With GA4 server side tracking: Where is the database?

Question

With E.U. based websites, being compliant with the GDPR is a requirement. Googles promise with Google Analytics 4 and server side tracking is, that this setup will be compliant (as per their definition). After reading about it and seeing that both servers, the Google Tag Manager Preview and the Tagging server, can be set up in multiple environments outside of Google, I can see where Google is heading *).

The final question remaining unanswered to me is: Where is the database?

The reason I am asking is that if Google still persists all data in the U.S., then nothing changed as the Privacy Shield is of no help for good reasons.

*) Yes, they are also trying to move around the first party cookie and DNS limitation imposed by nearly all current browsers as per the California Consumer Privacy Act (CCPA), GDPR and ePR requirement.

Please note that this question does not search for legally circumvention. Meaning "everything's allright" does not answer this question. It's just about data storage for analytics/ tracking data. As a bonus it seeks to answer if a custom database or a database in a webmaster/ dev/ sysadmin defined location can be set up. Thanks in advance.

Answer 1

The database is wherever Google hosts it. Likely in the US. You can get the endpoint, ping it, then conduct the ip lookup and see the country. The collect endpoint is not necessarily where the data is stored, but it's definitely where the data touches, so can as well be treated as the storage location. Actual storage is not advertised.

Third party cookie limitation has virtually no influence on GA. First party cookie is untouchable. People like to talk about scary third party cookie ban. It's not a big issue for tracking people, it's mostly affecting retargeting, which is really quite an annoying thing anyway.

The regulation towards the data storage location is, really, seen as mostly a laughing matter by Google and Adobe: the two biggest suppliers of analytics solutions. And it kinda makes sense in our age of globalism. From the companies' perspective, the data should be stored where the companies have the best ability to maintain it.

The alternatives that allow the data to be stored in custom places are just way too expensive for typical Google's customers to go by unless they already do the ETL and host their data on their own servers, which, again, is completely possible with pretty much any TMS, including GTM. It's just pricy to host your datalake, also now you need to maintain the ETL process, plus now you need a data scientist rather than a digital analyst. About three times more expensive if you're smart about it. But also gives a lot more analytics capabilities, hence more insight.

People, however, miss that it's not just GA/AA that host sensitive data in the states, it's also Facebook, Instagram, Twitter, Reddit, Google Ads, Bing, etc. So really, if the aim was not to "leak" even anonymized user data to the US servers, a company would have to say no to about 90% of its advertisement and that automatically means the competition will just grab 90% of its market.