4 ms·

What personal data does GA collect?

Nextgrid 4y ago
IP addresses for starters, which are considered personal data under the GDPR. Keep in mind that the mere transfer of the IP address (which is inherent in a TCP connection and cannot be avoided in the default setup without proxying it yourself) is enough, regardless of whether Google will actually store said IP or anonymize it (not that you should trust them in any case).
- judge2020 4y ago
  > IP addresses for starters, https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
  - Nextgrid 4y ago
    Have you read the second paragraph of my reply?
- fooster 4y ago
  IP addresses by themselves are not personal data.
  - manuelmoreale 4y ago
    They are according to the GDPR and that’s all that matters when it comes to the issue discussed here.
  - martin_a 4y ago
    They can be used to track and identify users, so they are personal data. My IP address hasn't changed in some time, so if someone was to connect various sources of information, he would be able to identify me personally
    - pelorat 4y ago
      How so? Your almost fixed IP address does not leak your real identity, at most it leaks your ISP.
      - morelisp 4y ago
        You're making the argument that it's not PII, which has no bearing on if it's personal data.
      - martin_a 4y ago
        > How so? Connect my login into my personal Google account with the same IP address over and over to all the script calls on other Google services. It's pretty easy to connect the dots once you have a far enough reach.
    - origin_path 4y ago
      They can be used to track and identify users by the police. Not by third parties, because ISPs won't give out identifying information to those. That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying. Otherwise there's a lot of obvious problems e.g. if you were in the habit of wearing unusually distinctive clothing, or had an interesting bumper sticker on your car, etc, then all those things would become "personally identifying" even if nobody who saw them had any idea who you are. There are also deep moral limits to how blind you can insist other people become.
      - morelisp 4y ago
        > Not by third parties, because ISPs won't give out identifying information to those. lol
      - zelphirkalt 4y ago
        > That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying. I think the rules are usually though, that when those correlating things are put together, into one system, then the combination of those things are in sum personally identifying. That can actually happen very quickly and in non-obvious ways. You might add something inconspicuous and suddenly that makes users unique and allows to map in any theoretical way to real identities. I think one also has to consider publicly available information sources. Just to make a silly example: If there was some public register of favorite foods of people, and you asked your users about favorite foods, which you store in your database. Ooops, it is personally identifying, because anyone with that data in hand could map it to identities using publicly available data. However, I am not so sure, that the publicly available data is considered for judging whether something is personally identifying information.

IP addresses for starters, which are considered personal data under the GDPR. Keep in mind that the mere transfer of the IP address (which is inherent in a TCP connection and cannot be avoided in the default setup without proxying it yourself) is enough, regardless of whether Google will actually store said IP or anonymize it (not that you should trust them in any case).

judge2020 4y ago
> IP addresses for starters, https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
- Nextgrid 4y ago
  Have you read the second paragraph of my reply?
fooster 4y ago
IP addresses by themselves are not personal data.
- manuelmoreale 4y ago
  They are according to the GDPR and that’s all that matters when it comes to the issue discussed here.
- martin_a 4y ago
  They can be used to track and identify users, so they are personal data. My IP address hasn't changed in some time, so if someone was to connect various sources of information, he would be able to identify me personally
  - pelorat 4y ago
    How so? Your almost fixed IP address does not leak your real identity, at most it leaks your ISP.
    - morelisp 4y ago
      You're making the argument that it's not PII, which has no bearing on if it's personal data.
    - martin_a 4y ago
      > How so? Connect my login into my personal Google account with the same IP address over and over to all the script calls on other Google services. It's pretty easy to connect the dots once you have a far enough reach.
  - origin_path 4y ago
    They can be used to track and identify users by the police. Not by third parties, because ISPs won't give out identifying information to those. That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying. Otherwise there's a lot of obvious problems e.g. if you were in the habit of wearing unusually distinctive clothing, or had an interesting bumper sticker on your car, etc, then all those things would become "personally identifying" even if nobody who saw them had any idea who you are. There are also deep moral limits to how blind you can insist other people become.
    - morelisp 4y ago
      > Not by third parties, because ISPs won't give out identifying information to those. lol
    - zelphirkalt 4y ago
      > That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying. I think the rules are usually though, that when those correlating things are put together, into one system, then the combination of those things are in sum personally identifying. That can actually happen very quickly and in non-obvious ways. You might add something inconspicuous and suddenly that makes users unique and allows to map in any theoretical way to real identities. I think one also has to consider publicly available information sources. Just to make a silly example: If there was some public register of favorite foods of people, and you asked your users about favorite foods, which you store in your database. Ooops, it is personally identifying, because anyone with that data in hand could map it to identities using publicly available data. However, I am not so sure, that the publicly available data is considered for judging whether something is personally identifying information.