4 ms·

GA4's IP Anonymization is good but not sufficient. Your IP Address is exposed to Google's servers, and is redacted after collection. Per GDPR, this still counts

by lmkg 5y ago

GA4's IP Anonymization is good but not sufficient. Your IP Address is exposed to Google's servers, and is redacted after collection. Per GDPR, this still counts as Google processing your IP Address. It is not clear what actually works when you incorporate Consent Mode. I haven't actually found any reports that include the data supposedly collected. I also have some doubts that Consent Mode does not actually require consent (see IP Address concerns above).

dbbk 5y ago
No, in the article they say alongside this announcement they're going beyond IP Anonymization and ceasing logging or storing IP addresses altogether. Of course, any network request is going to send an IP address... that's how the Internet works. If that alone is enough to make a service illegal then third-party analytics is going to be just flat out impossible for everyone.
- o_m 5y ago
  Fathom managed to do it. They created a separate European infrastructure and created an European company with European employees to manage it. The original Canadian company have no access to the data in Europe.
- lmkg 5y ago
  > any network request is going to send an IP address Yup, that's my point. > If that alone is enough to make a service illegal then third-party analytics is going to be just flat out impossible for everyone. Yup, that's my point. EU court rulings say it's illegal to transfer data to Google, because Google is subject to the CLOUD Act in the United States. IP Address is personal data, and is considered transferred just by having the user's client connect to Google's servers. Google's description of what they will or will not do with the IP Address is legally invalid, because the CLOUD Act can compel them to break their promises. This ruling, while unfortunate, is correct. Third-party analytics in general are not illegal. What's illegal is third-party analytics (or third-party anything) hosted by a US company subject to the CLOUD Act. Even then, it's possible to make it legal by running it through a self-hosted proxy which anonymizes the data before sending it over to Google. But a direct connection from the user-agent to Google servers is illegal.

by lmkg 5y ago

dbbk 5y ago

No, in the article they say alongside this announcement they're going beyond IP Anonymization and ceasing logging or storing IP addresses altogether. Of course, any network request is going to send an IP address... that's how the Internet works. If that alone is enough to make a service illegal then third-party analytics is going to be just flat out impossible for everyone.

o_m 5y ago
Fathom managed to do it. They created a separate European infrastructure and created an European company with European employees to manage it. The original Canadian company have no access to the data in Europe.
lmkg 5y ago
> any network request is going to send an IP address Yup, that's my point. > If that alone is enough to make a service illegal then third-party analytics is going to be just flat out impossible for everyone. Yup, that's my point. EU court rulings say it's illegal to transfer data to Google, because Google is subject to the CLOUD Act in the United States. IP Address is personal data, and is considered transferred just by having the user's client connect to Google's servers. Google's description of what they will or will not do with the IP Address is legally invalid, because the CLOUD Act can compel them to break their promises. This ruling, while unfortunate, is correct. Third-party analytics in general are not illegal. What's illegal is third-party analytics (or third-party anything) hosted by a US company subject to the CLOUD Act. Even then, it's possible to make it legal by running it through a self-hosted proxy which anonymizes the data before sending it over to Google. But a direct connection from the user-agent to Google servers is illegal.