Following a recent period of renewed media debate about the legality of tracking website visitors with Google Analytics, Sara Andersson, founder of Search Integration AB and the blog No Ketchup, interviewed me about my opinions…

You can also read the original interview in Swedish.

1. You have worked inside the Google as the Head of Web Analytics EMEA, written books about Google Analytics and worked with the product since it was established. Can you give me your thoughts on how Google look at this product and how they handle data internally?

It was fascinating for me to see the other side of the fence when I joined Google. Prior to working in the field of web measurement, I came from a web development and SEO background, so I must admit to being quite nosey when I joined the company in 2005. Essentially, there were two key reasons for me taking the role:

• Google’s clear desire to drive the product forward. By that I mean the acquisition of Urchin was just the beginning of driving the web measurement industry forward (unlike so many acquisitions that fade away following the initial bubble)
• Google’s commitment to the end-user. Be it the user experience, priority, new features, or privacy. The advertiser, although very valuable and well looked after in their own right, actually comes after these.

I see no change in Google’s values today.

Google, like any organisation, uses data to understand its business – its products, its users and its customers. It collects data from all its products. As you might expect with Google, that happens at a very, very large scale. So large that you can think of a individual user as a grain of salt dissolved in the ocean. My point is that individuals are such a minutely small “data point” that it is irrelevant to the organisation. Google is interested in trends i.e. the next big thing. When you service hundreds of millions of users every day, focusing on individuals simply does not makes sense.

Also consider that although very popular, Google’s business model is built entirely on trust. Users of Google search, AdWords, Analytics, or any other product do not sign a binding contract. Users are free to go elsewhere at anytime – as you know, that is very easy to do in a digital world. Hence, form the very beginning Google has taken privacy seriously from an end-users point of view. In my experience that is unique – usually an organisation considers privacy issues form their own point of view.

2. The latest discussions on Google Analytics being illegal and the fact that they propose that people should not use GA on their sites, what is your reaction to this? Are the concerns legitimate at ALL?

To be frank, most of the mass media journalism I have seen on this subject has been very poor. It is disappointing because there are legitimate discussions to be had about online privacy. However what I have seen in Sweden (Expressen, Dagen Nyheter) and in Norway (Digi i Norway) is superficial and alarmist.

In short, there is nothing illegal about tracking a visitor to your website anonymously and in aggregate. Both these terms are important, because it is entirely possible for users to configure GA differently.

Here’s my privacy analogy:

A parent standing on a street corner counts the number of cars that drive pass a school gate. They are interested in safety and traffic flow. Hence they count the number of cars passing per minute, note their type e.g. car, SUV, buss, lorry etc., take a note of their speed and any other factors, such as weather and amount of day-light. All users of this particular section of road are effected by such data – the local commune, parents, children, teachers, commuters, shops and business, and delivery companies.

The observer has a legitimate reason to observe and measure traffic conditions and there are no privacy issues with this. No personal identifiable information (PII) is collected and traffic is reported in aggregate. That is, individuals are not tracked. This is how Google Analytics works.

Of course, you can modify my above analogy to make it very scary – and illegal. For example, the observer writes down license plates, takes photographs or videos drivers, stops drivers to ask for their name and address, and then follows them around to find out were else they drive to. In the online world there are tools that do this, but Google Analytics (as it stands now) is not one of them.

3. The latest EU privacy law is trying to stop people from tracking individual information. What is your thoughts on this in relation to Google Analytics as a product?

The EU privacy law covers the scary scenario I describe above. It was introduced in May 2011 across all 27 member states is now quite clear about this. Essentially, it makes is illegal to collect PII without explicit consent. In other words you have to get permission from the visitor first. In addition:

• Site owners must have a best practice privacy policy in place describing what tracking is taking place and this must be easily accessible – read my explanation and anatomy of a privacy policy in detail.
• If you are tracking anything more than anonymous AND aggregate visitor information, you will also need explicit consent form your visitors.

If all you are using Google Analytics in a benign way, then I say you do not need explicit consent from your visitors as nothing that Google Analytics does is illegal.

The BIG caveat is 3rd party add-ons…

As a website owner you must understand what tracking technologies are deployed on your website(s). It is unlikely that Google Analytics is the only tracking instrument you have. “Add-on” products such as DoubleClick, Adsense, Disqus, YouTube, ShareThis, LivePerson Chat and social plugin buttons (Tweet me, Follow me, Facebook Like, Google Plus, LinkedIn etc.), all set 3rd-party cookies that track individuals. That is, individual browser behaviour is being tracked around the web. If you deploy these you need explicit consent from the visitor.

The bottom line is that you must audit your website to understand the privacy implications to your visitors. I discuss this more in my article: Google Analytics and the new EU privacy law #3.

4. Why does Google Analytics get all the focus in the debate about privacy? Are there other services and tools that in your opinion, website owners should be aware of when it comes to tracking sensitive data?

I guess it makes sense that the market leader gets the most scrutiny. It is estimated that more than half of the web and 45% of Fortune 500 company use Google Analytics. I don’t think G are concerned about the attention itself. Privacy considerations are a big part of all product development – from the ground up. Google may not always get it right, but from my experience the product teams do think long and hard about privacy issues so they are well prepared for this type of scrutiny.