Google Signals

👋 Understand the regulatory implications of enabling Google Signals in GA4 in terms of personal data protection and CNIL and RGPD compliance.

ℹ️ Google Signals will be removed from the reporting identity on February 12, 2024. This change will apply to all Google Analytics 4 properties and will only affect reporting functionalities.

Reminder of the legal framework for data collection

In Europe, website users have the right to data privacy thanks to the General Data Protection Regulation (GDPR).

Under the RGPD, an IP address is considered Personally Identifiable Information, and therefore personal data. It is therefore necessary to obtain users' consent to collect and process their data. Other privacy laws, such as CCPA, LGPD, etc., also require this consent.

The problem? Third-party cookies are on the way out, or at least their use is very limited. Browsers such as Mozilla Firefox, Safari and Brave already block cookies by default. Google has also announced that it will block third-party cookies in 2024.

Google's alternatives

Google has introduced Google Analytics 4 (GA4), focused on data privacy, and has proposed several alternatives for the cookie-free future:

• IP anonymization function

• Google Signals

• Privacy Sandbox: with the trust token API and FLoC technology.

Each of these technologies has its own specificity, providing a comprehensive view of users' online behavior while at the same time respecting privacy laws.

What is Google Signals?

Google describes Signals as session data from sites and applications that Google associates with users who are logged into their Google Accounts and have activated Ad Personalization. This association enables reporting, remarketing and conversion exports across multiple devices.

The main advantage of Google Signals over third-party cookies is that it uses aggregated data. In this way, personal data is anonymized and never processed by third parties. This means that this technology protects users' personal data in a way that complies with the RGPD and other privacy laws.

ℹ️ Google Signals can only be used by users who have activated Ad Personalization. When this option is enabled, Google can develop a comprehensive view of users' interactions with an online product or service across multiple browsers and devices.

When the Google Signals feature is activated, it collects more information in the following areas:

• Cross-platform reporting. Google Analytics links device data and user activity from different sessions via Google Signals or user ID data, enabling us to understand user behavior at every stage of the conversion process.

• Remarketing. Google Analytics data is used to create remarketing audiences that can be shared with your linked advertising accounts.

• Advertising reporting features. Google Analytics collects information according to the configuration of your tracking code, which includes data from Google Signals and Google advertising cookies, if present.

• Demographics & Interests. Google Analytics collects additional demographic and interest information from device IDs and users logged into their Google Accounts that have enabled Ad Personalization.

Google Analytics 4 (GA4) and Google Signals

Once you've set up Google Analytics 4 (GA4), you'll discover that Google Signals uses one of three user tracking options:

• User ID

• Device ID

• Google Signals

☝ User ID is the most reliable method of tracking users across different devices, but they must give their consent to the use of cookies or be authenticated or logged into your website or app at each session, which is not always the case.

Device ID is also effective, but only in combination with cookies. Without cookies, certain problems can arise, such as the same user being reported several times due to cookie duration limits in some browsers.

Google Signals collects aggregated user data. It is therefore a feature that complies with the GDPR and other privacy laws. While it doesn't replace the full tracking capabilities of cookies, it does provide aggregated data from a single user session, describing their behavior.

When Google Signals is activated, existing GA functionalities are enhanced, giving you a consolidated view of user behavior. Please note that Google Signals is only operational for those who have activated Ad Personalization.

ℹ️ If the User ID is not available, GA4 will automatically switch to Google Signals for data collection. You can change the default order of tracking options. For example, you can set Google Signals as the second option.

To activate Google Signals, please consult the Google documentation. Aggregated data is not shared with other Google products following activation of Google Signals. If you wish to share this data, configure your data sharing and product linking settings.

The problem with Google Signals

Although Google Signals offers apparent advantages in theory, its practice reveals complexities.

For reasons of data protection and user anonymity, Google Signals may affect your reports by hiding certain data. Warnings on your reports indicate the impact of these data thresholds in GA4 :

☝ We recommend disabling Google Signals.To avoid threshold effects you can disable Google Signals.

ℹ️ GA4 does not transfer data from Google signals to BigQuery, which may lead to discrepancies in the data reported. You may observe discrepancies in the number of events per user between Analytics and BigQuery.

Google Signals and RGPD compliance 🇪🇺

Upon activation, Google Signals collects user data that is aggregated, anonymized and not processed by third parties. In this way, Google Signals complies with the RGPD and privacy laws.

Here's what you need to do to comply with the regulations:

• Include the necessary privacy disclosures when activating Google Signals.

• Have a Privacy Policy explaining that Google Signals collects and processes personal data, even if it is aggregated.

• Inform and obtain the consent of users for the collection, processing and use of their personal data for advertising purposes.

• Use a consent management platform to manage Google and other user consents.