When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?


Yes, it would be too obvious a loophole otherwise. You'd just put a shell company in front of the actual business, and have that shell company claim it didn't hold onto any data.

Formally, you are the Data Controller, and Google is a Data Processor. You must have a contract in place with Google that guarantees you can abide by GDPR obligations.


Just to add to the (correct) answer already given by @MSalters.

You can escape this obligation by not letting Google Analytics process personal data on your behalf.

You can do this by enabling the GA IP-anonymization feature.

If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) contract in place with Google in order to comply with the GDPR.

This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.

  • OK that's a very CRITICAL piece of information! Thank you! – Ole Jun 5 '18 at 16:49
  • Please note that enabling IP anonymization will not necessarily make your data anonymous, as Google usually stores user IDs associated with events (either auto-generated ones stored in cookies or an ID that you provide to Google), so the data is at best pseudonymous. Why? Given such a user ID you can extract data related to a specific person from GA, hence the data is not anomymous. – ThePhysicist Dec 18 '19 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.