10 Total
3 High severity
4 Medium severity
3 Low severity
Summary

This is the Google Analytics Terms of Service, governing business entities' use of Google's web and app analytics platform, including collection and processing of website visitor behavior data (page views, transactions, screen views, and other interaction events) through Google's measurement code and SDKs installed on the account holder's properties. The agreement requires account holders to post a privacy policy on their properties disclosing that data is collected and shared with Google, and prohibits sharing personally identifiable information with Google through the service. The agreement also permits Google to use non-personally-identifiable, aggregated Customer Data to improve Google products and services, and authorizes Google to combine that data with data from other sources.

Technical / Legal Breakdown

This Agreement governs use of the standard Google Analytics service (including UA Properties and GA4 Properties) between Google LLC and the executing entity, establishing contractual terms for data collection, processing, and reporting on website and application user behavior. The agreement states that Customer Data (data collected concerning characteristics and activities of Users) is processed by Google on behalf of the account holder, who retains ownership; the terms authorize Google Affiliates' support staff to log in under customer passwords to maintain the service, and authorize Google to use aggregated, non-personally-identifiable Customer Data to improve Google products and services. The agreement asserts broad indemnification obligations on the account holder for third-party claims arising from their use of the service, combined with a mutual liability cap at $500 and a mutual exclusion of consequential damages; the agreement also expressly restricits the service to business use only, excluding consumer (personal) use, which operationally limits applicable consumer protection frameworks in some jurisdictions. The agreement engages GDPR (through explicit reference to the Google Ads Data Processing Terms for EEA/Switzerland/UK contexts), CCPA, and general FTC consumer protection frameworks; the privacy policy disclosure obligation in Section 7 and the data sharing provisions in Section 7 create compliance dependencies that vary by jurisdiction, particularly for EU/EEA-based account holders whose data processing arrangements may be governed by separate data processing addenda rather than these terms alone.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Start Compliance free trial
High — 3 provisions
Medium — 4 provisions
Low — 3 provisions

Monitoring

Google has updated this document before.

Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →

Compliance Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Compliance free trial

Cross-platform context

See how other platforms handle GDPR and EEA Data Processing Terms and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

BIPA
Illinois, USA
View official text ↗
CCPA/CPRA
California, USA
View official text ↗
COPPA
United States Federal
View official text ↗
CFAA
United States Federal
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
CAN-SPAM
United States Federal
View official text ↗
DMA
European Union
View official text ↗
DMCA
United States Federal
View official text ↗
DSA
European Union
View official text ↗
FCRA
United States Federal
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
GLBA
United States Federal
View official text ↗
HIPAA
United States Federal
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
UK GDPR
United Kingdom
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
VPPA
United States Federal
View official text ↗

Related Analysis

Privacy · May 5, 2026
Chrome Installed 4GB of On-Device AI. What Google's Policies Authorize.

Google deployed Gemini Nano through Chrome updates, enabling on-device AI features for some users — often without clear user awareness or e…

Privacy · April 16, 2026
What Google Actually Knows About You

Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.

Dependency Governance · May 27, 2026
Zero-Click Governance: What Google's AI Search Transition Means for Traffic-Dependent Businesses

AI Mode, AI Overviews, and embedded advertising are shifting search from referral infrastructure toward platform-contained answers.

Archival ProvenanceSource & Archival Record
Last Captured May 20, 2026 12:17 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000900
Version ID CA-V-002798
SHA-256 e93812d6cd934c5148ba08a7382281fe695fb37d98c600b90d15b1c5dd1d397f
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans