This week I once again had the debate with a site's legal team about how using google analytics violates the privacy of a site's users.

This is not a huge issue for many sites, but if your site has a privacy statement, you are legally bound to adhere to it -- and many privacy statements are explicitly violated by the use of google analytics.

If your privacy statement says that "we log hits to our website by IP number and use that data to better understand how people use our site. No private information about our users is stored and no private data is shared with any company" AND you are using google analytics, you are breaking the law. You have violated your privacy statement.

I argued that the privacy statement of a site using Google Analytics should be clear. "we log hits to our website by IP number and use that data to better understand how people use out site. We use Google Analytics to do this review of website use, so any information that Google has keyed to your IP number will be coorliated with the logs of your visits to our site for whatever purpose Google's policy allows"

the end result was "Visits to this website are logged. These logs of information are used to better understand how people use our site. This analysis is done using the Google analytics service. Google's privacy policy may be found here (with a link to the google analytics Terms of Service page at http://www.google.com/analytics/en-GB/tos.html (see section 8 for privacy related info)

[note that the above privacy statement has been altered to avoid the possibility that you can use a search engine to determine the site, if you get an exact match, or one even close, you have found the wrong site]

here is the (lack of) privacy policy language that is suggested by google at that page:

"This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States . Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.".

So, essentially if you use google analytics you are violating the privacy of those that visit your website.

While they do say that they will not associate the server access information they gather about you by your ip# to any other data they have stored, it does not say anything about the 3rd parties that process data on google's behalf. Think twice before handing over so much data to the Google hive mind/data mine. There are plenty of Free Software tools available for analyzing your web server logs.

ahhhh. i feel better now. time to get back to work.