Privacy Policy for Google Analytics

If your website or mobile app uses Google Analytics, you definitely need to have a Privacy Policy.

Google Analytics stores cookies on your users' PCs to keep track of usage data. This is enough to evoke the requirement of a Privacy Policy according to the EU Cookies Directive.

The EU's GDPR also requires a Privacy Policy when usage data is collected, such as through cookies.

When you use Google Analytics, you can opt-in to getting access to analytics and usage data plus advertising features that allow you to create better marketing campaigns.

The use of these features that include retargeting triggers the requirement to update your Privacy Policy to inform users about your usage of retargeting identifiers through Google's network.

Privacy Policy for the standard features of Google Analytics

In the Google Analytics Terms of Service agreement there's a requirement that users of Google Analytics must have a Privacy Policy agreement in place.

The Privacy Policy must disclose that analytics is used, disclose how data is collected and processed, and provide notice of the use of cookies.

Here's the clause in the Terms of Service agreement that sets forth these requirements and provides suggestions for meeting them:

Your Privacy Policy should be easily accessible to visitors directly from your website or mobile app, such as in a footer link or mobile app "About" menu.

This makes it easy for users to locate and view your agreement whenever they want to.

Here's an example of how Upwork (former oDesk) includes a link to its Privacy Policy and other legal agreements in its website footer:

Because so many businesses place their legal agreement links in their website footer, people know to check there.

You can also include a pop-up or banner message, such as the one in the image below, that tells your users that cookies are in use. Include a link to your Privacy Policy (and Cookie Policy) in this pop-up or banner message to make sure relevant information is easily accessible.

Include information about your use of Analytics cookies in your Privacy or Cookie Policy and make it clear that you're using Google Analytics to gain insights and improve the functionality of your website, or for marketing purposes.

Here's how Indeed.com does this in a clause in its Cookie Policy:

Give users the ability to opt out of having cookies placed for the purposes of Google Analytics and let them know that they have this right.

There's an opt-out browser add-on from Google that helps make opting out incredibly easy and convenient for users. You can mention and link to this add-on in your Privacy Policy:

Analytics Remarketing

If you use the Google Analytics Remarketing Lists feature, you're required to agree to the Google Analytics Terms of Service. These Terms require you to have an informative Privacy Policy that discloses that Google Analytics Remarketing uses cookies to track users who visit your website or use your mobile app and display your ads to these users when they are on other websites.

While the exact language you should include isn't provided by Google, you should focus on being clear, concise, and informative.

Here's a checklist of what to include in your agreement:

• Let users know that you use remarketing and that this will advertise your company or website across other websites that users visit.
• Let users know that Google and other third-party vendors will show your ads on websites that users visit after visiting your website.
• Let users know that your ads will be shown on other websites because the user visited your website in the past.
• Let users know how they can opt out of this remarketing campaign through the Google Ad Settings page.

Here's a clause from AdRoll's Privacy Policy that's a great example of how to let users know all of this information:

The very next clause in the Privacy Policy addresses how users can opt out of or adjust targeted ads and the use of personal data:

AdRoll provides an Adjust Ad Preferences feature where a user can adjust advertising preferences quickly and easily. It's linked in the website footer along with other legal agreements:

Users who click on the link are taken to a screen where they are given the ability to adjust individual ad remarketing settings. Consent can be revoked or granted for all advertising and analytics cookies with one click, or individually adjusted:

If you use AdRoll, AdWords, or a different remarketing tool, you can add a link on your website to a page or module like this. Having something like this one is a great way to allow your users to choose which cookies they wish to allow and opt out of behavioral ads if they want to.

The following example from Storkie makes it clear that the website is using Google's cookies and lets users know how they can opt out of this:

Privacy Policy for the advertising features of Google Analytics

Google Analytics Advertising tools lets you take the usage data and information you obtain from Google Analytics and use it for advertising purposes. Remarketing, also known as retargeting, is a widely used and incredibly popular function of Google Analytics.

If you choose to enable remarketing or any of the Google Analytics Advertising features, Google requires that you notify your visitors by disclosing the following 3 main points in your Privacy Policy, as stated in the Policy Requirements from Google:

1. Which Google Analytics Advertising Features have you implemented?

In your Privacy Policy, include a list of all features and links to more information about each of the features you have implemented for your website so that users can be aware of them.

For example, if you use Google AdWords for remarketing purposes, declare this and consider including links to both Google's Remarketing website, as well as the general Google Privacy Policy as it applies to AdWords usage.

2. Disclose that you and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together.

Do this through a Cookies Policy or at least a cookies clause in your Privacy Policy.

You need to let users know that you use third-parties for advertising and how these third-parties may use cookies.

If your business is based in the EU or you sell to EU customers, there are additional requirements you must meet in order to satisfy the EU Cookies Directive because all remarketing service are based on cookies usage.

Visitors to your website or mobile app must give informed, specific, and voluntary consent to have cookies placed on their devices before any cookies are placed.

The most common way that this requirement is satisfied is through the use of pop-up banners that appear prominently on a web page the first time a user visits a website. The banner informs a user about the use of cookies and requires some sort of active action from the user to give consent.

In this example from BBC, a user must click the "Continue" button before cookies can be used. The notification box clearly states that by clicking the "Continue" button, the user is consenting to BBC's use of cookies.

How to Add Your Cookie Consent Solution

3. How visitors can opt-out of the Google Analytics Advertising Features you use, including through Ads Settings, Ad Settings for mobile apps, or any other available means (for example, the NAI's consumer opt-out).

Google has its own available opt-out tool for Google Analytics that they encourage you to linking to, as noted earlier in this article.

Linking to it is a great way to satisfy the requirement that users must be informed on how to opt-out.

If you're developing a mobile app and not a website, your Privacy Policy should be accessible from within the app.

Dropbox accomplishes this by putting a "Legal and Privacy" section in its "Settings" tab that links to its Privacy Policy.

Here's an example from The Sierra Trading Post's Privacy Policy that discloses its use of the Google Analytics features:

The section titled "Interest-Based Online Advertising and Google Analytics" includes the required information to comply with Google's requirements:

1. What Google Analytics Advertising Feature is implemented
2. How both this website and third-party vendors use first-party cookies, first-party identifiers, third-party cookies, and other third-party identifiers together
3. How users can opt out of the cookies information being collected and used

It says:

"we use Google Analytics' 3rd-party audience data such as age, gender, and interests to better understand the behavior of our customers and work with companies that collect information about your online activities to provide advertising targeted to suit your interests and preferences... These companies also use automated technologies to collect information when you click on our ads, which helps track and manage the effectiveness of our marketing efforts."

This makes it clear what information is being collected by Google Analytics, who is using it, and how it is being used.

The last paragraph of this section satisfies the requirement about informing users on how they can opt-out:

"you may opt out of the automated collection of information by third-party ad networks for the purpose of delivering advertisements tailored to your interests, by visiting the consumer opt-out page for the Self-Regulatory Principles for Online Behavioral Advertising at http://www.aboutads.info/choices/ and edit or opt-out your Google Display Netowrk ads' preferences at http://www.google.com/ads/preferences/."

If you enabled the Advertising Features in your Google Analytics account, update your Privacy Policy by adding a new clause titled "Interest-Based Online Advertising and Google Analytics" and make sure it includes the required information about your usage of these features.