Google Analytics and Yahoo! Analytics Privacy, Data Ownership and Data Expiration

With the Office of Management and Budget providing a framework for enabling the use of persistent cookies for web site measurement (see post on New OMB Guidance for details) there is lots of interest among Federal web managers and communications staff in using Google Analytics (GA) and Yahoo! Analytics (YWA) the predominant “no cost” solutions on the market. At the same time, I hear lots of hesitancy about using the solutions because of concerns and questions about:

• Whether Google Analytics and Yahoo! Analytics use analytics data for marketing
• Their data collection opt out policies for both site visitors and site owners
• Data ownership

If you’re in the private or non-profit sectors and are considering using these solutions, or currently using GA or YWA, you should know that both solutions have recently modified their privacy policies and opt-out capabilities to address the increasing concern about site visitor control over their data.

What I find interesting about the GA and YWA options is the paths each company has taken over the last year. I think they are quite divergent, and they may reflect business goals that go well beyond the sphere of web analytics.

Google Analytics

Google Analytics provides you with a number of options for controlling data, and the acceptance of Google Analytics among site visitors. In fact, as a site owner, you will need to think about the options you’d like to present to visitors. Google is becoming increasingly interested in addressing privacy issues raised in the US and Europe and the promotion of control over data is one avenue that they are taking.

Using Data for Marketing

GA provides options that are fairly nuanced, so you really need to consider what each one provides.

• Data sharing

When we think about sharing data, concerns often focus on the issue of “I don’t want my site’s visitor information given to Google for their marketing efforts” or “I don’t want my site’s visitor information going to a third party for their marketing efforts.”

GA covers this pretty well. If you go to your Account Settings, you can choose how you want your data shared, if at all. Selecting “Do not share my Google Analytics data” effectively prevents Google from using the data for marketing purposes.

• Opt out

Personally, I’d always recommend to your site visitors that if they don’t want to be tracked on your site, then direct them to manage this through their browser settings. However, if you want to give them another path, you can direct them to download a GA plug in that will disable GA tracking on any site they visit…not just yours. While this may be a civic-minded option to offer, I don’t endorse it because you’re encouraging visitors not to be tracked. I wrote about this in some detail in an earlier blog post. You can check out the plug-in directly at http://tools.google.com/dlpage/gaoptout?hl=en. I affectionately call this the Nuclear Option.

• Anonymize IP

GA already obscures IP addresses so that you cannot report on visitor level data.Now, you can further anonymize IP addresses through the addition of additional code to your GA tag. This will remove the last octet of the IP address prior to its storage, and slightly reduce the accuracy of geographic reporting, according to Google.

Just keep in mind that these options apply to your site visitors and the data you collect on their activities.  They don’t apply to you, the GA account owner.

Let’s start with the Terms of Service for GA <http://www.google.com/analytics/tos.html> and go down to point #6. INFORMATION RIGHTS AND PUBLICITY. This passage explains that Google won’t share your data with third parties. Now, go to the link within #6 to Google’s Privacy Policy < http://www.google.com/privacy.html>.

This describes privacy for use of all Google services. I’ve summarized the items that will be of most interest if you’re using Google Analytics:

Information you provide – describes how Google uses the data you’ve provided when you sign up for a Google Account. So, if you’re going to open your GA account, you’ll need to provide your name and email address. Google can use this information to, in their words, “provide you with a better experience and to improve the quality of our services.”

Cookies – Google uses cookies to track your visits. If you are using GA, they will track your usage. This is also used to “to improve the quality of our service.”

Log information – When you access GA, their servers record your visit, as well as information such as, “Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser or your account.”

And in case you didn’t get it from the “Information you provide” section, the following statement concludes the list:

“In addition to the above, we may use the information we collect to:

• Provide, maintain, protect, and improve our services (including advertising services) and develop new services; and
• Protect the rights or property of Google or our users.”

So, the bottom line is that if you open a GA account and provide usage to others in your organization, Google can use that data for marketing and product development purposes.

Recommendation - If you’re a Federal government site, select the “Do not share my Google Analytics data” and direct people to use their browser opt out. Go to USA.gov if you need a template to work from. Remember that you must update your privacy policy per the OMB directive before you start using GA. See NIH and NCI privacy policy examples as templates.

If you’re a commercial site, consider your site visitors’ privacy vs. the advantages of using Google’s benchmarking services and select your data sharing option accordingly. Remember to be up front and transparent about this in your privacy policy.

Data Ownership and Other Considerations

Don’t let “free” obscure your vision. Read the Terms of Service and know what you’re signing up for. Also notice what isn’t covered.

• Google indicates in that it “may retain and use, subject to the terms of its Privacy Policy (located at http://www.google.com/privacy.html), or such other URL as Google may provide from time to time), information collected in Your use of the Service.” Yes, they provide the opt out and data sharing options described above so that appears to mitigate unauthorized usage. Of course, they could make this a bit clearer. You’ve got to keep drilling down to get the whole story, and then you end up back either back in the TOS or mucking about in the Privacy Center.
• From #2. Fees and Services: “the Service is provided without charge to You for up to 5 million page views per month per account, and if You have an active Adwords campaign in good standing, the Service is provided without charge to You without a page view limitation.” If you have a  a site with more than 5 million page views, plan to do an Adwords campaign.
• Data retention: With fee-based tools, there is generally a default length of time that data is kept and this can be negotiated. There is no such guarantee with Google Analytics. Even though we’ve seen data kept for indefinite periods, there is nothing in the Terms of Service to ensure that this policy will continue.
• Data sampling: GA samples visits on reports with 500K visits within a selected date range to return reports within a reasonable time frame.

Recommendation - Google Analytics may be a good choice for your Federal agency web site, especially if you have little or no budget for web analytics, have less than 5 million page views per month and are comfortable with archiving your reports on a regular basis.

 

Yahoo! Web Analytics

YWA is distinctly different than GA in that its goal as an analytics tool is to provide the potential for delivering data that can be attributed to specific visitors. This is consistent with all fee-based options.

Using Data for Marketing

Yahoo is pretty up front about using YWA data for marketing and product development. This is described in the Terms of Service <http://info.yahoo.com/legal/us/yahoo/ywa/ywa-4750.html>. According to the TOS, under Analytics Program Terms, you must state this in your Privacy Policy:

NOTICE AND ABILITY TO OPT-OUT. You will prominently display within your website’s privacy policy a notice that includes each of the following disclosures in close proximity: (i) a statement that expressly identifies Yahoo! as a provider of third-party web beacons on your website(s), (ii) a statement that describes your use of the data gathered by the Analytics, (iii) a statement that expressly identifies Yahoo! and its use of the Analytics data to improve Yahoo!’s products and services and to provide advertisements about goods and services that may be of interest to end users, and (iv) a statement that describes how the end user may learn more about the choices offered in connection with the use of Analytics information, including an active link to the following URL: http://info.yahoo.com/privacy/us/yahoo/opt_out/targeting/details.html.

This is followed in the TOS by sample language that you can use.

Enabling visitors to opt out of YWA is a bit convoluted. The company recently removed the stand alone opt out for YWA and combined it with general opt out options for the ad network. Unfortunately, there’s nothing on the ad network opt out page <http://info.yahoo.com/privacy/us/yahoo/opt_out/targeting/details.html> that indicates anything about YWA.

Visitors need to know to select “Opt Out” as shown in the screen shot. This opt out is a cookie-based solution, and visitors must keep the third party cookie on their machine for it to be effective. Like the Google Opt Out plug-in, I don’t recommend this direction, and would much rather you push the browser based opt out from your site.

Unlike GA, but similar to fee based tools, such as Omniture, Webtrends, Unica and Coremetrics, there is no anonymizing of IP addresses.

Recommendation - If you’re a Federal government site, I could see some issues about using YWA. While the transparency is all good, you may cause some dust ups by telling visitors that their data is being used by Yahoo, as well as indicating to the public that you are passing their data to Yahoo. True, the data passed to Yahoo is an aggregate number, and there’s no personal information being transferred, but try explaining that nuance to your boss or the hundreds of thousands of visitors coming to your site.

Data Ownership and Other Considerations

Pretty much the same as GA…no mention of data retention in the TOS, although YWA assures me that it’s their policy to never expire your data. I believe their good intentions, but if it’s not in the TOS, then it isn’t guaranteed. YWA does not sample data, but you can make arrangements for data sampling if you’d want to explore this option. Like GA, the TOS is written clearly as a document that gives you the right to use YWA as long as and under the terms laid out by Yahoo, and like GA, these terms can change at any time. Remember…it’s free.

Recommendation - YWA may be a good choice for your Federal agency web site, especially if you have little or no budget for web analytics, and you don’t mind that visitor data is going to Yahoo to provide them with info to be used for their marketing and product development efforts. Like GA, I’d recommend that you archive your reports in case there comes a time when data isn’t kept indefinitely.

Summing Up

While I’ve spent this post describing the data capture issues for both of these “no cost” tools, these are just a few of the requirements to consider in selection. They both have differences in data collection, reporting and analysis that you should look into as well before deciding which one works best for your overall analytics requirements.

 

 

 

Comments

[Brian Clifton]

Phil - thanks for putting this down so clearly. However, I wanted to add my comments to put this into context.

Your statement on GA:

Cookies – Google uses cookies to track your visits. If you are using GA, they will track your usage. This is also used to “to improve the quality of our service.”

Its a tad misleading to say "they will track YOUR usage" - my emphasis. All collected GA data is anonymous and aggregate so surely this is a moot point. My analogy it that its like counting cars that drive past a school each day in order to get an understanding of road safety in the area. That is not the same as writing down license plates and following up with a personalised letter to your home address... though it what some vendors are attempting to do.

I also find it odd when commentators highlight the purpose of collecting data (either GA or YWA) as if this is something new and sensitive and users need to worry about it. For example:

"Provide, maintain, protect, and improve our services (including advertising services) and develop new services"

Putting the web to one side, what on earth is the purpose of collecting data at all if it is not to improve your products/services?

Vendors do of course need to be scrutinised, but I feel your focus is misplaced here. Vendors (or websites) that track individuals surreptitiously (e.g. with the use of Flash Shared Objects) - and attempt to identify them personally - is what is threatening web privacy. And there are a large number of website that attempt to do this...

Brian Clifton
Former Head of Web Analytics, Google EMEA
Author, Advanced Web Metrics with Google Analytics

[Web Analytics Management]

Brian –
Thanks for the thoughtful response and I understand where you’re coming from. Let me clarify why I highlighted elements of the policies:

1.The potential use of GA and YWA in the US Federal government is a new opportunity and there are many folks I’ve spoken to who are not familiar with how these solutions track, or what they track. I’m simply explaining how this all works so people can make educated decisions about their choices.

2.There is a clear distinction in the policy regarding how GA tracks your site visitors and how they track your activity as an account user. This is not a question of right or wrong, or questioning how the data is used. I’m simply explaining the differences so potential consumers of GA are not surprised.

3.Privacy, differentiation in data collection and definition of Personal Identifiable Information (PII) are the focal points of OMB M-10-22. I would be re-miss in my analysis of the TOS and privacy policy if I did not point out the data being collected and how it is used. Again, this is not an issue of right or wrong. It’s not a judgement either. I just want to provide information that will help folks make informed decisions as it relates to how both GA and YWA deal with privacy, opt out and data retention. As I concluded, there other factors that should weigh into the decision of what vendor to use.

Best-
Phil