Google Analytics 4, the fresh successor to Universal Analytics, is Google's dynamic tool in the realm of digital marketing and eCommerce. This new version is designed with a more privacy-friendly approach, marking a shift in data collection strategies. However, as California privacy regulations tighten, a question arises: Does Google Analytics 4 comply with the California Consumer Privacy Act (CCPA)?
The short answer is yes - Google Analytics 4 is indeed CCPA compliant. However, deploying it imposes certain CCPA obligations on your business.
In this article, we'll explore:
- Google Analytics 4's CCPA compliance
- What businesses need to do with Google Analytics data to remain compliant with the CCPA
- The implications of non-compliance with the CCPA
- How to handle CCPA compliance requirements related to GA4
Is Google Analytics 4 CCPA Compliant?
Google Analytics 4 is CCPA compliant, but it doesn’t make your website CCPA compliant by default.
Google Analytics 4 uses cookies for the collection and processing of personally identifiable information (PII). In its data processing agreement, Google clearly states that they process “Online identifiers, including cookie identifiers, IP addresses, and device identifiers; client identifiers”.
The Google Analytics cookies collect data about users’ browsing behavior on any given website across devices. Its first-party cookies create a client ID that can inform the business about the demographics, traffic sources, time spent on a specific page, and so on. The insights it provides help website owners measure how consumers use their websites and optimize the user experience based on these metrics.
It is rather simple to use. All the business operator needs to do is create a GA4 property, install a javascript tracking code on the website, and collect valuable data. This data can be used in combination with other Google products and advertising features, such as remarketing and Google ad personalization.
This information falls under the scope of the CCPA.
The CCPA operates on an opt-out principle, meaning it does not require businesses to obtain cookie consent for the use of Google Analytics. This means you are free to process website user data via Google Analytics 4. You can also use it in combination with Google Tag Manager (GTM).
However, it may create other CCPA obligations for your business, provided the CCPA applies to your business.
The California Consumer Privacy Act applies solely to profit-seeking businesses that process consumer personal data, provided they conduct their operations in California and satisfy at least one of the following requirements:
- Generate an annual gross revenue exceeding $25 million
- Handle the personal data of at least 50,000 Californians per year
- Derive at least 50% of yearly income from the sale of consumers' personal data
If your business does not meet these criteria, you are exempt from the CCPA. This means that you don’t have any CCPA obligations and can use GA4 as you please.
However, if your business fulfills these requirements, keep reading.
How to Use Google Analytics in Compliance with CCPA
You can use Google Analytics 4 in California, or anywhere in the United States, without asking for user consent.
Unlike in the European Union, where the General Data Protection Regulation (GDPR) requires websites to collect consent for using GA via cookie banners, the data privacy laws in the US have no such requirement.
However, once you collect consumer data, the CCPA requires you to meet certain demands. In the case of using GA4, these include:
- Allowing consumers to opt out of the sharing or sale of personal information
- Determining a data retention period, and
- Honoring consumer requests
Opting Out of Sharing Personal Information with Google
Assuming that you do not sell personal data, here’s what you need to do to enable your consumers to opt out of the sharing of personal information:
- Provide consumers with a notice to opt out and a mechanism to opt out of the sharing of personal information. GA data is used in combination with other Google products, which means that you share users’ data with them, and they have the right to opt out of that. You need to inform users about the data sharing in the privacy notice you serve to them when they arrive on the website. You also need to provide them with a “Do Not Share My Personal Information” link, ideally in the website footer.
If you sell personal data collected through Google Analytics 4, you also need to allow users to opt out of the sale of personal data.
A consent management platform, such as Secure Privacy, can provide you with a CCPA-compliant privacy notice and an opt-out mechanism to help you comply effortlessly. - Honor Global Privacy Control (GPC) signals. You have to set up your website to not send GA cookies, or any other cookies, if the user’s browser sends you an opt-out signal through the GPC. Not complying with GPC is a violation of the CCPA and can lead to penalties
.
Determine a Data Retention Period
You cannot keep GA4 data indefinitely. You have to delete it when you no longer need the historical data.
The CCPA requires you to determine for how long you’ll keep the data upon collection. You can set this up in your admin panel. Then, you have to include the information about it in your privacy policy.
Honor Consumer Requests
Your website visitors have CCPA rights related to the data collected by GA cookies. They have the right to know about data processing, to access the data, and to request data deletion.
Google Analytics 4 admin panel features make it easy to respond to a consumer request.
What You Don’t Need to Do
The information about GA4 data on the internet can be somewhat confusing for US businesses. Much of the confusion has been created around the GDPR requirements for GA.
Due to the fact that GA data transfers to the US are not GDPR-compliant, most of the information is related to complying with EU law.
However, US businesses do not need to ask for an opt-in, nor to care about data transfers anywhere in the world. As a result, you don’t have to concern yourself with:
- Obtaining user consent. You need to allow opt-out only. You don’t need anyone to opt in.
- Consent mode. This is only relevant to businesses that must obtain consent for the use of GA cookies. US businesses do not need it.
- IP anonymization. This would have been useful if you needed consent to process Google Analytics data. The IP address helps GA create a user ID and attribute certain browsing behavior to them. IP anonymization can be useful for you only if you don’t want to handle consumer requests related to IPs.
