A GUIDE TO SETTING UP GOOGLE ANALYTICS FOR KIDS’ APPS AND SITES

Currently, we are not aware of any analytics solutions that can guarantee compliance with kids’ data privacy laws, eg COPPA or GDPR-K. If you decide to use a solution such as Google Analytics on your kids’ site or app, then you will need to configure your set-up to minimise the collection of personal data including persistent identifiers.

You should always establish their own data compliance policies and seek the advice of duly qualified professionals, including legal advice, as applicable. This guide is offered as general information only. It is not and should not be considered legal advice nor can it be relied upon to guarantee your own compliance.

Current data privacy laws in the US and EU restrict the collection and processing of personal data from children under 13 (US) or under 16 (EU). Other countries such as China and India are rolling out similar legislation. In each case, personal data includes things like IP addresses, geolocation, usernames, device IDs, and other persistent technical identifiers.

As a publisher (website, app, connected toy or other digital service) you are legally liable for any such data collected from kids using your service. When you rely on third-party technology, you must ensure they are compliant too. We often get asked how to configure Google Analytics (or similar solutions) to be compliant on a kids’ site.

For this reason we have created a practical guide to help you set up your Google Analytics account to optimise for compliance with the rules and best practices in relation to kids. The guide covers key risk areas when you use Google Analytics, including IP addresses and geo- location; data sharing settings; advertising features; data collection settings; and audience marketing.

We recommend that you:

1. Truncate IP addresses so that precise location cannot be collected or used:

A. If using /analytics.js/ you should select the ‘anonymizeIP’ setting when you initialize Google Analytics on your page. This must be done prior to setting up any events and should be set-up as follows: ga(‘set’, ’anonymizeIP’, true)

B. If using Google Tag Manager, you can adjust the settings in your tag by going to: “More Settings” > “Fields to Set” > Add new field named ‘anonymizeIP’ with a value of “true”

[source: Google LLC] Version 1: 18042019

2. Disable data sharing settings in your account:

Go to “Account Settings” > “Data Sharing Settings” and disable the following options:

Data sharing with Google Products & Services

Data sharing with account specialists

Give all Google sales experts access to your data

[source: Google LLC] Version 1: 18042019

3. Change property settings to adjust tracking and advertising features:

A. Go to “Property Settings” and ensure the following is disabled:

“Advertising Features” > Enable Demographics and Interest Reports

[source: Google LLC] Version 1: 18042019

[source: Google LLC]

B. Go to “Tracking Info” and change the following:

“Data Collection” > disable “Remarketing” and “Advertising Reporting Features” “Data Collection” > set to the lowest possible value (currently 14 months) “User ID” > “Off” “Session Settings” >

О 30-minute session timeout О 60-day (2 month) campaign timeout

[source: Google LLC]

C. Under “Product Linking”, data sharing should be disabled (where possible).

This is to prevent any analytics data feeding into other Google services.

[source: Google LLC] Version 1: 18042019

D. “Postbacks” should be disabled where possible (unless you can verify that

the ad networks that send post-back data are compliant with applicable data protection laws)

[source: Google LLC]

E. “Audience Definitions” should be disabled.

By disabling “Remarketing” under Step 3(B), “Audience Definitions” should automatically be disabled. Use this step as a way to double-check.

Version 1: 18042019

The above set-up will have an effect on what you can and cannot do with user data across your sites/apps. The below chart briefly outlines some of these effects:

CAN STILL DO CANNOT DO

• Determine the location of users (eg, country, city) visiting website/app

• Contextually target users with advertising

• Track user flows, referring websites, etc.

• Retain user data for up to a maximum of 14 months

• Report on demographics (including age/gender) and/or user interest categories (affinity/in-market segments)

• Target users with interest-based advertising or re-marketing campaigns

• Benchmark against other companies

o Includes benchmarking against channel groupings (display, social, paid search, etc.), location, device types

o Includes benchmarking metrics such as

session data, bounce rates, etc.

Version 1: 18042019

[source: Google LLC]

Version 1: 18042019