Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the introduction of this tool, I'm going to be asked what the security implications are.

Does using Google Analytics pose any security concerns? Are there any PCI compliance issues that it might introduce? And if there are no unreasonable concerns, how can I document this? I have searched Google Analytics website, and have found a privacy statement, but not a specific statement of what information their tool collects, or how it is stored.

share|improve this question
You should also consider using Piwik Web Analytics, which is free and open-source. You have to self-host it but with https and your own server you don't need to trust or share your data with a third-party (insert NSA joke here). I've moved completely off GA and I find Piwik far outperforms GA and is worth the extra setup effort. – Tom Brossman Jul 17 '13 at 8:57

To use Google Analytics, you have to insert a JavaScript snippet into the page that is served by Google. This gives Google the technical opportunity have this JavaScript do anything to your page or with your visitors. You certainly have to trust Google. You also have to then trust that this code isn't altered in transit. You have to trust that Google secures its infrastructure.

share|improve this answer
Thanks Stephen. I'm familiar with the technical aspects of how it works. I'm looking more for some policy or documentation from Google so that I have answers when these security questions come up. I need a way to document, from Google, what they actually do collect. – David Smith Jul 17 '13 at 14:34

The data officially is owned by the Google Analytics account administrator, as stated on https://support.google.com/analytics/answer/6004245?hl=en under account administrator control over data section.

When working on this similar initiative for an enterprise, I have utilized their IT information management ISO certifications 17021 and 27006. You can grab a valid certificate at https://storage.googleapis.com/support-kms-prod/8E2BD7B74E99E08E0E4F9FA870E49092BFE4

When considering Google employee's own access to user data, it's covered under their "Employee Access Controls and Procedures" document, but I assume is internal use only and can't find a copy. The closest supporting document I found is in reference to their Google Apps for Business product, found here https://static.googleusercontent.com/media/www.google.com/en/US/work/apps/business/files/google-apps-security-and-compliance-whitepaper.pdf

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.