Overview

Privacy & Governance

Analytics is powerful but comes with legal responsibility. You must protect visitor privacy.

Key concepts

PII (Personally Identifiable Information):

• Data that identifies a person
• Name, email, phone, SSN, payment info
• Must NOT be sent to Adobe without explicit consent

Consent:

• Permission from visitor to track them
• GDPR, CCPA require explicit opt-in
• Must be granular (opt into analytics, not all marketing)

Data residency:

• Where your data is stored
• EU data cannot go to US servers (GDPR)
• Australia has data sovereignty rules

Regulations

GDPR (Europe)

• All EU visitors: explicit consent required
• Must allow opt-out
• Rights: access, deletion, portability
• Fines: up to 4% of revenue

CCPA (California)

• All California residents: right to know, delete
• Opt-out available
• Fines: up to $7,500 per violation

Other

• Canada PIPEDA
• Australia Privacy Act
• China data residency rules

Rule of thumb: If you don't know, assume GDPR applies.

Privacy in Adobe Analytics

Consent with Web SDK

alloy("setConsent", {
  consent: [{
    standard: "IAB TCF",
    value: consentString
  }]
});

Data minimization

• Only collect what you need
• Don't collect email/name/payment info
• Use hash for user ID (not plain email)

Data retention

• Admin → Report Suite Settings → Data Retention
• Delete historical data after 90 days, 1 year, 3 years
• Cannot keep forever

User rights

• Visitor can request: "Delete my data"
• Adobe supports Privacy API
• You have 30 days to fulfill

---

Next: What must never reach Adobe Analytics