Kruso Blog | Cookies from Google Analytics vs. GDPR

”Loopholes” in Google Analytics for third-party cookies

Are you aware if your site uses third-party cookies, and if that's the case which? At kruso we experience that a lot of sites use third-party cookies like "DoubleClick", without the editors being aware of it. Certain options in Google Analytics grants permission to these types of third-party cookies on the website, which can be a huge problem GDPR-wise.

Cookies like "DoubleClick" can exist on website that (previously) have activated remarketing-tracking in Google Analytics. DoubleClick is Google's advertising network, and by having a "DoubleClick" cookie you share data about your visitor's behaviour and demography with a third party. The users therefore must give permission to allow this cookie according to GDPR. If you are not aware that a third party have access to your user's data, you won't ask for abovementioned permission - and thus arises the problem.

Luckily it's simple to deactivate access for third parties like "DoubleClick" if you dont want to use them and ask your users for permission. We therefore recommend that all editors complete two steps in order to get a clear picture over the active cookies and close the loopholes.

Check your site and get a clear picture of your cookies

An easy way to check what cookies your site uses is by using a tool like ”Attacat Cookie Audit Tool”, which is a Google Chrome extension. Enable it, surf around on the site, disable it and check the report. If you spot cookies of which you have doubt, you are very welcome to contact us. We would love to help you scan your site and find a solution, so you don't break the rules of data protection and/or cookie consent.

Close the loopholes for third-party cookies like ”DoubleClick”

If you don't actively use remarketing and therefore dont ask your users permission to place remarketing cookies like "DoubleClick" at them, you should deactivate the possibility to use them in your Google Analytics setup. Even though you have never used remarketing you should still check if these options are correctly set up.

All it takes is that you open Google Analytics, click on "Administrator" -> "Tracking Info" -> "Data Collection" and deactivate both parimeters "Remarketing" and "Advertising Reporting Features" (if they are not already deactivated) and finally save the new options.

Alternatives to Google Analytics

One of the most debated subjects since GDPR became law in May is if the use of Google Analytics would conflict with the regulation. The challenge with Google Analytics is that you, as a business or organisation, don't own the data that Google collects about your users and their behaviour. You are therefore responsible for that Google can't collect sensitive information. It is possible to comply with GDPR and at the same time use Google Analytics, but it demands more of you as a business than if you choose a different solution, where you own the generated data and thereby doesn't share it with a third party. We recommend Siteimprove Analytics which is the most advanced tool on the market. Siteimprove makes it possible for you to take ownership of all the data that is generated from your website. If Siteimprove sounds interesting please feel free to contact us so we can set up a demo and show you your options. Another possibility is self-hosted data services like Piwik which is a cloud-based data analytics platform that also grants you ownership of the collected data. You can find other alternatives here.

About Siteimprove

Siteimprove is a super intelligent crawl-software that can scan websites for errors in both SEO, content quality (like misspelling, dead links etc.), GDPR-issues and web accessibility issues. At the same time Siteimprove has it's own analytics tool that easily replaces Google Analytics and is far more user-friendly (and contains more functions). One of the benefits of switching from Google Analytics to Siteimprove is that it doesn't take ownership of your data. In other words, only you will own the data that Siteimprove collects from your users.

Siteimprove can be set up so each editor has his own responsibilities, and it is easy to set up rules (also called politics) that the content on the site must live up to. Furthermore are all errors split up into different categories so it's easy to judge whether an issue should be solved by an editor or a developer.

Give our CSO Rune Galschiøt a call on +45 3131 4888 if you would like to hear more about your options with Siteimprove. We will gladly set up a demo and show you just how much Siteimprove has to offer.

'Loopholes' for third party cookies in Google Analytics can cause GDPR-issues