{"id":2347,"date":"2024-06-15T15:15:34","date_gmt":"2024-06-15T13:15:34","guid":{"rendered":"https:\/\/wearekemb.com\/?p=2347"},"modified":"2025-03-03T18:18:44","modified_gmt":"2025-03-03T17:18:44","slug":"data-privacy-with-ga4","status":"publish","type":"post","link":"https:\/\/wearekemb.com\/en\/data-privacy-with-ga4\/","title":{"rendered":"Data privacy with GA4"},"content":{"rendered":"

[et_pb_section fb_built=”1″ custom_padding_last_edited=”on|tablet” _builder_version=”4.27.4″ _module_preset=”default” background_color=”#FFFFFF” custom_padding_tablet=”30px||30px||true|false” custom_padding_phone=”30px||30px||true|false” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″][et_pb_row _builder_version=”4.19.4″ _module_preset=”default” custom_padding=”||30px|||” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Google has announced that Universal analytics will become obsolete in summer of 2023. This decision was taken after multiple European privacy agencies had declared that UA is not GDPR compliant and thus \u201cillegal\u201d. Google has been pushing some changes into\u00a0the newer version of google analytics (GA4)<\/a><\/strong>\u00a0in order to solve this issue.<\/p>\n

In this article, we will look at the changes implemented in the newer version, and what additions Google has provided to make their product compliant.<\/p>\n

<\/em><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” text_font_size_phone=”12px” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

IP anonymization<\/strong><\/h2>\n

In Universal analytics, IP anonymization had to be manually set up. According to Google \u201cthe anonymization happens before the data is ever logged in any data center or server\u201d
Because data was being sent to servers in the US, this information needed to be anonymized in order to be compliant. With GDPR in full effect in Europe, stricter measures are being implemented. With GA4, IP anonymization happens automatically. The newer version of analytics does not log or store IP addresses. It merely uses the address at collection time to determine location information. And when that metadata shows that the data collected is coming from EU based devices, it will be stored in EU servers. When IP is anonymized, it is no longer considered a PII (personally identifiable information).<\/p>\n

\u00a0And this is how it works:<\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/wearekemb.com\/wp-content\/uploads\/2023\/01\/IP-ANONYMIZATION-1024×537-1.png” title_text=”IP-ANONYMIZATION-1024×537″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Basically what happens is that the last 3 digits of the visitor\u2019s IP address will be replaced by 0, thus rendering the IP (partially) anonymous, and then<\/strong>\u00a0<\/span>gets stored in Google analytics servers in the US.\u00a0<\/p>\n

Say you are surfing a website from the EU. Your IP address will indeed be forwarded to US servers, however the IP is not stored. It reaches GA servers, gets anonymized,\u00a0<\/span>then<\/strong>\u00a0<\/span>gets stored. You can see why this might be a problem. The visitor\u2019s actual IP is\u00a0<\/span>still<\/strong>\u00a0<\/span>sent to servers outside the EU but is\u00a0<\/span>not<\/strong>\u00a0<\/span>stored before the anonymization happens, or at least that is what Google claims. However,\u00a0<\/span>to ensure<\/strong>\u00a0<\/span>true\u00a0<\/span><\/strong>IP anonymization, you might want to go one step further and set up Google tag manager server side tagging. We will not dive into the technical details behind setting up the server side GTM container, but we will briefly explain what it is.<\/p>\n

<\/figure>\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n

[\/et_pb_text][et_pb_image src=”https:\/\/wearekemb.com\/wp-content\/uploads\/2023\/01\/true-anonymization-1024×526-1.png” title_text=”true-anonymization–1024×526″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Instead of sending your website (client side) data directly to GA servers, you initially send this data to a GTM container in a server\u00a0<\/span>that you host<\/strong>\u00a0(for GDPR reasons, the server should be located in the EU). Then, the visitor\u2019s\u00a0IP address (their real one) will be sent to the server side container, and the IP anonymization will happen\u00a0<\/span>there.\u00a0<\/span><\/strong>So the GA servers in the US will not receive the\u00a0<\/span>real IP<\/strong>\u00a0<\/span>address<\/strong>, but the anonymized one.<\/span><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Google Consent Mode<\/strong><\/h2>\n

As mentioned, GDPR is in full effect now which means the amount of data being gathered by marketers and firms will drop significantly since\u00a0<\/span>nothing<\/strong>\u00a0<\/span>should be tracked in case a visitor does not give permission or accept cookies. However, upon setting up consent mode, you will have the ability to recover part of that missing data as fully\u00a0<\/span>anonymized\u00a0<\/span><\/strong>data to GA4, Google Ads and BigQuery. Worth to note that this data is not sent through cookies, and in fact\u00a0<\/span>no cookies<\/strong>\u00a0<\/span>are used to send data to servers. The data will be in form of \u201csmall message beacons\u201d containing very basic information and some events (pageview, click events in case they happen, without any PII)\u00a0 This seems to be like a \u201cgrey area\u201d in terms of GDPR compliance. Technically GDPR does\u00a0<\/span>not<\/strong>\u00a0<\/span>apply to fully anonymized data. However, it can be argued that even if you are sending anonymous data to Google Analytics servers they can be \u201carranged together\u201d to try to identify the individual. This anonymized data will help Google\u2019s machine learning algorithm with conversion modelling (The algorithm will then \u201cbetter\u201d attribute conversions to Google Ads for example). So how does it work?<\/p>\n

By default, there are tags with\u00a0<\/span>built in<\/strong>\u00a0<\/span>consent checks (GA4 configuration tags, and GA4 event tags for example are included). These tags will change their behaviour, depending on the user\u2019s consent choice. As we can see from the picture below, we have two consent checks.\u00a0<\/span>Ad_storage\u00a0<\/span><\/strong>\u00a0and\u00a0<\/span>analytics_storage<\/strong>\u00a0<\/span>which in plain English mean marketing and statistics cookies respectively. So tags with these built-in checks will wait for the user\u2019s consent. And depending on that, the corresponding tags either fire or not.<\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/wearekemb.com\/wp-content\/uploads\/2023\/01\/consent-settings.png” title_text=”consent-settings” _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

We won\u2019t be explaining the\u00a0<\/span>technical<\/strong>\u00a0<\/span>setup<\/strong>\u00a0<\/span>of the consent mode in this article, however we wanted to explain this topic as clearly as possible. So in order for Google Tag manager to understand and read the consent choice of the user, you need to have a CMP already configured on your website.<\/p>\n

[\/et_pb_text][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

CMP<\/strong><\/h3>\n

CMP stands for consent management platform. If you are in the EU and navigate to a website for the first time, you will immediately see a \u201ccookie consent banner\u201d where you choose whether you give permission for the website to track all cookies, some cookies, or none. This banner is configured through a CMP. When you came to our website the first time, you were greeted with this cookie banner.<\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/wearekemb.com\/wp-content\/uploads\/2023\/01\/cookie-banner-1024×145-1.png” title_text=”cookie-banner-1024×145″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][et_pb_text _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Many CMPs have built integrations with consent mode into their product. GTM\u00a0<\/span>needs<\/strong>\u00a0<\/span>to receive the consent choice of the visitor in order to regulate the behavior of the tags that are set up.Consent mode has two states.\u00a0<\/span>The default state is<\/strong>\u00a0<\/span>the state\u00a0<\/span>before<\/strong>\u00a0<\/span>you select your choice. And the\u00a0<\/span>updated state<\/strong>\u00a0<\/span>that follows after you update your selection. In plain English, you are telling Google Tag manager to\u00a0<\/span>wait<\/strong>\u00a0<\/span>for the user\u2019s consent before firing any tags and tracking the user\u2019s behavior on the website. After the user selects their choice, this\u00a0<\/span>updated<\/strong>\u00a0<\/span>choice is forwarded then to GTM.<\/p>\n

<\/figure>\n

[\/et_pb_text][et_pb_image src=”https:\/\/wearekemb.com\/wp-content\/uploads\/2023\/01\/google-consent-mode-1024×574-1.png” title_text=”google-consent-mode-1024×574″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.19.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.20.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Additional privacy controls in GA4\u00a0<\/strong><\/h2>\n