I have not signed up our store for Google Analytics because frankly, it is so intrusive into the amount of data collected, like showing customers tags attached to them, discounts that we may not want just openly advertised, and it has the full permission to change anything in our store (literally)? It also has full permission to downgrade and block us in Google (and it appears that this stretches into our Shopify store - which may not be true, but the terms and conditions language is VERY concerning). So, for our store, dealing in CBD oils, Google does NOT allow CBD oils for Google Ads and has already blocked us in the Google listings - so as far as merchant analytics, I actually worry about what it can do. It wants access to our Gmail account? It’s google. They already have access - so this additional “linked” access which they otherwise would not get, including being able to shut down our paid Gmail account (yes - that language IS in there), is disturbing. I have appreciated Shopify’s analytics up until now, but this feels like this is crossing the line of our ability to run a storefront free of intrusion and abuse? Furthermore, the amount of data being collected on customer transactions may violate the PCI compliance with credit card data collected and NO ONE on Shopify’s end is discussing this? How is PCI compliance being maintained when the rule is a “need to know” basis and Google analytics does NOT need to know their credit card or personal shopping data? I am sure that the answer may lie in customer data not being transmitted to Google, but through our gateway accounts, but that is not entirely true (or so it seems?) when Google can access every detail of a transaction to the level of being able to CHANGE details in the transaction (and that is EXACTLY what their terms and conditions language states), which them gives them access to the shopping experience as it happens and they can intercept credit card numbers (and this is not a “crazy” concern as Google has gotten into trouble in the past doing this and has made no efforts to change this practice). Losing PCI compliance is a huge concern and very costly with our card processors.
How am I to promise our customers a secured and hassle free experience when Google can now hijack their shopping and “browser history???” data (not that Google already doesn’t access everyone’s data in some form or another), and make it appear to my customers that I’ve literally sold their data to Google (because they will blame us, the store owners - not Shopify and not Google)? Furthermore - I’ve read that I would have to pay for Google Analytics 4? WHAT? How is it they get ALL of our info, can LITERALLY control our store and change data, track ALL of our customers’ data (of which Google HAS been caught MULTIPLE times selling user data), and we have to pay them for it? There is supposedly a down-graded version that is free, but I’ve read the terms and conditions and it is no different in intrusiveness.
Please tell me that anyone else in the world here has a problem with this? Please Shopify - explain to us why we are paying for your service and you have been a trusted and amazing platform for so many businesses (at least up until now), but this is now our only alternative? All the “instructions” for turning off permissions are not built for a dummy like me to follow and even then, I fear that Google will just bypass those permissions every time it “updates” (this has been a very REAL problem for users with Google histories that they turn off but get “automatically” turned back on when Google does updates). And, in all the language of terms and conditions, Google Analytics can, at their own whim and timing, turn on any additional controls and features and accesses they want, without notice (because it’s up to us to constantly monitor Google’s terms???) - and yet I am supposed to have a “secure” account with Shopify that I can trust and offer my customers a “secure” transaction? I was considering opening a second store for one of my other companies, but now, I’m not so sure. There are other “analytic” alternatives - but it seems like all those cost? It’s just combining figures from a database into a chart - which is really not that hard - so, please tell me there is another option? Please tell me this concern is somehow controlled? Please tell me that you have a comprehensive, detailed and transparent list of the levels of access, when that access occurs, how it occurs, and what information may or may not be revealed at those levels? Please tell me that you have already legally secured PCI compliance in spite of what appears to be a concern? Please tell me that you have controls in place to ensure that Google cannot add programmatic features as it wants to, arbitrarily? Please tell me that Google will NOT change anything in my shop or emails? Please tell me why each level of control that Google Analytics is requesting is necessary.
I imagine: customer visit -tracking cookie, and this is used for site visits, where they came from, and what they did ONLY during a transaction - including a sign in by assigned customer ID only for repeats. That it only tracks what products they looked at and for conversion, what they purchased. Then, every other analytic is nothing more than tracking our monthly sales and reporting back. I cannot fathom what additional details would be needed? Sure - a customer assigned ID may also tell me if they signed up for emails, or perhaps I want to know which credit card type was most used in the store (which does not require knowing which customers used which cards as I can already see that without violating PCI compliance), but I don’t need Google Analytics to know more than that. Thank you in advance for your feedback.
I know this is already long, but I felt it important to include that I’ve done my homework and thus, my concerns come from this: The reason UA is being phased out has to do with some very poor security measures - so there is already a GDPR concern. The EC ruled in 2020 against Google in violation of GDPR rules (privacy shield invalidation rules). Some of the fixes suggested requiring customer consent and knowledge that Google Analytics was being used, but this does not resolve GDPR or PCI. There have also been questions raised by the PCI compliance groups as to the software programming language used by Google and that its proprietary standard which cannot be altered by customers to further protect users is a potential area of concern and is under review. In 2019, there were a LOT of people complaining because even 1 out of compliance portion of PCI, under scrutiny, caused everything to become non PCI compliant and this affected a lot of people (this was on a Google support forum, no less). Other web merchants employing GA4 have provided more advanced, customization of the GA4 integration due to the privacy concerns (especially in the healthcare field). That said, we utilize some of Google’s Gmail enhanced security and privacy features and within their own organization, we are compliant on these factors. Google DOES have PCI compliance - but only for their own software architecture and payment processing (Google Pay). I mentioned customer ID’s because that IS the tool used by GA4. They did away with session cookies and assign a ClientID & UserID - which singles and tracks individual user behavior using their specific cross-platform linking system (emails, social media, merchant accounts, etc). And for anyone tracking along - Google only recently had a “customer data hacking breach” - which, who becomes legally responsible for that? Google - or Shopify - or us little guys that auto-signed our customers up for this? Anyway - sorry to have made this longer, but my point is that I’ve done my homework and there is a substantial amount of concern and am hoping that Shopify has more than a generic explanation and can provide some security and sensability to this question. Thank you!!!