Site Policies

A change in technology can sometimes mean a change in policy. While we haven’t changed our security and privacy principles very much, there is some information you need to review:

  • Your data is secure with Universal Analytics.
    Universal Analytics adds features to Google Analytics, but our privacy commitments haven’t changed. Safeguards like IP masking, the Google Analytics browser opt-out add-on, data confidentiality, and security work with analytics.js, the Universal Analytics JavaScript library.
  • First-party cookie storage is minimized in analytics.js.
    The information stored in the local first-party cookie is reduced for analytics.js. Only an identifier made up of two randomly generated 32-bit numbers (e.g., 12345.67890) is used. Clearing or deleting cookies from a browser does not ensure that subsequent visits to a website will be considered new sessions in Analytics. Learn more about how to opt-out from Google Analytics.
  • Find out if a site uses Universal Analytics.
    It’s easy to tell if a website is using Google Analytics, including Universal Analytics. You can use developer tools built into most modern browsers to check if a web page uses Google Analytics. Note that it’s possible for a page to use both the classic Google Analytics (ga.js) and the Universal Analytics (analytics.js) JavaScript libraries at the same time.
  • Universal Analytics supports the Measurement Protocol.
    Universal Analytics introduces new collection technologies to Google Analytics, including the Measurement Protocol. Any site, app, or other digital device or service that implements the collection methods and/or features of the Measurement Protocol is responsible for providing notice and choice to users and customers according to our Measurement Protocol PolicyIn case you use a service that has implemented the Measurement Protocol, please check the notice given and choice offered by this service directly with the Google Analytics customer using such service, as the opt-out directly provided by Google Analytics does not affect data reported through the Measurement Protocol.
  • Universal Analytics supports data collection without browser cookies.
    The Universal Analytics collection methods (analytics.js and the Measurement Protocol) can be implemented and used to collect user interaction data without cookies. Learn more about how to opt-out from Google Analytics.


Data limits apply to Universal Analytics.

The data limits for standard and premium accounts apply to Universal Analytics. Data processing might be restricted to once a day if collection exceeds these limits.

Google Analytics customers are prohibited from sending personal information to Google.

The Google Analytics terms of service, which all Google Analytics customers must adhere to, prohibits sending personally identifiable information (PII) to Google Analytics (such as names, social security numbers, email addresses, or any similar data), or data that permanently identifies a particular device (such as a mobile phone’s unique device identifier if such an identifier cannot be reset), even in hashed form. Your Google Analytics account could be terminated and your data destroyed if you use any of this information.

Custom dimensions are the new custom variables.

Custom dimensions give you a flexible way to bring additional data into Google Analytics, so you can learn more about how users interact with your content. Custom dimensions should be used in Universal Analytics where custom variables are used in the Classic Analytics ga.js JavaScript library.

Referrals are processed differently than in in previous versions of Google Analytics.

By default, all referrals trigger a new session in Universal Analytics. For example, if a user is on your site, leaves but then immediately returns, this user has logged 2 sessions. You can, however, modify your tracking code to exclude all traffic from specific domains as referral traffic with the referral exclusions.

Data sent via a Universal Analytics collection method can only be processed by a Universal Analytics property.

When you implement a Universal Analytics collection method, like the analytics.js JavaScript for websites, SDK v2.x or higher for mobile apps, or the Measurement Protocol for other digital devices, you must send this data to a Universal Analytics enabled property. Data sent from one of these methods to a classic Google Analytics property will not be processed.

Tell users that you use Universal Analytics, and let them know their options.

Let your users know about these Google Analytics features, and give them proper notice about your implementation changes. Get consent or provide an opportunity to opt-out of your services.

When you implement Universal Analytics, it is your responsibility to ensure that your use is legally compliant, including with any local or regional requirements for specific notification to users.


Google Analytics Advertising Features allow you to enable features in Analytics that aren't available through standard implementations. Advertising Features include:

  • Remarketing with Google Analytics

  • Google Display Network Impression Reporting

  • DoubleClick Platform integrations

  • Google Analytics Demographics and Interest Reporting

By enabling these advertising features, you enable Google Analytics to collect data about your traffic via Google advertising cookies and anonymous identifiers, in addition to data collected through a standard Google Analytics implementation. Regardless of how you send data to Google Analytics (for example, via the Google Analytics tracking code, Google Analytics SDK, or the Measurement Protocol), if you use Google Analytics Advertising Features, you must adhere to this policy.

You will not facilitate the merging of personally-identifiable information with non-personally identifiable information collected through any Google advertising product or feature unless you have robust notice of, and the user's prior affirmative (i.e., opt-in) consent to, that merger.

If you've enabled any Google Analytics Advertising Features, you are required to notify your visitors by disclosing the following information in your privacy policy:

  • The Google Analytics Advertising Features you've implemented.

  • How you and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together.

  • How visitors can opt-out of the Google Analytics Advertising Features you use, including through Ads Settings, Ad Settings for mobile apps, or any other available means (for example, the NAI's consumer opt-out).

We also encourage you to point users to Google Analytics' currently available opt-outs for the web.

Because laws across countries and territories vary, and because Google Analytics can be used in many ways, Google is unable to provide the exact language you need to include in your privacy policy. Only you understand the unique aspects and special considerations of your business, and your privacy policy should account for this information that only you can provide.

Interest-based advertising (including Remarketing)

If you've enabled interest-based advertising, including Remarketing, with Google Analytics in connection with other Google services, you must follow the policies applicable to those Google services (like the Google AdWords Policy for Advertising Based on Interests and Location and its sensitive category restrictions, and the DoubleClick Services Platform Program Policies).
Comments