30 Days Until GDPR – Are You Prepared?

Susan Esparza  /  
April 13, 2018
Main Image

It is 30 business days until GDPR goes into effect on May 25. As we have pointed out before, it is dangerous to assume that your business will not be affected, and so we urged you to take steps to comply.

Today, we want to update you on steps that Google has been taking in preparation. As before, you can use their actions to benchmark your own.

As much as possible, we have quoted Google directly.

Google product updates:

  • Now Available: “granular data retention controls that allow you to manage how long your user and event data is held on our servers. Starting May 25, 2018, user and event data will be retained according to these settings; Google Analytics will automatically delete user and event data that is older than the retention period you select. Note that these settings will not affect reports based on aggregated data.”
  • What you should do in your GA account:  Review and modify as needed.
  • Upcoming: User deletion tool – “manage the deletion of all data associated with an individual user (e.g. site visitor) from your Google Analytics and/or Analytics 360 properties. This new automated tool will work based on any of the common identifiers sent to Analytics Client ID (i.e. standard Google Analytics first party cookie), User ID (if enabled), or App Instance ID (if using Google Analytics for Firebase).”
  • What you should do: Follow the Google Developers site for updates. Make sure that you can delete user data in your own systems as well.

Contract changes:

Google has updated contractual terms for many products, reflecting Google’s status as either data processor or data controller under the new law (see full classification of Ads products). The new GDPR terms will supplement your current contract with Google and will come into force on May 25, 2018.

NOTE: In both Google Analytics and Analytics 360, Google operates as a processor of personal data that is handled in the service.

What that means:

  • For Google Analytics clients based outside the EEA and all Analytics 360 customers, updated data processing terms are available for your review/acceptance in your accounts (Admin ➝ Account Settings).
  • For Google Analytics clients based in the EEA, updated data processing terms have already been included in your terms.
  • If you don’t contract with Google for measurement products, you should seek advice from the parties with whom you contract.

Updated EU User Consent Policy

Google’s EU User Consent Policy is being updated to reflect new legal requirements of the GDPR. It sets out your responsibilities for making disclosures to, and obtaining consent from, end users of your sites and apps in the EEA.

Action: Consult your legal department or advisors, whether your business will be in scope of the GDPR when using Google Analytics and Analytics 360. Review/accept the updated data processing terms as well as define your path for compliance with the EU User Consent Policy.


Get our reference guide on how to prepare for GDPR.

GDPR Prep Reference Guide


Ready to take your ads to the next level?

DELVE is your strategic partner for site-side analytics, campaign management, and advanced marketing science. As experts in the Google Analytics 360 Suite, DoubleClick Digital Marketing Solutions, and Google Cloud Platform, DELVE drives client growth through a data-driven mindset that converts digital inefficiency into hard ROI.
SEE EXAMPLES of our experience and reviews from our clients.
Contact us to learn more about how we help our clients get advertising right.