#52 Talking privacy, GDPR and GA4 (with Rick Dronkers @ Data to Value)

This week Dan and Dara chat with Rick Dronkers to talk everything privacy – from compliance and GDPR, to Schrems and Google’s stance. Rick helps them understand all the buzz arougn the recent ‘GA is illegal’ news and how (or if) GA4 can help address anything.

DISCLAIMER: Neither we, or our podcast guest Rick Dronkers, is a lawyer or data privacy professional. We don’t give any legal advice. This podcast should not be taken as legal advice. Please consult with a lawyer and a privacy legislation professional before taking any decisions.

Check out Rick over at Data to Value https://bit.ly/3Bmxwbm, Twitter https://bit.ly/3Uhxquy and LinkedIn https://bit.ly/3S3EusA.

And make sure you listen to Rick’s podcast Life After GDPR (after ours of course 😉 ) – https://bit.ly/3qJccrU.

Have a read through the “Q&A on the CNIL’s formal notices concerning the use of Google Analytics” with links to all the CNIL pages on GDPR-compliant tools and how GA might be compliant with the use of server-side GTM – https://bit.ly/3UgBtXZ.

Since the recording of this podcast, Rick published his article on “Fight, Flight or Freeze: Will you (continue) to use Google Analytics 4?” which is well worth a read – https://bit.ly/3S3jIta.

In other news, Dan gets his Trek on, Dara goes mountaineering and Rick enjoys his creature comforts!

Follow Measurelab on LinkedIn – https://bit.ly/3Ka513y.

Intro music composed by the amazing Confidential – https://spoti.fi/3JnEdg6.

If you’re like what we’re doing here, please show some support and leave a rating on Apple, Spotify, or wherever really.

---

Let us know what you think and fill out the form https://bit.ly/3MNtPzl, or email podcast@measurelab.co.uk to drop Dan and Dara a message directly.

Quote of the episode from Rick: “It’s good for us to realise Google Analytics makes them no money right. It all serves to get people in on the ad network, and that kind of conflicts with the privacy thing”

Quote of the episode from Dan: “One of my nerdy pastimes is to go onto a website and see if their cookie banner even works, because everyone’s got a cookie banner now”

Quote of the episode from Dara: “If we just started from fresh today and we had no knowledge of what was there before, we’d probably find a way and we’d work quite comfortably within the legislation”

---

Transcript

[00:00:00] Dara: Hello, and welcome back to The Measure Pod, a podcast for people in the analytics world to talk about all things surprise surprise, analytics related. I’m Dara, I’m MD at Measurelab.

[00:00:24] Daniel: And I’m Dan, I’m an analytics consultant and trainer also at Measurelab.

[00:00:27] Dara: And we’re very happy to be joined by fellow podcaster, Rick Dronkers today. So firstly, big welcome to The Measure Pod, Rick. Great to have you on board.

[00:00:36] Rick: Yeah, great to be here.

[00:00:37] Dara: So I’m not going to steal your thunder. So we always hand it over to guests to introduce themselves. And usually what we ask is what your journey has been. And you can obviously give a very quick whistle stop tour, or you can take a little bit longer, it’s entirely up to you. What’s got you to the point where you are today and what is it that you’re doing today?

[00:00:54] Rick: Yeah, I’ll start with what I’m doing today and then we’ll work back probably. So like you guys I’m active in the digital analytics space. I run a company called Data to Value. We specialise basically in the Google stack, so we do a lot of Google Tag Manager, server-side tag manager, and right now a lot of Google Analytics 4, and yeah, we help clients capture data. So how I got into that industry, like three years ago, I started the company before that I worked at a digital analytics agency, which was a Google partner. But if I take it back way further, my dad had an advertising agency and basically around the time the internet got started right. And I always had a computer at home.

[00:01:31] Rick: My dad, I think he pretty quickly figured out, like, that’s going to be an important thing. So it’s probably good if my sons have access to it soon, so there also wasn’t this like fear of messing up the computer, like it was kind of encouraged. So, I think that’s where it all started, so pretty quickly started tinkering with websites and then whenever I had questions, my dad either could help me himself, or he got people at his company and he asked them like, you know, what’s the book that he needs to read or what’s the resource that he needs to look at right, so it was a nice hack I had, I think.

[00:02:00] Rick: So it started out with web development, by today’s standard you can’t really call it web development. But just tinkering and building your own website and doing that for whatever kind of platform I could figure out, like as long as I could be creating something. And then I think it was around like 15, 16 or something I started figuring out what affiliate marketing was, right, like basically how to make money. I have this skill now, which is building a website. But now I want to make money because I don’t want to work in a restaurant right? That kind of mindset. Ended up also working in a restaurant because the affiliate thing didn’t take off quite that quickly. But in the end I did manage to like supplement my income with affiliate marketing, building websites.

[00:02:39] Rick: What I did was TV channels, they had like this one day a year where they would announce all the new shows they would put on next year, and back in the day they didn’t really like register all domain names right off the bat. So you could quite easily get like an exact match domain name, like the .com or the, you know, and that way you could rank really high for a TV show and if the TV show got popular, then you could get a lot of traffic on that. And then depending on the audience of the TV show, you could put like mobile banner you know, ring tone ads or whatever kind of crap we had back in the days on it. So that was a little bit, yeah my introduction to digital marketing I would say, and also to analytics, because pretty soon you figure out like, okay, I now have this, but now I need to know if it’s actually working right. So how do you figure that out?

[00:03:21] Rick: And that’s when I stumbled first across Net Start, which is like the counters on your website, you know, the real old school stuff. And then pretty soon into Urchin and Google Analytics. So yeah, that’s how I rolled into it, but took quite a detour first. Helped at my dad’s company building websites for clients and then pretty soon figured out like, hey the online marketing stuff’s actually way more my thing and also what a lot of clients are asking for. There’s now a lot of people building websites, but not a lot of people marketing those websites. And then the analytics thing really grabbed me and we worked together with an agency at one of the companies I ended up at, and that agency turned to be my next employer, which was Maxlead which is a digital marketing agency from the Netherlands. And there, I started as a web analytics consultant, I got to work on Google Analytics for big clients. And yeah, that basically brought me to starting my own company three years ago.

[00:04:11] Dara: That’s a brilliant story and there’s two firsts at least there, you’re the first guest to say that your, well your parents got you into analytics, that’s definitely a first. And the other one is you’re the first person to mention ringtone ads. Giving me a real blast from the past, not necessarily good memories, but yeah. Ringtone ads, wow.

[00:04:29] Rick: Yeah well, if you read about some of the people, like I made, let’s call it hundreds maybe if you sum it up, maybe 2,000, 3,000 bucks over that period on that. But I think there’s people really became like millionaires based on ring tone ads, it’s insane those stories.

[00:04:44] Daniel: It’s really interesting coming from that kind of second generation digital, but tell me, how was it starting a company three years ago? Because that was like right before a very difficult time right? That’s just before the pandemic. So how has that gone for you? How has Data to Value kind of evolved and developed through the last couple of years?

[00:04:59] Rick: Yeah to be honest, the pandemic probably was even better for us. So I built up my network of like previous employees of the agency I worked at plus like clients that I used to work for at that agency and now moved on to other companies. So getting your first clients is relatively easy because you just say on LinkedIn, hey I’m going to start for myself, is anybody looking for any digital analytics help? Well everybody is or was at least right? So that part was pretty easy. And then I actually worked on site with some clients, so I did like one day a week at this client one day week at the other client. But the pandemic actually made it into what I wanted it to be anyway, which is full remote. So I already had a couple clients that were not in the Netherlands, so I already did quite a bit of remote work, but then due to the pandemic, basically got to go full remote, which was what I had envisioned anyway because I hate standing in traffic, you know?

[00:05:50] Rick: So that was a no brainer for me, for our type of business and doing video calls, it works so well. Maybe also at the agency I worked we couldn’t find enough analytics talent in the Netherlands. So we were already doing the video calling a lot right, daily. And luckily all the clients also embraced working remote so.

[00:06:10] Dara: It was a real silver lining for us too, actually. We hadn’t that experience prior, we were very much focused on all being in a physical office. So we were reluctant at first and thankfully we were proved wrong. We were reluctant to go remote first to begin with because we thought it was all about having people in a physical space every day. And you know, COVID taught us that that’s not the case, and actually it’s helped us to expand because we’ve been able to hire people who aren’t able to get to our original office space. And the same with clients you know, we’re not seeing clients face to face as much as we were pre-pandemic, but it doesn’t seem to be having any negative effect because people’s working routines have changed, haven’t they? So the idea of being on a video call now is not quite as gruelling as it would’ve been two, three years ago. It would’ve been more of a novelty back then for a lot of people, whereas now everybody has the setup and everybody’s used to doing that as part of their normal working day.

[00:06:56] Rick: Yeah, we’re in a luxury position, right? I would argue that our industry is probably earning above average. And most people will be able to allocate some space in their house and get some of the gear. This of course doesn’t apply to all industries, but I think for our industry, it’s really a no-brainer, also with the type of work.

[00:07:14] Daniel: Digital nomads, we can grab a laptop and just go anywhere and continue doing the work that we’re currently doing. I mean, speaking for us as the kind of Google-stack specialist, you know, working with Google Analytics, Tag Manager, those kind of things. Even like the GCP (Google Cloud Platform), we don’t need any on-prem equipment, we don’t need any hardware really. Everything we’re doing is, if I have access to a web browser, I can do my job and that is a really fortunate position to be, especially during the pandemic too, that we could just literally overnight, we picked up and worked from home. And it is a bit of a challenge to get maybe people set up at home with desks and supports, back rests and webcams and things like that. But, you know, that was a temporary challenge of just ordering more kit you know. I think actually what we found as Dara said is we’ve learned that the reality is that we can continue operating, if not more effectively, remotely with a lot more freedom, work life balance can be improved and also, like we said, talent acquisition is the hardest thing actually in this industry, probably more so than other places. And actually we can now recruit further afield and that’s been the biggest help for us, is to kind of expand and it doesn’t matter where you are, as long as you’ve got internet connection and a web browser you’re in.

[00:08:14] Rick: Yeah, that’s a great thing. It will have some downstream effects though, right? I work a lot with with a company called MarketLytics. But they’re from Pakistan, they’re from Karachi and they have been working for international clients for quite a long time. If you see how much talent there is in countries like Pakistan, India, how, you know, they all speak perfect English, almost. They are super eager to learn whatever you throw at them yet this will really open up like globalisation at its finest, basically. At first it might give an edge to companies here hiring in from there but I think it also like for people trying to get a job here, your competition just became the world instead of one geographic location, right? So people have to step their game up, there’s a bunch of people out there who are really willing to put in a lot of work and effort. I think in the end it results in higher quality work, but it does change the dynamics quite a bit also for people looking for a job here, let’s call it in the west.

[00:09:13] Daniel: All right, Rick let’s talk some work stuff now. I’m really keen to pick your brains a little bit around some of the stuff that we work in. It’s always good to have someone who works in the same kind of tool set, the same kind of stuff that we do. I’m sure you get this as well, but a lot of our friends and family have no idea what we do and we can’t talk to them. So it’s a rare opportunity we get to kind of chat stuff about Google Analytics, Tag Manager with someone else, so it’s a pleasure that you’re here.

[00:09:34] Daniel: So I have to start with obviously your podcast is the Life After GDPR. So, maybe let’s start with GDPR and Google Analytics specifically because I know we both work in Google Analytics, GA4 before, and there’s been a lot of chatter over the last couple of months, maybe year, about a lot of kind of headlines making it at least into the national press around GA (Google Analytics) is now illegal. GA (Google Analytics) is this, we can’t use GA (Google Analytics) and lots of different countries are kind of coming out and they’re kind of running on this train of Google Analytics is illegal, but we know there’s more to that story, there’s more than one Google Analytics as well, and it’s a bit more nuanced. But what’s your feelings around that? Can you maybe give us an overview of what the hell that is about and why it’s so nuanced and why maybe we shouldn’t take it at just the headline and we should read the full article.

[00:10:14] Rick: Yeah so I’m going to summarise and butcher what the guests on my podcast have told me right because let’s start out with the fact I’m not a lawyer, I’m also not a privacy expert. I started the podcast basically to figure out this question, right. So in my podcast, I try to invite people to tell me what is going on. So like you said, there’s a lot of headlines, I think it’s probably wise to identify like the players on the field. So we have privacy regulations within countries or within in our case, the European Union. There are data protection authorities per country, right? Each country has like their own data protection authority, and they basically make cases around what is allowed, what isn’t allowed. They try to handle complaints, so complaints have to be filed against either a website or a tool or whatever. And then they start to look at it and then they figure out, can we make a case or they, you know, inform the website, like hey you’re doing something that’s not allowed, please remove that.

[00:11:06] Rick: And then there’s privacy, let’s call them privacy advocates, privacy fighters. None of your business, so NOYB, that’s probably the most well known, it’s founded by this guy Max Schrems. And he has been fighting privacy for a long time and got a lot of big cases ruled in his favour. And they basically submit complaints to all of these European data protection authorities. To basically, yeah, get the ball rolling on hey, we need to get a ruling on this, right? Because you can have a law, but if there’s no judge that rules on that new law, then it’s not officially illegal yet right? We were a little bit in that in between limbo state and they were basically doing the groundwork of like, we now have this GDPR, but now we actually need to build cases based upon that GDPR to actually move to the next step.

[00:11:51] Rick: So I think that’s a really crude summary of what has been happening and now over the last couple of years, there have been some rulings or some advice that those data protection authorities gave. So the Austrian one, the Belgium one, the France one, there’s a couple of them. And the real blunt news headline version of it is Google Analytics is illegal, and most of what that’s based on is the underlying problem that currently there is no agreement between the EU and the US about international data transfers. So we used to have Safe Harbor and then Max Schrems overthrew that, that’s called Schrems 1, that ruling. Then we had Privacy Shield, which basically was the same thing, also got destroyed by Max Schrems, so that’s called Schrems 2. And now we have, let’s call it individual contracts that companies make on top of their services that they assume should be enough to cover for that use case.

[00:12:44] Rick: But basically there’s no blanket agreement between the EU and the US about how do we handle the transfer of data, and for a B2B company storing data about their products, of course you can store it in the US, nobody cares right? There’s no personal data about that data set, but once it’s about people, so once it can be classified as ‘personal data’, which is what the GDPR applies to, then it becomes an issue. And even though Google Analytics states you cannot have any personal identifiable information in Google Analytics. First of all, that’s a different classification than what the GDPR uses for personal data. And for instance, the Client ID, so the cookie, like the unique number that identifies me on your website, that is already classified as personal data under the GDPR, so it applies to that data set. And then the issue is that in the US, there is something called the Cloud Act, which is a law or something that is in place that basically allows intelligence agencies to subpoena a company, a US-headquarted company to hand over data about a specific user, and probably this was all thought up with making sure that terrorism doesn’t happen right?

[00:13:54] Rick: The intentions are probably good, right. But it can be applied to anybody, and because all the big cloud vendors have a US-based headquarter. Even though you would store your data on a Google Cloud, Europe server, it could still be subpoenaed by the mother company, which is in the US. So that’s basically the train of thought that all this is based on, like in the end, this way the US handles personal data where any intelligence agency can get access to that data in theory, even though according to Google’s transparency reports it hasn’t happened. And that is in conflict with GDPR, so regardless of how you configure Google Analytics, like in the end, the data’s going to be stored on a US-based server, and that is why, you know, no bueno.

[00:14:39] Daniel: That’s the thing that I find fascinating is that, you know, a lot of these stories start with the GA (Google Analytics) is illegal because it’s probably the most popular or used platform across millions, billions even of websites over the you know 15 or so years. But actually this applies to any technology that has a US headquarters. So this could be, you know, pretty much all technologies. You’ve got Google, Amazon, Microsoft as well as like most marketing platforms, Facebook, Meta, all of those. And so when I read the kind of GA (Google Analytics) is illegal, but I’m going to continue retargeting in Meta, on Instagram or whatever, or I’m going to keep my data in AWS cloud, which is still owned by an American company. This is the real interesting thing that I just don’t see it ever getting passed without sort of a new EU-US new agreement, which I’m sure Schrems 3 will exist and take down at some point. This is the reality, I think that they’re just going to clash and I don’t see how this is going to really get resolved. It’s just a really weird and odd situation to be in where both parties are like, well, this applies to downloading maybe fonts on your websites, this applies to your marketing campaigns, your analytics, your cloud server, which, you know, again, you could have it stored in the EU, but again is owned by an American company. There’s just no way well, at least I don’t see there’s any way past this.

[00:15:45] Rick: Yeah, a hundred percent so there’s one nuance to what you just said. The company has to have consumer facing services that also service EU citizens or people browsing from the EU. GDPR also applies to an American who is on holiday in let’s say the Netherlands, if they then browse internet from there, then they also protected by the GDPR. So it’s more like people browsing from the EU. So companies that serve consumer facing things like let’s call it Gmail, Google Maps, YouTube right. In theory, maybe you could argue that if Oracle is not offering any consumer facing services, then that might not be in there, you know, don’t quote me on that, but yeah, for all the things that we use that applies, and like you said, I think a hundred percent sure that Google and Meta are lobbying like crazy in Brussels, right? But I think it’s a really fundamental disagreement of how the GDPR is structured.

[00:16:37] Rick: And then in the US, I think, you know, they really believe making sure that our intelligence agencies have that option is a good thing, and this is a structural disagreement. I feel like on that level, regardless of digital marketing, right, we’re way down the line in just feeling the effects of it, but it’s more like a structural disagreement on that level.

[00:16:55] Dara: And going back Rick to the GA-specific, but have the cases that have kind of sparked these scaremongering headlines, like GA (Google Analytics) is illegal. Are these all based around Universal Analytics? And if so, how much of a step in the right direction is GA4? Because presumably this distinction that you mentioned between PII and personal data, that still exists, and you would still have data in GA4 that would be classed as personal data by GDPR standards.

[00:17:20] Rick: They were all based on Universal Analytics, because it takes a while to get these cases, you know, get them actually evaluated. And as you know, Google Analytics 4 has a lot more privacy features also in recent months being released by Google, so I think that’s a great move by Google. I don’t think it solves the underlying fact that we just discussed, so for anybody who’s in digital analytics, you understand the fact that you need a session ID to stitch multiple sessions to get it to identify how a user interacted with your website over a longer period of time. Otherwise, if you just have single hits and page views, it’s better than nothing but it’s not, you won’t be able to do attribution over time. And once you take that step then there’s that identifier, which will, I think always be classified as personal data under the GDPR. So that’s already like, regardless of all the privacy features Google bakes into GA4, I don’t think they will get away with the classification of yeah Google Analytics is not using personal data unless they break that logic.

[00:18:18] Rick: Actually the French data protection authority, the CNIL, they have an interesting article on their website. I’m not sure if it’s translated to English, but you can try to Google Translate, I’m not sure if it’s GDPR approved, but it works, but they have an interesting article where they mention the use of a proxy. So they call it a proxy, putting server-side tag manager in between your website and your data collection with your Google Analytics, and then basically scrambling everything. They argue that might actually be GDPR approved, but if from a technical perspective, you might already guess that once you do that then a lot of the features of why you use Google Analytics go out the window, because if you scramble any ID then sure Google can’t do anything with the data. So from a privacy perspective that’s good because Google can’t stitch it to any user or whatever, but you also probably lose, well, any advertising feature in Google Analytics obviously goes out to window right away. But probably also attribution will not be great, audience segmentation, all these kind of things will probably suffer once you go down that route, and then you might wonder if you still want to go with Google and not go with another tool.

[00:19:27] Dara: And that’s actually another big question, isn’t it? So this is something we’ve spoken about on The Measure Pod a couple of times before, because on top of all of the kind of privacy concerns, the fact that this is the first time GA (Google Analytics) are actually sunsetting a previous version, means that now more than ever there is that decision for people to make, if they were going to jump ship. Because in the past I’d say a lot of businesses would’ve just stuck with it because it’s what they’ve always used and they have all their historical data. Now, if somebody was unsure if GA (Google Analytics) is still the right solution for them, more than ever, now’s the time for them to think well maybe we should look to other solutions. And then obviously there’s loads of pros and cons to all the different solutions that are out there. But I guess my question is, you know, do we think GA4 is taking things in the right direction? Can you work with it within the confines of the regulations or is it a time for companies to think maybe we need to look for another solution?

[00:20:19] Rick: I think, like you said before, it would not have been evaluated simply, you know, because not taking an action is the easiest action. And so I think in that sense, it’s good right because for the longest time we’ve been in this world of we just throw any JavaScript on our website, because the vendor gives it to us and it’s easy. And we just don’t think about the implications of that, and pretty soon those vendors figured out like, hey, that’s super interesting to us because, we used to have those share buttons that everybody had next to their article, like add this, share this, whatever the company was called and they turned out to be like the greatest data harvester ever. So I think, you know, on a broader spectrum it’s good that we are being triggered to think about this and privacy regulation is the stick to get us to do that, maybe we needed the stick.

[00:21:04] Rick: So for Google Analytics specifically, I have a blog post in draft mode that I’ve been meaning to publish, but it’s like a square framework that I was thinking about, which is basically fight, flight or freeze. So I did a little MeasureCamp presentation about this idea. So I think you have three options either you’re going to fight, so let’s say Google Analytics is super valuable to you. I think this will mostly be if you are opted into the Google ecosystem. So let’s say you run Campaign Manager and DoubleClick and maybe even Search Ads 360, right? You’re a big spender on advertising, Google is still the biggest ad network out there. You’ve already invested in that infrastructure. The benefits of GA360 integrated with the rest of the marketing suite are obvious, and there’s also like a real monetary value of switching, there will be technical cost of actually switching, there will be a licence cost and figuring that out, there will be maintenance cost of running it yourself or whatever solution you move to, it’s probably not going to be as integrated as the Google Suite.

[00:22:02] Rick: So for those heavy advertisers, I think the fight argument is pretty big, right? Like it’s probably worth it to get advice from a solid privacy lawyer and see what can you do, how can you maybe make it work, what are the options for you. But then there’s so many companies that have Google Analytics on their website and I think nobody ever opens Google Analytics right. In that case, I would say flight, right? Either go to no analytics, because nobody looks at it anyway. Like why would you have the JavaScript on your website, or go to any of the lists of privacy friendly alternatives. Again, the French DPA has like a list of tools that they have deemed GDPR approved. So that’s also a no brainer, right? If you never use analytics, if you don’t spend a lot of money on it, why would you even take the risk of all this privacy regulation coming at you, it doesn’t make a lot of sense, actually.

[00:22:51] Rick: And then the last option is freeze, which I think eventually, most companies will do because you know, like I said, inaction is what we tend to do. Just sit it out and wait and see what happens. Or in a lot of cases, not even be aware that you have Google Analytics on your website and see what happens, right? Like a lot of companies simply are just not actively working on it. I think those are the three options and there’s something to be said for each of them I think.

[00:23:17] Daniel: It’s really interesting, I like that analogy of the three options. And when it comes to Google Analytics, the way I’ve been thinking about this and, and probably talking Dara’s ear off on this podcast a bunch of times, but the way I think about it is that what we often forget is that Google Analytics we just use the acronym ‘GA’ and we forget that it’s owned by Google, which is obviously a marketing company and it’s also part of the Google Marketing Platform. And it’s a collection of tools that are built for marketers that are focused on marketing. I think the issue is that a lot of people who originally thought of Universal Analytics specifically as a data product first, and it almost, the marketing aspect was almost bolted on as a modular aspect as they bought it from Urchin, evolved it into Universal Analytics.

[00:23:53] Daniel: I think with GA4, we really can’t think of it as a data product, it’s a marketing tool. And I think that there’s a shift which was always there it was inevitable. It’s owned by a marketing company, but it’s inevitable shift where GA4 is a marketing tool first. And we’ve spoken to, for example, in our archive, we’ve spoken to a guy called Liam Galliers around Adobe Analytics and he was saying that their team invest in Adobe analytics for the data, but the marketing team still have GA (Google Analytics) and we’ve spoken to Jordan Peck from SnowPlow and we’re talking about SnowPlow, which is a purely data product, but they’re still probably going to be Google Analytics on the website because of the marketing team. And I think having access to the Google ecosystem and especially as they’re moving everything in the future. I mean, Google’s making movements, everything’s going to be GA4-focused.

[00:24:32] Daniel: The standard client for GTM (Google Tag Manager) server-side is GA4 tags. They’re connecting Google Analytics 4 to all the Google Marketing Platforms. They’re probably, if I had to crystal ball it, they’re probably going to eventually deprecate the Google Ads pixels and the DoubleClick Floodlights because GA4 is, quote unquote, solving the privacy gap, which they’re kind of trying to work towards, obviously this isn’t official. We don’t know anything you know about this that’s happening, but the reality is GA4 is such an investment from a marketing aspect that the data is secondary. I mean, we see that with things like behavioural modelling, with conversion modelling, you don’t get access in the platform to real data, and a lot of people just don’t know that and are not aware of it. I don’t really know where I was going with that, Rick, but I think this is the key thing that I have conversations with people around. If you want data, pure data from a data product just to have data, then yeah, for sure go to a different product because Google Analytics 4 isn’t that really, it’s a marketing tool that gives you some data if you like it.

[00:25:24] Daniel: Yes there’s the BigQuery export, but there’s all sorts of nuance and issues with that at the moment. The reality is this is a marketing tool and from a data perspective, you have to really, really want to and try to make it useful from a data team’s perspective. I think that’s the seismic shift between Universal Analytics and GA4. Within Universal Analytics, it is a data product first and a marketing product secondary. Whereas I think GA4, if we go into the same assumptions we are going to be mistaken, we may even hit issues, whereas if we go in thinking it’s a marketing tool first and a data product, secondary, I think that’s really where we have to start thinking about Google Analytics and the future of Google Analytics in the Google Ads ecosystem. And that way we can kind of compartmentalise it and say, like the reality is yes, if you are going to shift go get Adobe or something like that, but the reality is you’re probably still going to have Google Analytics because you want access to the biggest ad network in the world right?

[00:26:10] Daniel: Is the interesting thing, the kind of the thought process that I’m seeing at the moment. And I think especially the people that are going to freeze and just not really realise it until next year. I think there’s going to be a big old kind of like, oh crap, what the hell do we do in July next year? And I think this is going to be it, it’s how do we use this from a data perspective when it’s not really a data product anymore.

[00:26:27] Rick: I think you’re right, I think also you can kind of see that with Gtag right? Recently Google had some developments around that again, and also some of the documentation for Google Analytics or for Google Tag Manager I think was about how to implement eCommerce using the data layer got changed and recommending the Gtag approach, which kind of it got reverted. But it kind of highlights like what Google might want to see, which is throw it all into one tag, the Google Tag and make that, first of all, easy to use right? Because if you look at this from the perspective of a country without privacy regulations and you just want to get stuff done quickly for a marketer, then having a Google Tag that you can throw on there and that measures conversions automatically. 10 years ago, we would’ve been really excited about that but now from the perspective of all the privacy regulation, we’re reconsidering that a bit, because it could also be a strategic move, but it’s definitely helping less technical clients close the gap to more technical clients without having to hire a lot of specialists with having just one tag to throw on there.

[00:27:26] Rick: But I think, yeah, it doesn’t really fit well together with the concept of privacy regulations and even in the US, there’s now five states, I think, with a privacy regulation and there’s talks of having one that covers all states. I don’t think that trend will reverse, I think one important thing that I remembered, if it applies to Google, it will apply to Microsoft and to all of them. But the big difference is that Google is really secretive about their measures that will preserve privacy. So with a lot of these features, they have released, which, you know, it’s better than having none of those features right? It seems like a move in the right direction, but there’s not a lot of information available, this is what privacy experts tell me, or I read on Twitter by following them. There’s not a lot of information available that clearly audits how they separate their data sets and that make sure that they tell you if you disable Google Signals, then your Google Analytics data cannot be used for remarketing purposes by you. Is it also actually not being used by them to enrich the profile right, those kind of things. From what I understand, like Microsoft and other companies are more proactively sharing audits by external parties showing how they separate data sets and how they preserve privacy. Whereas at Google it’s like, yeah we do that, trust us.

[00:28:42] Rick: And that’s also what is probably pissing off a lot of the privacy fighters out there. You know, you’re the biggest ad network, all the incentives would align for you not to do it and you’re requiring us to trust you that you are doing it, simply by saying, yeah, we do it without an audit. So I guess that’s also a thing that might have actually got Google in the crosshairs of those privacy fighters to begin with.

[00:29:04] Daniel: So Rick there’s one other aspect that I’ve been really keen to chat to you about, and it’s specifically around Google Analytics, and I think Dara kind of touched on it earlier or spoke about it, which is that Google Analytics 4 have released a couple of features that are trying to address this, and specifically they’ve released features around controlling the cookie duration or overriding the cookie duration. They’ve also released features around the sort of data redaction or granular data redaction and you can do things like NPA, mark events as NPA, non-personalised ads. I just want to get your feel on that I mean, I’m struggling to find, not necessarily use cases, but to kind of like show people that this can be useful. A lot of people that I’m working with specifically are using the kind of the defaults, the out of the box and like anything in Google Analytics or most Google things, probably alluding to what you were saying just now, in terms of they’re quite secretive, they give you the mechanisms to change it, but they don’t make it super readily available and you have to know where you’re going and what you’re doing before you can even attempt it.

[00:29:54] Daniel: So I suppose it’s more of a point around, Google provide us all sorts of controls, especially around Google Analytics, what we can do, server-side GTM, client-side GTM. We can control everything, we can do that. But to most people that want to be compliant that don’t have in-house lawyers or analytics teams, or even a analysts, they probably have no clue that this is even available to them and they think that Google Analytics is just doing some reports. It’s free, quote unquote, free, and they’re just going to throw it on the website, but they could be stuck with a fine, they could be stuck with some kind of GDPR fine, or they could be finding that they’re collecting personal data when they had no intention of ever wanting to do it. I’m just wondering if you think that Google is ever going to be in a place or Google Analytics is ever going to be in a place where, you know, they can make it quote unquote compliant for different regions. Let’s just take GDPR, let’s take the EU for the time being, you know, it’s hard enough to deal with that let alone what the us are doing in Brazil and everywhere else. Is this the reality? Is the kind of average end user of Google Analytics really ever going to know what to do to actually be compliant, or is this a bit of a pipe dream and the reality is most people are forever more going to be sort of not compliant?

[00:30:55] Rick: Yeah great question, I suspect that Google is keeping a bit silent until this new transatlantic data agreement is signed. If you look at the Google Analytics blog, there is like two blog posts by the head of Google Analytics, like somebody high up in the tree basically stating that Google believes in a new privacy shield basically and that’s the only way we’re going to solve this. So I feel because in March or May they announced that this new transatlantic data agreement would, you know, is in the works. So I feel like kind of, maybe they’re waiting for that and also that might be a factor. I think if you could configure Google Analytics and you select that you service people in, you know, that your company’s based in the Netherlands, let’s say. Then by default, it would set it to certain settings that would not be in Google’s overall favour, right. If you consider Google Analytics as a free product, it’s likely a loss-leader for us to spend money on the Google Advertising Network. And if you want to spend money on the advertising network and use your Google Analytics data for that, then those features should not be disabled. So that kind of conflicts, but maybe if Google looks at it from like a bigger perspective and like also PR perspective, maybe it could actually be a good move.

[00:32:06] Rick: They could have a setting where you say configure Google Analytics the most GDPR compliant way. There are a lot of features that definitely help it move in that direction. I think the underlying issue still remains, right? Their headquarters is still based in the US. So it can build, you know, endless features, but that won’t solve that issue. So I think that plays a role, right? They feel like if we can solve that underlying issue, then all the other stuff doesn’t really matter. But yeah, from a configuration point of view, Google Analytics 4 actually has a lot of features right now that can help you change the data and preserve privacy, let’s call it. They even have Europe-based servers now for European hits. So what you will notice is if people visit your website from a European IP address the hit will be processed by region1.googleanalytics.com instead of just googleanalytics.com. And that server is supposed to be in Europe, and then the way it works is that on that server, PII will get stripped or things that you could classify as personal data. So there’s a whole list of things that Google has put in there, like really specific device IDs that could allow for fingerprinting and then of course the geolocation information, and then it gets sent through to the servers in the United States where you access your reports basically.

[00:33:18] Rick: I think that’s a great feature. They could be more transparent about how it actually works and it would be nice if they would give us the option to select which metrics and dimensions we want to get basically scrambled on that server before it goes to the US. But then in Google’s defence, still that server, even though it’s a Google Cloud European server, it’s still owned by Google in America. So, you know, again, it doesn’t solve the underlying issue for them. I hope that Google becomes more proactive on this, but I feel it’s such a strategic thing to them like if they put out a statement on it, it could impact all of their business. And I think it’s good for us to realise like Google Analytics makes them no money right? So yeah, it all serves to get people in on the ad network and yeah that kind of conflicts with the privacy thing.

[00:34:01] Daniel: Yeah well again, it’s just remembering that this is a marketing tool, right? I think that’s the case and it is not in their interest, although it could be good PR as you said. Actually, this conversation is the real interesting part, the fact that we’ve got, you know, three data analytics professionals that work with Google Analytics every day and we are trying to figure this stuff out now. And you know, we’re talking about GDPR, which came into effect years ago, and we’re talking about like legislation that’s been in place for a while. I know obviously recent rulings aside, we’re still trying to muddle through. One of my nerdy pastimes is to go onto a website and see if their cookie banner even works because everyone’s got a cookie banner now and I just see all the GA (Google Analytics) Facebook hits flooding in without any consent.

[00:34:34] Daniel: So we’re in a place where like, I would say that us as sort of GA (Google Analytics) professionals, you know, not Google staff members, but GA (Google Analytics) professionals, we’re kind of using this stuff and we’re trying to figure this stuff out. And this is where I think that, you know, does anyone else have a chance that doesn’t do this for a living?

[00:34:48] Dara: But you mentioned cookie banners there and this is what I was going to bring up next, the other side of all this, because we’ve talked a lot about the legislation or the regulations, and we’ve talked about the tech, but there’s not nearly enough done on the other side of this to gain the trust of users and to get informed consent and this is something that you spoke about on your podcast, Rick, this idea that informed consent, firstly, doesn’t really exist, because very few people go in and actually read the full policy. You either accept everything if you’re one of those people who thinks, well, I’m not too worried, I’ll just click okay on everything. Or you’ve read the headlines and you think I’m just going to decline everything because I’m not going to take the time to look into what they’re actually getting my consent for. And I think you made a good point in that discussion around maybe seeking consent a little bit later on in the journey and offering something in return for it.

[00:35:35] Dara: So instead of this annoying kind of status quo of every single website you go on, you get this overlay straight away and again, most people will either just click okay or click reject. You won’t take the time to go in and read it. But if there was some way where you’re gaining that further consent to maybe track a little bit more, once somebody’s into a checkout flow, or once somebody’s on a product page and you could maybe gradually inform them of what it is that you’re doing and what the benefit is to them, rather than just hitting them, it just feels really lazy. We just hit people with this box that they don’t really understand, they’re going to either click yes or no. They’re not gonna take the time to understand it, so it doesn’t feel like we’re really doing enough, and this isn’t just us as analytics professionals, but website owners themselves. We’re not really doing enough to inform people of what all of this means and what the benefit might be to them of giving consent for certain uses of data and maybe not giving consent for other uses.

[00:36:27] Rick: Yeah, definitely. I’ve since been informed that you are not allowed to specifically give something for the consent, you cannot trick users into it like that. I think that the underlying issue of what you just mentioned is that let’s say you’re the DPO or you’re at the legal department of company X. This requires them also to be comfortable with figuring that stuff out because doing it at the gate, like everybody else is doing it that’s the safe approach right, because either you get consent or you don’t get consent, and then, you know you got it covered. So it will also require DPOs and legal departments that first of all, have the amount of staff needed to explore that and also the willingness to be like, hey, okay, we see that this way of doing it, from a user experience point of view it’s ridiculous right?

[00:37:15] Rick: So that makes it a difficult issue because from a legal point of view, of course, you expose yourself to a certain type of risk. When we implement something the wrong way, okay the risk is ruining some data, but there’s probably maybe a tiny bit of monetary risk, but if you expose yourself to those legal issues I can imagine that’s a bit scary for them.

[00:37:35] Daniel: Well the biggest issue actually, and again going back to the whole point of Google Analytics being a marketing tool is that you need that landing page query string because if you ask for consent later on in the journey, but you need that, you need that first page query and you can’t store it either without the consent. So this is the thing, so the whole point of a marketing attribution tool goes out the window and it becomes purely kind of server logs again, and it kind of nullifies the point of Google Analytics. If you look on Measurelab’s website, we throw the cookie banner up as soon as you land. We had to do some real hacking, you know, it wasn’t easy to get the cookie banner to work with server-side GTM to respect consent, because what we ended up having to do is we needed to wait for consent, either opt in or out or tweak it before we even triggered any of the Google Analytics so that we could, you know, again, consent or no consent we don’t mind what the choice is, we make it very easy to do both. But if you have consented, we want to go great, we grab the query string, we get it before you move on. You know, we need to grab that query string because again, the whole point is the marketing attribution or even just hit attribution, it doesn’t have to be attribution modelling.

[00:38:32] Daniel: This is the thing, so I really love that episode, Rick, I think it was one of my favourites actually, and digging into the kind of the GA (Google Analytics) landscape kind of like the stuff that we do. But I think that’s the thing that hit me, I think maybe if they opted out at the offset and then maybe later on being like, ah, you might like us a bit more now. Maybe ask them again in a less intrusive way. I’m not saying I’m a fan of this approach, by the way, I’m just saying that’s the reason why we’ve had to do it this way and it’s purely for the marketing attribution.

[00:38:55] Rick: Yeah writing the landing page query string away, like in local storage or something, or even for the session duration it’s technically yeah, it’s not allowed directly.

[00:39:03] Daniel: Yeah so we need consent to do that bit, to then get consent to store it and send it to Google Analytics, it’s a crazy minefield.

[00:39:10] Dara: Even if there was a certain baseline that could be handled at the browser level. I think some of the browsers are starting to do this now, if I’m not mistaken, but not always asking for, you know, if there’s certain things as a user that you are happy with it would be much more convenient if there was a way to set that at the browser level or through an add-on or a plug in or whatever, rather than having to go through this frustration of having to deal with various different types of consent boxes on different websites.

[00:39:35] Rick: I think it’s also, we have been grown accustomed to what we have and now pieces are being taken away. So it’s also a little bit the loss aversion, you know, mindset for all of us. Like we had all this data, first Google took the SEO keywords away right, that’s where it started. And now gradually we’re losing all of this granular data, that probably also plays a role.

[00:39:54] Dara: I think that’s a good point, if we just started from fresh today and we had no knowledge of what was there before, we’d probably find a way and we’d work quite comfortably within the legislation. Rick, I think we could carry on talking all day, but maybe you’ll be kind enough to come on The Measure Pod again and we can have a further discussion down the line, but for now I think let’s wrap it up. And this is the point in our show where we talk about what we’ve been doing, all the fun, exciting things we’ve been doing outside of work to wind down. So we’ll start with you, I’ll put you on the spot Rick, what do you do when you’re not working?

[00:40:23] Rick: I bought a house last year together with my girlfriend, so there’s lots to be done on that front. And I think within a week or two week there will be two cats that arrive in the house, so there’s also lots to be done for that, so I’m a pretty busy man lately. Yeah besides that I’m really spending a lot of time on, like you guys, doing the podcast and just making sure that my clients are still happy and understanding GA4. That honestly, that takes quite a lot of my time at the moment.

[00:40:49] Dara: It does, it doesn’t leave much time for past times does it? What about you, Dan? What have you been doing since the last episode to wind down?

[00:40:56] Daniel: I’m a huge Star Trek fan and for the audio listeners, I’m going to hold up my Star Trek themed mug, which I always have with me. The second film that came out celebrated its 40th anniversary believe it or not. And they re-released it in the cinema, the kind of director’s cut and so, a couple of us from Measurelab, we all went up to London to the Millennium Dome, there’s a cinema in there and we watched a 40 year old Star Trek.

[00:41:14] Dara: The O2.

[00:41:16] Daniel: I think we know it as the O2, but I think everyone knows of the weird millennium dome thing at least in London. But anyway, we went to see Star Trek 2 in the cinema, 40 years after it came out, which was so much fun.

[00:41:26] Rick: That is cool.

[00:41:27] Daniel: And Dara, you were also there, you were one of the people, one of the Star Trek fans that came with.

[00:41:32] Dara: I was, I’m a slightly more silent Star Trek fan. I never jump in and say, you know, when anyone says who’s a trekky I never put my name forward, but I am yeah, I definitely, definitely identify as a trekky, but it feels a bit like that’s cheating if I say that was my wind down. But the other thing I was going to mention, which I can’t remember if I mentioned on the last episode, is I went to Wales. So myself and my partner Hannah went to Wales and we climbed Snowden. I might be repeating myself, so hopefully between those two updates, that counts as one thing that I’ve done that was interesting. Maybe I’m cheating a little bit this week, so hopefully next week I’ll have something more interesting and unique to talk about.

[00:42:06] Dara: Final question for you, Rick, just before we wrap up. If people are interested in reaching out to you or hearing a bit more about you, learning more about you, what’s the best way for people to find out more or get in touch with you?

[00:42:17] Rick: Yeah, I’m active on Twitter and LinkedIn with just my name as my username, so Rick Dronkers on both of them and there I share, you know, whatever I’m working on with the podcast or blog posts or things like that. So that’s probably the best way to go.

[00:42:31] Dara: What about you Dan?

[00:42:32] Daniel: So yeah, LinkedIn and Twitter also, I’m a silent Twitterer. I do the LinkedIn way more, but I have a Twitter account and I do the tweets as you call them Dara occasionally. But my website is the key one, so danalytics.co.uk and I blog and rant about Google Analytics stuff from time to time, there’s pretty much a lot of ways to get in touch with us I think, the usual places, the usual socials.

[00:42:50] Dara: I’m a simple guy, it’s probably just LinkedIn for me. Okay that’s it from us for this week, to hear more from Dan and I about GA4 and all things analytics related, you can check out any of our previous episodes on our archive at measurelab.co.uk/podcast, or you can just use whatever app you’re using to listen to this now to find previous episodes and listen to them.

[00:43:10] Daniel: And if you want to suggest a topic or someone we should be speaking to that might be yourself or a theme that you want to hear me and Dara rant about. You can get in touch with us, there’s a Google Form in the show notes, which you should be able to find in the app that you’re listening to or email podcast@measurelab.co.uk, and get through to me and Dara directly that way.

[00:43:25] Dara: Our theme music is from Confidential, you can find a link to their music in our show notes. I’ve been Dara joined by Dan and Rick. So on behalf of all three of us, thanks for listening and see you next time.