many enterprise-level customers require this as a condition of using Google Analytics. If they were to breach this confidence, it would probably result in them losing the enterprise space as a whole. 2. Google Analytics data is first-party data. There are no means for Google to stitch together panopticon view of a user from the GA data from different companies. The user identifier is a first-party cookie, which is not shared between sites. There are no side-channels. Believe me, I literally spend at least five hours every week staring at hits in the Network tab, and I know where every piece of data comes from and how it gets processed. Cookies are not shared between sites except manually, and then only between sites operated by the same company. 3. Low signal-to-noise ratio. The median Google Analytics implementation is a dumpster fire. When I engage with a new website, it's actually more common than not that they have double-tracking (or triple or more) on at least some pages, which completely kills the accuracy of bounce rate and time-on-page metrics. Even "good" implementations have a huge amount of variability between the data. 4. They can probably get the data elsewhere. Google acts as a Controller for several of its other products (notably, Google Ads aka AdWords), meaning that it explicitly acknowledges it does use the data for its own purposes. And Chrome syncs your browsing history to your Google account. While Google Analytics would get them extra coverage, the cost-benefit doesn't seem worthwhile to me, especially consider the GDPR angle. 5. That's not why it's free There's a common theme in posts like these about "why do you think Google gives GA away for free?" implying that they do it for the data. Website analytics is a strategic compliment to website advertising. If people can see how much money they make from ads (and moreso, optimize how much money they make from ads), then they will buy more ads. Google makes money from Analytics as a strategic compliment. They do not need to acquire your data for it to be profitable. Nowadays it's also an integration point with other services in the marketing cloud. See "caveats" below. CAVEATS Everything above is about the "default" Google Analytics installation, how it works out of the box. Google Analytics allows you to share data with Google in a variety of way, and actively encourages you to do so for several of those. I'll enumerate the specific points where a particular configuration of Google Analytics has significant privacy impacts. 1. Advertising Features. This establishes a "cookie match" between the first-party GA cookie and the third-party DoubleClick cookie. Meaning it connects your GA data to Google's own data. 2. Google Ads integrations This establishes several data connections to the Google Ads dataset, in both directions. Google explicitly acknowledges they act as a Controller for this integration, i.e. it's their data know and they can use it. 3. Google Signals Hoooooo boy. This is the setting that explicitly connects data to a user's Google Account. If a user is logged in to Google in Chrome (meaning logged in to the browser), then Google Analytics can use their account as the identity signal instead of a cookie. So the data from this one actually could be aggregated across different GA properties. The Google Account can also be used as the basis for targeting advertising. Concluding Thoughts Using Google Analytics "feeds the beast" insofar as it continues to cement Google's hegemony on the Internet. If you want to ditch GA for that reason, I completely sympathize. But saying it "feeds the beast" in that Google actually acquires that data and uses it, borders on a conspiracy theory. There are plenty of good and valid reasons to ditch GA based on principles, and on statements that can be backed up on evidence. There's no need to overreach. GA is overkill for most small websites. Its main value is to integrate with Google advertising products (to re-iterate: the buttons that do that are off by default but very easy to press). I don't think that logfile parsing is as accessible as many people seem to believe, but there's now a strong landscape of privacy-conscious analytics tools that didn't exist five years ago, which will provide at least the simple metrics that personal websites actually need. The web would probably be better if Google Analytics stopped being the "default." But that's more about the monoculture of available tools, rather than extending Google's ubiquitous surveillance apparatus.

caspii 6y ago
Well, it's all speculation in the end, because Google is silent about it. BUT: the costs of running and maintaining Google Analytics must be significant. There must be some strategic reason for Google to continue to do so (look at the way they deal with products that are not working for them, remember Google Reader?). So what is that strategic reason?
- lmkg 6y ago
  I address that in point 5. Analytics is a strategic compliment to advertising. When people can measure the revenue resulting from online ads, they buy more online ads. And at the margin, when people can optimize the return on online channels to make them more efficient, they spend even more on online ads.
Guidii 6y ago
Thanks for posting a thoughtful reply. It's great to see reasoned discussion on this site. Like most tech issues, there's a lot of nuance in this, and it's helpful to be able to hear the benefits on all sides of an issue. Disclaimer: I'm a googler, but not in the analytics space. I don't have the background to meaningfully contribute to this, and will bow to lkmg's expertise. I also really like my job;)
Nextgrid 6y ago
> Legal and contractual liability I disagree. The GDPR consent prompt Google has implemented on their websites is not compliant with the regulation, and Google have a history of dark patterns elsewhere when it comes to privacy that may also run afoul of the regulation. Contractual obligations was supposed to prevent Facebook from breaking their promise of not using 2FA phone numbers for advertising purposes, and we all know how that ended up. Ad targeting involves so many factors that Google can very well use the analytics data for it and still maintain plausible deniability as it would be impossible to prove this from the outside, so the risk is limited compared to the potential rewards. > There are no means for Google to stitch together panopticon view of a user from the GA data from different companies Having a view over the entire web would allow you to track user sessions across websites with just IP addresses, browser fingerprinting and heuristics. Cookies are not necessary for this. > Low signal-to-noise ratio. I don't think Google dips into individual analytics events; that would indeed be vulnerable to noise plus would require understanding how every site uses analytics and what events represent what. I think they just get a general metric such as "user X is interested in the general category of your website" or "user X is active during these times of day" or "user X is often connecting from this IP, from which user Y is also frequently seen, thus they probably live nearby or together". > They can probably get the data elsewhere. They do, which makes this so much worse because it gives them plausible deniability. There's no way to prove with any certainty that they are/aren't doing this because the data could come from multiple different sources instead, but there's also no reason to believe GA is not one of these sources (even if it's only used to merely confirm the accuracy of other sources' data). > That's not why it's free If analytics was a loss leader for their advertising product, they could very well include it as part of advertising - setting up an ad account (and maybe depositing some $$$) gives you access to analytics. At this point they also have a lot of "freeloaders" who don't use/need advertising and use GA which it would make sense to kick out now that it's clear they will never convert to an advertising customer. They don't do neither of these things, and are happy to crunch gigantic amounts of data for absolutely zero revenue. This doesn't make sense unless they gain something from it internally, and their business model incentivizes them to do so.

by lmkg 6y ago

caspii 6y ago

Well, it's all speculation in the end, because Google is silent about it. BUT: the costs of running and maintaining Google Analytics must be significant. There must be some strategic reason for Google to continue to do so (look at the way they deal with products that are not working for them, remember Google Reader?). So what is that strategic reason?

lmkg 6y ago
I address that in point 5. Analytics is a strategic compliment to advertising. When people can measure the revenue resulting from online ads, they buy more online ads. And at the margin, when people can optimize the return on online channels to make them more efficient, they spend even more on online ads.

Guidii 6y ago

Thanks for posting a thoughtful reply. It's great to see reasoned discussion on this site. Like most tech issues, there's a lot of nuance in this, and it's helpful to be able to hear the benefits on all sides of an issue. Disclaimer: I'm a googler, but not in the analytics space. I don't have the background to meaningfully contribute to this, and will bow to lkmg's expertise. I also really like my job;)

Nextgrid 6y ago

> Legal and contractual liability I disagree. The GDPR consent prompt Google has implemented on their websites is not compliant with the regulation, and Google have a history of dark patterns elsewhere when it comes to privacy that may also run afoul of the regulation. Contractual obligations was supposed to prevent Facebook from breaking their promise of not using 2FA phone numbers for advertising purposes, and we all know how that ended up. Ad targeting involves so many factors that Google can very well use the analytics data for it and still maintain plausible deniability as it would be impossible to prove this from the outside, so the risk is limited compared to the potential rewards. > There are no means for Google to stitch together panopticon view of a user from the GA data from different companies Having a view over the entire web would allow you to track user sessions across websites with just IP addresses, browser fingerprinting and heuristics. Cookies are not necessary for this. > Low signal-to-noise ratio. I don't think Google dips into individual analytics events; that would indeed be vulnerable to noise plus would require understanding how every site uses analytics and what events represent what. I think they just get a general metric such as "user X is interested in the general category of your website" or "user X is active during these times of day" or "user X is often connecting from this IP, from which user Y is also frequently seen, thus they probably live nearby or together". > They can probably get the data elsewhere. They do, which makes this so much worse because it gives them plausible deniability. There's no way to prove with any certainty that they are/aren't doing this because the data could come from multiple different sources instead, but there's also no reason to believe GA is not one of these sources (even if it's only used to merely confirm the accuracy of other sources' data). > That's not why it's free If analytics was a loss leader for their advertising product, they could very well include it as part of advertising - setting up an ad account (and maybe depositing some $$$) gives you access to analytics. At this point they also have a lot of "freeloaders" who don't use/need advertising and use GA which it would make sense to kick out now that it's clear they will never convert to an advertising customer. They don't do neither of these things, and are happy to crunch gigantic amounts of data for absolutely zero revenue. This doesn't make sense unless they gain something from it internally, and their business model incentivizes them to do so.