Disclosure: Google Analytics consultant. Not a Google employee, but my bread is very clearly buttered on one side here.
The article's use of that verbiage is deceptive. I think it's not actually a lie, but it's misleading.
When you use the Google Analytics product, Google is a Processor under GDPR and a Service Provider under CCPA. They are contractually bound not to process that data beyond providing the service to you, which is dashboards. It is illegal for them to dip into this data for their own purposes without additional authorization from the customer. (Note that in contrast, when you include a Facebook share button, Facebook is a Joint Controller and not a Processor.)
Sharing Google Analytics data with Google is possible but optional. It's fairly easy to do and encouraged (it enables certain features), but those checkboxes have big legal terms next to them that tends to give people pause.
In particular, the Advertising Features setting allows Google to make a connection between Google Analytics data and Google Ads or DoubleClick data.
This is a really good point. It's very disingenuous of the parent article to not mention that. Google being a Processor of data removes their ability to use this data for targeting and profiling.
Implication is that they have the ability. The only thing that removes their ability for targetting and tracking you is to block them at the browser or network level. Ie. don't give them the data in the first place.
Legal action against a multi-billion dollar corp. is the most expensive and about the last option for defending privacy of normal people.
I agree they probably aren’t doing it, but there is almost zero chance of a multi-billion dollar fine.
They’d just explain it away as an error and be given a few million dollar slap on the wrist.
It would be very easy for Google to make a plain language public statement about this and clear things up, the way Apple goes about their privacy/data handling.
The article's use of that verbiage is deceptive. I think it's not actually a lie, but it's misleading.
When you use the Google Analytics product, Google is a Processor under GDPR and a Service Provider under CCPA. They are contractually bound not to process that data beyond providing the service to you, which is dashboards. It is illegal for them to dip into this data for their own purposes without additional authorization from the customer. (Note that in contrast, when you include a Facebook share button, Facebook is a Joint Controller and not a Processor.)
Sharing Google Analytics data with Google is possible but optional. It's fairly easy to do and encouraged (it enables certain features), but those checkboxes have big legal terms next to them that tends to give people pause.
In particular, the Advertising Features setting allows Google to make a connection between Google Analytics data and Google Ads or DoubleClick data.