Google Analytics and our commitment to privacy: What you need to know

As we use Google Analytics 4 (GA4) to measure website performance, it's essential that every communicator understands the privacy principles that guide our work.

The single most important principle is this: The University of Minnesota owns its analytics data, not Google.

Think of Google as a vendor we hire to process information for us. They are contractually obligated to protect our data. Here are the core principles you need to know:

• We own and control our data
  The University is the sole owner of all data collected in our GA4 properties. We control what is collected, how long it’s stored (within GA4’s configurable retention limits), and who has access. We can configure, export, and request deletion of data as needed.
• Google's role is a "data processor"
  Google acts as our service provider. They are contractually forbidden from sharing our data with other Google products (like Ads) or third parties unless we explicitly authorize it. They are also forbidden from selling our data.
• No personally identifiable information (PII) is allowed
  It is strictly against Google's terms and our policy to collect PII such as names, email addresses, or phone numbers in GA4. It is our shared responsibility to ensure our tracking setups do not capture this information in URLs, titles, or events.
• Privacy features are built-in
  GA4 is designed with privacy in mind. For example, IP addresses—which can infer a user's location—are automatically anonymized by default. The full IP address is never stored. This is a non-negotiable feature that protects user privacy.

Our goal with analytics is to measure collective behavior and trends—what content is working, which user journeys are most common—not to track individuals. By following these principles, we can gather valuable insights while upholding our commitment to user privacy.

Official Google resources

For those who wish to read the source material directly, here are the most relevant links:

• Google Ads Data Processing Terms: Core legal agreement that governs Google's role as a data processor for services like Google Analytics.
• Google Analytics Help: [GA4] Data privacy and security: Google's plain-language help center article explaining their commitment to privacy in GA4.
• Google Privacy Policy: Google's overall policy for its own products and users.