Easily integrate Google Analytics while staying GDPR-compliant!

The arrival of GDPR has turned the lives of many developers upside down. Even for those most committed to respecting internet users' privacy, the complicated legislative obligations as well as the possible sanctions are sometimes frightening, to the point of preventing some from simply measuring their site's audience.

Opt-in? A banner? A popup? A privacy policy? I give up!

Requiring publishers to ask for a user's consent before being able to throw all sorts of targeted ads at them is normal. But having to wait for consent before being able to measure audience causes errors in the figures: whether it's the number of visits, the number of pages viewed, or the time spent on the site.

The solution

What many people don't know is that the GDPR regulation contains a specific article relating to audience measurement, offering the possibility of setting a tracking cookie without having to obtain consent beforehand.

This authorization, valid ONLY for audience measurement and A/B testing, is only permitted under certain very specific rules, but applicable in a few lines of code and a few clicks on the Google Analytics admin panel.

Actions to implement on Google Analytics

• Sign the data processing agreement with Google
• Declare the party responsible for data processing (DPO, probably you)
• Set the data retention period to 13 months (14 months in the case of GA, without cookie reset)
• Anonymize the collected IPs

For a complete tutorial on these first 4 steps (achievable in a few minutes), head over to this article from Codeur.com: https://www.codeur.com/blog/rgpd-consentement-google-analytics/

A bit of code now

Once the Google Analytics script has been customized, all you need to do is:

• Enable by default the launch of the analytics script
• Add a simple cookie banner with text similar to this: "This site uses anonymous audience measurement cookies to improve the user experience. For more information on the use of this data, click here") with a link opening a cookie management popup.
• In this popup, simply explain your approach to audience measurement, and give the person a way to decline these cookies.
• Be sure to keep a link in your footer to your cookie management popup, it must be accessible at all times!
• Disable your Google Analytics script if the user declines audience measurement.

For those who might be wondering: Yes, you can use a cookie to remember the person's non-consent.

Always check that your audience measurement fits the CNIL's acceptance criteria, directly on this dedicated page: https://www.cnil.fr/fr/mesurer-la-frequentation-de-vos-sites-web-et-de-vos-applications

And there you go, you can now measure your audience based on accurate figures!