The world’s largest surveillance system is watching you.
It’s capturing (almost) everything you do on the web on (almost) every website. And it’s hiding in plain sight.
And it’s “legal” because it’s claiming that you know about it,
and that you consented to it.
But do you know what it is?
Do you know what “analytics” is? Websites use analytics services to give them insights into how their users interact with their sites. Every website wants to know that. And analytics providers can give them that information. For example, an analytics provider can give detailed statistical reports to a website about their users and how they interact with its site: how many people visited the site, where did they come from, what did they view or click on, how did they navigate the site, when did they leave/return, and many, many other characteristics. This data can be collected and collated over years, over thousands or millions of users.
There are many providers of analytics service, but according to analysts, there is only one 800-pound gorilla, Google Analytics.
“Google Analytics has market share of 89.31% in analytics market. Google Analytics competes with 315 competitor tools in analytics category.
The top alternatives for Google Analytics analytics tool are Tableau Software with 1.17%, Vidyard with 0.78%, Mixpanel with 0.59% market share.”
And according to other third party analysts: “As of 2025, Google Analytics is used by 55.49% of all websites globally. This translates to approximately 37.9 million websites using Google Analytics.”
You get the point: one company, one service is capturing the bulk of the web traffic on the planet. Websites get statistical reports on the user interactions on their sites. Google gets individual-level information on the actions of most everyone on the web, on most websites, click-by-click, globally. Wow.
Legally, a website that uses Google Analytics is contractually obligated to obtain "consent" from its visitors to apply Google Analytics. But often the disclosure on those websites is cursory, or even incomprehensible: “we use analytics”, or “we use analytics software for statistical purposes”...which sounds harmless, but hardly would explain what’s happening to the average user. Technically, what happens is simple, but invisible to the average user: when they click on a website, that website auto-transfers to Google, in real time, detailed information about every step a user takes on its site. What’s happening is very simple. A site using Google Analytics incorporates a small piece of code on its site which auto-transfers to Google, in real time, information about every interaction its users have: every visit, every click, and information about each of those visitors, on an identifiable basis.
In fairness, Google Analytics has some privacy protections. Its reports to its client websites are statistical, rather than reports at individual users. But even if the websites don’t get information about users at an individually-identifiable level, Google does…. And Google does not do cross-site correlation, i.e., it does not profile users across sites, for Analytics purposes. (Note, Google does exactly this cross-site correlation in the context of its Ads businesses, but that’s a different topic than this blog.)
All this is “legal” if it’s based on consent. A phrase disclosed in a privacy policy, or a cookie notice, no doubt you’ve seen, or maybe clicked on, is deemed to constitute “consent”. But really, did you or the average user have a clue?
I’m in the school of believing that analytics tools represent a relatively low level of privacy risk to individual users. But what do you think if one company is getting real-time information about how most of humanity is engaging with websites on a planetary level? A user goes to any random site, but their data also auto-transfers to Google, did they know? Since the scale of this service vastly exceeds any other service on the web, the scale of this data collection is the largest on the web. Please respond with a comment if you can think of anything of similar surveillance scale. I know you can’t, but let’s engage in the thought experiment. I’m not picking on Google (I love my former employer), but in this field, which is essential to privacy, it’s the 800-pound gorilla, surrounded by a few mice.
And the photo, if you’re interested, is Chartres Cathedral, built in the era when we believed only God was all-knowing.
