Are you looking to learn about Data Retention in Google Analytics in relation to EU GDPR compliance?
Follow this guide to learn about the adjustments needed regarding company data retention policies.
ExactMetrics is built to make compliance as easy as possible for our users.
Learn how to get started with our EU Compliance addon.
Make sure to read our important legal disclaimer at the bottom of this guide.
About Data Retention in Google Analytics
Are you seeing this message while on Google Analytics?
“We’ve recently launched new Data Retention controls that may affect your data starting May 25, 2018. To dismiss this message, please visit your property’s Data Retention settings under Admin > Property > Tracking Info and click ‘Save’. Learn more
Why Has Google Implemented the Data Retention Policy
Overtime, user-level data and event-level data are presumed to be less relevant to your business. As a result, holding on to that data for an indefinite period is considered a liability for businesses affected by EU GDPR.
Thus, one of the core concepts of GDPR is Data Minimization.
Data Minimization
The principle of “data minimization” means that a data controller should limit the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose. They should also retain the data only for as long as is necessary to fulfill that purpose. In other words, data controllers should collect only the personal data they really need, and should keep it only for as long as they need it.
The data minimization principle derives from Article 6.1(b) and (c) of Directive 95/46/EC and Article 4.1(b) and (c) of Regulation EC (No) 45/2001, which provide that personal data must be “collected for specified, explicit and legitimate purposes” and must be “adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed.
What is user-level and event-level data?
The retention period applies to the following:
- Cookies at the User-level and event-level.
- User-ID, data in the “user explorer” or other User-identifiers.
- Advertising identifiers such as DoubleClick cookies, Android’s Advertising ID, Apple’s Identifier for Advertisers.
Note
These settings will not affect standard reports (as described above, i.e. standard reporting tables will be available and unaffected, but querying data with segments or secondary dimensions would not be available outside of the selected retention period).
When will the Google Analytics Data Retention controls take effect?
May 25, 2018.
What Happens When Data Reaches the End of the Retention Period?
At the end of the retention period, data is deleted automatically every month.
If you adjust the retention period, data will be affected when the next monthly process occurs. For example, if it’s changed from 50 months to 28 months, any data older than 28 months is deleted during the next monthly process.
Retention period changes take effect after 24 hours. During this 24 hour period, you can revert your change, leaving your data unaffected.
Reset on new activity
When users return to your site, the retention period can be reset to the current time plus retention period. For example, you have a retention period of 14 months, but a user returns to your site every week. That user’s identifier is refreshed every week and never deleted.
If another user doesn’t return to your site before the retention period expires, the user’s data is deleted.
Data retention reset can be enabled by turning on the option “Reset on new activity”. But if you don’t want the retention period to reset for users that visit, leave it off. User data will then be deleted automatically during the monthly deletion process.
Our Recommendations
User-data retention:
We usually recommend choosing “Do not automatically expire”, unless regulations or laws require you to change this.
Reset on new activity:
We usually recommend leaving the option on, unless regulations or laws require you to change this.
How to Change the Google Analytics Data Retention Settings
Please see our guide: EU GDPR Data Expiration Settings.
Sources and Further Reading:
Legal Disclaimer: This addon is designed to automate some of the settings change required to be in compliance with various EU laws however due to the dynamic nature of websites, no plugin can offer 100% legal compliance. Please consult a specialist internet law attorney to determine if you are in compliance with all applicable laws for your jurisdictions and your use cases.
As a website operator, it is solely your responsibility to ensure that you are in compliance with all applicable laws and regulations governing your use of our plugin.
ExactMetrics, its employees/contractors, and other affiliated parties are not lawyers. Any advice given in our support, documentation, website, other mediums or through our services/products should not be considered legal advice and is for informational and/or educational purposes only and are not guaranteed to be correct, complete or up-to-date, and do not constitute creating/entering an Attorney-Client relationship.